It happens every few months because Grub2Win, by necessity, does low level system calls, updates the Windows BCD and updates the EFI partition.
It has to do these things in order to function.
The virus scan companies regard this behavior as suspicious.
I report it to the virus scan companies from time to time and they fix it for another couple of months.
Then it happens again, as you see.
The only way around it is to disable your virus scan real time protection for a few minutes while you do the install.
You may also have to add a virus scan exclusion to the C:\grub2 directory.
You can examine and compile the Grub2Win source code yourself to satisfy yourself that there is no virus. The code is SSL signed by me to ensure that it has not been modified.
Hello.
im wondering if this is a false positive due grub2win changing system files?
let me know please! :)
also here

Last edit: peri xious 2025-12-06
Hi,
This is a false positive.
It happens every few months because Grub2Win, by necessity, does low level system calls, updates the Windows BCD and updates the EFI partition.
It has to do these things in order to function.
The virus scan companies regard this behavior as suspicious.
I report it to the virus scan companies from time to time and they fix it for another couple of months.
Then it happens again, as you see.
The only way around it is to disable your virus scan real time protection for a few minutes while you do the install.
You may also have to add a virus scan exclusion to the C:\grub2 directory.
You can examine and compile the Grub2Win source code yourself to satisfy yourself that there is no virus. The code is SSL signed by me to ensure that it has not been modified.
https://sourceforge.net/projects/sourcecode.grub2win.p/files/
There is little I can do about this other than reporting the false positives.
Thanks for understanding,
Dave
This grub2 option may work for you perixious.. Definitely not as pretty as Dave's app but supports multi-booting and has no security issues. :-)
https://forum.porteus.org/viewtopic.php?p=104216#p104216