Why Windows or an antivirus may warn about CyrFlip

Last updated: 24 September 2026

This page is for the moment right after Windows or your antivirus stopped CyrFlip. It says what the warning is, why it appears, exactly what to click, and what CyrFlip never does - in that order, so you can decide for yourself.

What the warning is

"Windows protected your PC"

This is Microsoft Defender SmartScreen. The blue window says: "Microsoft Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk." After you click More info it shows App: CyrFlip.exe and Publisher: Unknown publisher, with the buttons Run anyway and Don't run.

An antivirus quarantines or blocks CyrFlip.exe

The case reported so far is Avast / AVG, which names it IDP.Generic (Behavior Shield). Other antivirus products may use other names for the same kind of detection.

Where you meet it: the GitHub ZIP and the winget package (winget installs that same ZIP) can show these warnings. The Microsoft Store version is signed by Microsoft and does not show the SmartScreen warning.

Why it appears

CyrFlip is free, open source and made by one independent developer. The ZIP is not code-signed: a code-signing certificate costs money every year, and not buying one was a choice. SmartScreen trusts a file by its reputation - how many people have run that exact file - so a new, unsigned build starts with none, and the warning fades as a build is downloaded more.

There is a second reason, which signing would not remove. To do its job, a layout indicator does exactly what antivirus behaviour heuristics watch for: it installs a global keyboard hook (and, when the context menu is on, a mouse hook), it synthesizes Ctrl+C and Ctrl+V, it reads the clipboard, and it can replace the system text cursor. Running the program straight from a temporary folder (inside the ZIP, or %TEMP%) adds one more reputation flag.

The warning is doing its job on a file it does not know. The facts below let you judge the file yourself.

Exactly what to click

1. Unpack the ZIP to a permanent folder first, for example %LOCALAPPDATA%\Programs\CyrFlip\, and start CyrFlip.exe from there - not from inside the archive.
2. SmartScreen: click More info, check that the app is CyrFlip.exe, then click Run anyway. Windows remembers this for that file.
3. Antivirus quarantine: restore the file from the quarantine, and add an exception for that one folder only. Then report the false positive to your antivirus vendor (Avast and AVG both have a false-positive form on their websites), which helps every other user.
4. Optional check: compare the file's SHA-256 with the .sha256 file published beside the ZIP on the release page (Get-FileHash CyrFlip.exe in PowerShell), or upload the file to VirusTotal.
5. Or avoid the warning altogether: install CyrFlip from the Microsoft Store, which is signed by Microsoft.

Nothing here asks you to switch a protection off for your whole computer - one file, one folder, and you can undo either.

What CyrFlip never does

• Never asks for administrator rights for itself. It runs with your normal user rights.
• Never records, stores or sends your keystrokes. The keyboard hook only recognises CyrFlip's own shortcuts.
• Never sends anything anywhere - no telemetry, no accounts, no servers of its own. The one exception is the optional translator (off by default): it sends the selected text to the Ollama address you set, by default a program on your own computer.
• Never installs a service or a driver.
• Never writes outside your user profile, except a copy of the small layout file under %ProgramData%\CyrFlip in the Microsoft Store version, kept for older versions of the VS Code extension.
• Never starts with Windows unless you tick that option.

Administrator prompts you may still see

• A quick-launch scenario you marked run as administrator: the prompt is for your program, not CyrFlip. Untick the option in the scenario to stop it.
• Install Ollama in the portable version: CyrFlip downloads Ollama's official installer and starts it; any prompt it shows is Ollama's installer's own.

What it changes, and how to undo it

• Start with Windows - untick the option in CyrFlip's settings.
• The text cursor (off by default) - CyrFlip restores the standard cursor when it exits.
• Windows input settings (keyboard layouts, switch shortcuts), only when you change them on the Windows languages tab - that tab's restore button brings back the state you had.
• Its own settings and data - the registry key HKCU\Software\CyrFlip and the folders %LOCALAPPDATA%\CyrFlip and %APPDATA%\CyrFlip. Delete them after you exit CyrFlip and nothing of it remains.

The same facts, in more detail, are in the privacy policy.

If CyrFlip builds become signed one day, this page stays and says from which version.

Questions or a new warning to report: sza@ukr.net.