Windows Defender false alarm on the game loader
A Defender update today wrongly flags our game loader; if your game stopped launching, here is what is happening and what we are doing.
A Windows Defender definition update released today incorrectly flags our game loader (driftwood-xiloader.exe) as a threat named Trojan:Win32/Bearfoos.A!ml. If your game suddenly crashes at launch or Defender reports quarantining a file, this is why.
Your computer is fine. The flagged file is the same loader every DriftwoodXI player has used since July. It is built from the open-source LandSandBoat xiloader project, and we verified the flagged copy is bit-for-bit identical to the one recorded in our source control. The !ml in the detection name means it came from an automated machine-learning guess, not a match against real malware -- 68 of 70 antivirus engines, including Microsoft itself until this week, consider the file clean.
What we are doing: we have submitted the file to Microsoft for false-positive review. Once Microsoft corrects the definition (typically a few days), Defender updates itself and the launcher restores the loader automatically on your next launch -- no action needed on your end.
If you want to play before the fix lands, you can restore the file yourself: open Windows Security, go to Virus and threat protection, then Protection history, find the Bearfoos entry for driftwood-xiloader.exe, and choose Restore / Allow. Only do this if you are comfortable with it -- waiting for the official fix is also completely fine.
We will update this post when Microsoft confirms the correction.