Digital Defender - field check ============================== Thank you for running this. It helps more than you might think. HOW TO RUN IT (this is all you actually need) ============================================== 1. Double-click ddcheck.exe. There is nothing to install and nothing to unpack - it is a single file. 2. It tells you what it is about to do. Press Enter to start. 3. Wait a few minutes. That is it - there is nothing to uninstall. You do NOT need to be an administrator. Windows will show the publisher as "SmithyForge LTD". That is us - it is the company; Digital Defender is the product. YOU WILL GET TWO WARNINGS, and they are about popularity, not content. Chrome says the file "isn't commonly downloaded". Windows then shows a blue "Windows protected your PC" screen calling it an unrecognised app. Neither Google nor Microsoft has examined it and found a problem - it is simply new, and almost nobody has downloaded it yet. Every new program gets these until enough people have run one without incident. We are not going to tell you to ignore a security warning. Check it instead: - On the blue Windows screen, click "More info". It should show Publisher: 13010572, GB, Private Organization, GB, Surrey, SmithyForge LTD That number is our Companies House registration. An impostor can call themselves anything, but cannot make Microsoft display a verified UK company registration that is not theirs. If it says "Unknown publisher", do NOT run it and please tell us. - Or check the fingerprint against the one on the download page: Get-FileHash ddcheck.exe -Algorithm SHA256 Then it is your call. "Run anyway" is on that screen for a reason, but only use it once you have checked the publisher line. Prefer it to send nothing at all? Open a command prompt in that folder and run ddcheck.exe --no-upload It will write the report to your Desktop and go nowhere. Everything below is detail, and you are not obliged to read any of it. The program itself explains what it will do before it does anything, and waits for you to agree. The rest of this file is here for anyone who wants to check that what it says is true. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - WHAT THIS IS A measurement tool. It looks at the programs already installed on your PC and records what our (still experimental) detection engine WOULD have said about each one. We are trying to find out where it gets things wrong, and the only way to do that is on real computers that are not ours. ONE THING THAT MIGHT LOOK ODD: Windows will tell you this program is signed by "SmithyForge LTD", not Digital Defender. SmithyForge is the company; Digital Defender is the product. Software is signed by the legal company behind it, which is why the two names differ - but you should always be suspicious when they do, so we would rather tell you than have you wonder. WHAT IT DOES NOT DO It does not block, delete, quarantine, rename or change anything at all. It reads files; it never modifies them. It does not install itself, does not start a service, does not add a driver and does not run in the background afterwards. You run it once, it finishes, it is gone. There is nothing to uninstall. It is NOT antivirus and gives you NO protection. Please keep using whatever security software you already have. WHAT IT SENDS It writes a report to your Desktop, and sends a copy of that same report to reports.digital-defender.com. That is the only place it sends anything. YOUR FILES ARE NEVER UPLOADED. The report contains file names, sizes and fingerprints (hashes) - not the contents of anything. It also sends MEASUREMENTS of the programs on your machine that have no valid publisher signature - the numbers our detection model reads from a file, such as how its bytes are distributed and how large each internal section is. These are measurements ABOUT a file, not the file: they cannot be turned back into it and cannot be run. Signed programs are not measured this way at all. This is the part that lets us FIX the mistakes this report finds, instead of only counting them. If our model wrongly flags a program of yours, these numbers are what teach the next version not to. They are written next to the report, in a third file ending .vectors.jsonl, so you can see them. To send the report without them: ddcheck.exe --no-vectors It asks before it starts, and the report stays on your Desktop afterwards, so you can read exactly what was sent at any time. Be aware it lists file paths from your machine, which include your user name and show which software you have installed. If you would rather it sent nothing at all, run it like this: ddcheck.exe --no-upload and it will write the report locally and go nowhere. Then send it by hand, or don't - genuinely no hard feelings. WHAT YOU END UP WITH Three files on your Desktop, all starting "dd-fieldcheck-": the .txt - a readable summary, worth a look the .jsonl - the same information, one line per file, for our tooling the .vectors.jsonl - the measurements described above, one line per unsigned program (absent if you used --no-vectors) You don't have to do anything with them. They are your copy of what was sent. CHANGED YOUR MIND? Email Paul and say so, and the report is deleted. You don't need a reason. The machine name at the top of your .txt is how we find it. DON'T TAKE OUR WORD FOR IT "We only send X" is the sort of thing every program claims. Here is how to check, without trusting us: 1. The report on your Desktop IS the thing we sent. Not a summary of it, not an edited version - the same content. So reading it tells you exactly what we received. That is deliberate: it means we cannot quietly send more than we showed you. 2. Watch it go. Open Resource Monitor (search for it in Start), go to the Network tab, and run ddcheck. You will see connections to one place only, reports.digital-defender.com, at the very end. Nothing during the scan. (Two sends, not one: the report first, then the measurements separately, so a dropped connection cannot cost us the report.) 3. Run it with --no-upload and watch that tab stay empty. 4. If you are technical: ddcheck.exe imports seven Windows libraries -- kernel32, ntdll, api-ms-win-core-synch (files, threads) bcryptprimitives (hashing) wintrust, crypt32 (checking code signatures) winhttp (sending the report and the measurements, over HTTPS) winhttp is the only way it can reach a network. Check with: dumpbin /imports ddcheck.exe Search the file for hostnames and you will find exactly one that belongs to us: reports.digital-defender.com. You will ALSO find a dozen or so http:// addresses at sectigo.com, comodoca.com and usertrust.com. Those are not ours and we never contact them: they are part of the digital signature itself - the timestamp and certificate-revocation servers of the company that issued it. Every signed Windows program has them. The unsigned build of this file contains no http:// addresses at all, which is how you can tell they arrived with the signature rather than with the code. Even the signature checking stays offline: verifying a code signature normally looks up certificate revocation over the internet, and we deliberately restrict that to your machine's local cache. So the report upload is the only network activity there is. WHAT WE DO WITH IT We look at any file the engine would have blocked or asked about, and work out whether it was wrong. Files it got wrong are the whole point: they go into the test set so the next version does better. We do not upload your files anywhere, and we have no interest in what software you own beyond whether our engine mishandles it. RAN IT? SAY HELLO (optional, and only for one reason) The report arrives with no name on it. That is deliberate - we ask for nothing about you. But it also means that if we find something genuinely nasty on your machine, WE HAVE NO WAY TO TELL YOU. That has already happened once: a report showed a cryptominer that 55 antivirus engines recognise, still running on the machine that sent it. So if you are happy to be known, email support@smithyforge.com and say which machine was yours. Then we can warn you if something turns up, and ask you about anything odd we see. That is the only reason we would like to know. No mailing list, no newsletter, nothing else - and not telling us costs you nothing but that. QUESTIONS Ask Paul, or support@smithyforge.com.