Repository navigation
yt-dlp is detected as a virus #25
Description
Activity
It is a false positive caused due to the exe being unsigned.
This is a known issue. I don't have any way of fixing it.blackjack4494/youtube-dlc#114
https://www.reddit.com/r/youtubedl/comments/jrrkc0/youtubedlexe_shown_as_malware_on_virustotal/I have been told that the issue existed for the previous version as well
https://www.virustotal.com/gui/file/a89125033bff06983b0bec46424d62882395370a04b9ad909cf88da19c331292/detectionI will try reporting to microsoft, but it is impractical to do so with each AV seperately
Reacted by blackholeearth- changed the title
[-](latest version) yt-dlp 2021.01.20 trips windows defender as Trojan:Win32/CryptInject!ml[/-][+]youtube-dlc.exe is getting detected as a Trojan:Win32/CryptInject!ml[/+]on Jan 21, 2021 - pinned this issue
on Jan 21, 2021 You could try building it yourself to get around it, it's actually really easy even on Windows. One thing I noticed is the resulting exe is 500kb smaller using the latest version of Python.
EDIT: It doesn't get detected by Microsoft (on my system) but Malwarebytes still hates it.
https://www.virustotal.com/gui/file/bbae6034f44dc22262b1adf78ffb664c7da4cf4bdd027b2dbd5d5c9dc4f49ddb/detectionI am closing the issue since there really is nothing I can do to permanently fix this. If anyone has any ideas, feel free to continue this thread
- changed the title
[-]youtube-dlc.exe is getting detected as a Trojan:Win32/CryptInject!ml[/-][+]yt-dlp is detected as a virus[/+]on Apr 8, 2021 27 remaining items
For "normal" users, it is not recommended to run directly from source code. Unless you are familiar with git, it makes updating hard. If you dont want to use the exe, use pip/zip versions instead.
But for those who do want to run straight from source anyway, there is already
yt-dlp.cmdandyt-dlp.shin the root of the repo
Anyway, all of this is off-topic. Please keep the thread on topic.
PS: Unless anyone has any better ideas on how to take the AV venders off our heels, no point it writing any comment here. This issue was closed as
wontfixfor a reasonSeems like Bitdefender doesn't like ytp-dl but only when it's run.
Their ignorant response:
The analysis of the file has been completed:
Youtube downloaders often come with adware. Because of this, and because of the fact that youtube downloaders do not comply with youtube terms of service, we do not consider these types of applications trustworthy. Therefore, we will not take any steps toward whitelisting this detection.
Meaning they didn't even bother checking the file.
Reacted by Felix S., coletdjnz, gamer191 and clusterizedReacted by Jerry and quaternary@kamyker is that on a forum? I'd like to add my 2c if it's somewhere public, because I'm a long BD customer.
@kamyker is that on a forum? I'd like to add my 2c if it's somewhere public, because I'm a long BD customer.
No, emails. You can try asking them too here https://www.bitdefender.com/consumer/support/ . Don't do it too soon as they may think it's me again lol. I asked them again to at least analyze the file as that blocking behavior may also stop other apps working correctly and:
Thank you for getting back to me!
Unfortunately, as my colleagues from the AV labs provided us with the points from my last email, we cannot provide any other assistance regarding this issue.Btw in rare cases Bitdefender doesn't detect it depending on what link is used. No idea why that's happening.
Seems like Bitdefender doesn't like ytp-dl but only when it's run.
Their ignorant response:
The analysis of the file has been completed:
Youtube downloaders often come with adware. Because of this, and because of the fact that youtube downloaders do not comply with youtube terms of service, we do not consider these types of applications trustworthy. Therefore, we will not take any steps toward whitelisting this detection.
Meaning they didn't even bother checking the file.
I bet they are being paid by Alphabet to place this false-positive.
Reacted by france1 and Vangelis66- unpinned this issue
on May 17, 2022 I was bored, so I decided to run antivirus tests (using virustotal) on all the files in https://github.com/yt-dlp/yt-dlp/releases/tag/2022.05.18.
The results are as follows (files not listed below didn't have any timeouts nor positives):yt-dlp, yt-dlp.tar.gz, Source code (zip) and Source code (tar.gz):
Lionic-timeoutyt-dlp_win.zip:
Lionic and Clamav-timeoutyt-dlp.exe:
Webroot-W32.Trojan.Gen
Microsoft-timeoutyt-dlp_min.exe (this one had the most positive detections by far):
Fortinet-PossibleThreat.PALLAS.H
Ikarus-Trojan.Python.Psw
Jiangmin-Trojan.PSW.Disco.els
SecureAge APEX-Malicious
Webroot-W32.Trojan.GenHere's my virustotal results when I compiled from source:
Cylance - Unsafe
SecureAge APEX - Malicioushttps://www.virustotal.com/gui/file/10e0425544edc2ea778cf607057a773c5ee29d3ba138b23ef729eef8a7aeef83
Unless anyone has any better ideas on how to take the AV venders off our heels, no point it writing any comment here. This issue was closed as
wontfixfor a reason- locked as off topic and limited conversation to collaborators
on May 2, 2023 - marked When cookies.txt is used Kaspersky Internet Security recognizes yt dlp as a trojan #13794 as a duplicate of this issue
on Jul 21, 2025 - marked Windows Defender suddenly flags this. #16959 as a duplicate of this issue
on Jun 14, 2026
I felt like bug report is the closest topic.
It's probably a false positive but older releases didn't have this problem.