Antivirus flags and boot issues

Antivirus software can flag ReviOS optimizations as false positives. Aggressive security heuristics often misinterpret telemetry blocking and replaced system stubs.

🛡️ Antivirus false alertsCopy Anchor Link

Third-party antivirus scanners and Windows Defender detect two specific ReviOS modifications. Both are safe and intentional.

🌐 Hosts file hijack alertCopy Anchor Link

1. Open Windows Security.
2. Navigate to Virus & threat protection > Protection history.
3. Select the SettingsModifier:Win32/PossibleHostsFileHijack entry.
4. Click Actions > Allow on device.

Windows Defender flags alterations to the system hosts file. ReviOS redirects telemetry domains to 0.0.0.0 in C:\Windows\System32\drivers\etc\hosts. This prevents Windows from transmitting diagnostic data to Microsoft servers. Defender treats modifications to Microsoft hostnames as potential hijacks.

📦 System32 stub DLL flagsCopy Anchor Link

1. Open your antivirus quarantine or protection history.
2. Restore any quarantined files from C:\Windows\System32\:
   • utcapi.dll
   • utcutil.dll
   • sqmapi.dll
3. Add exclusions for each file in your antivirus settings.

ReviOS replaces Microsoft-Windows-Unified-Telemetry-Client and Microsoft-Windows-SQMApi binaries with 2 KB stub DLLs. These lightweight stubs export empty functions without running tracking services. Antivirus behavioral shields flag the unsigned 2 KB replacements as suspicious file changes or ransomware.

⚙️ How stubs are compiledCopy Anchor Link

ReviOS compiles stub binaries using pestub.py in the Revision fork of sxsc. The generator reads YAML component definitions from telemetry-removal-amd64.yaml. It uses standard Python ctypes structures to assemble pure PE/COFF binaries.

The compiler configures each stub with specific behavior:

• DllMain entry points return TRUE to satisfy Windows loader checks.
• All exported functions execute a minimal return returning zero.
• Complete export directory tables match the original function names.
• Headers include valid PE checksums and alignment.

These stubs satisfy hard dependencies in Winlogon, recovery.dll, and SpeechUXWiz.exe. Removing these DLLs outright causes Windows to fail during boot. The stubs eliminate telemetry execution while maintaining complete boot stability.

🛟 Recover from boot hangCopy Anchor Link

If your antivirus quarantined utcapi.dll or utcutil.dll, Windows cannot start. The system hangs indefinitely at the boot loading screen because Windows login components require these files.

1. Interrupt normal boot three times to trigger the Windows Recovery Environment (WinRE).
2. Select Troubleshoot > Advanced options > Command Prompt.
3. Run the System File Checker to repair the missing system files:

   Copy Text

   sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

4. Close the command prompt and click Continue to boot into Windows.
5. Add exclusions in your antivirus for utcapi.dll, utcutil.dll, and sqmapi.dll.
6. Open Terminal (Admin) and reinstall the telemetry removal package:

   Copy Text

   revitool winpackage --install telemetry-removal

7. Restart your computer.

⚡ Prevent future blocksCopy Anchor Link

Add exclusions before running aggressive system scans.

1. Open your third-party antivirus settings.
2. Add folder or file exclusions for:
   • C:\Windows\System32\utcapi.dll
   • C:\Windows\System32\utcutil.dll
   • C:\Windows\System32\sqmapi.dll
   • C:\Windows\System32\drivers\etc\hosts
3. Save the exclusions.