Windows Defender false positive

Restore Syringe so Yuri's Revenge games can launch

A recent Windows Defender definition update is quarantining Syringe, which is preventing games from launching. Follow these steps to restore syringe.exe from Windows Security.

Need help? Join the CnCNet Discord.

Language

The screenshots stay in English, but the buttons are in the same positions in other Windows languages.

What you may see

The game reports that it cannot launch, and Windows Security may show a Threats found notification.

Quick fix

Open Windows Security and restore the quarantined syringe.exe entry.

Windows Security Virus & threat protection Protection history Threat quarantined Actions Restore

Open Windows Security

Press the Windows key, search for Windows Security, then open the app with the blue shield icon.

Windows Start menu search result for Windows Security with the blue shield icon — Search for Windows Security from the Start menu.

Go to Protection history

In Windows Security, choose Virus & threat protection, then click Protection history.

Windows Security showing Virus and threat protection and the Protection history link — Open Virus & threat protection, then Protection history.

Open the quarantined threat

Find the entry marked Threat quarantined. Click the entry to expand it.

Windows may show an administrator prompt. Click Yes so you can manage the quarantined file.

Windows Security Protection history showing a Threat quarantined item — Expand the quarantined threat entry.

Restore syringe.exe

Under the expanded entry, open Actions and choose Restore. After restoring it, return to CnCNet and launch the game again.

Only restore the CnCNet syringe.exe entry. Do not restore unrelated files from Protection history.

Windows Security threat details showing the Actions menu and Restore option for syringe.exe — Choose Actions, then Restore.

Still having issues?

If Windows still blocks Syringe.exe located in your Yuri's Revenge installation folder, it may be Smart App Control or reputation-based protection. Exclusions do not bypass these checks, so they need to be disabled.

The Yuri's Revenge folder is usually C:\Program Files\EA Games\Command and Conquer Red Alert II.

Method 1: Disable reputation-based protection

Open Windows Security.
Click App & browser control.
Click Reputation-based protection settings.
Turn off Check apps and files.

Method 2: Disable Smart App Control on Windows 11

Open Windows Security.
Click App & browser control.
Click Smart App Control settings.
Turn Smart App Control off. If Smart App Control is turned off, it cannot be turned back on without resetting Windows or doing a clean install.

Method 3: Force update CnCNet

If Syringe.exe is still missing from the Yuri's Revenge folder, open CnCNet.
Open Options from the main menu, or press F12.
Go to Updater and click Force update.
When the update finishes, try launching the game again.

Windows message showing an app blocked by application control policy — Another Windows block message you may see.

Why is Syringe being detected?

Defender is detecting Syringe as HackTool:Win32/DllInject!MTB. Syringe is used by CnCNet to inject Ares, Phobos, and the CnCNet spawner into the game process.

This lets CnCNet add features, fix cheats, and support multiplayer launching. Syringe has been used by CnCNet for more than two years, but Microsoft recently changed the detection behavior.

Using another antivirus?

The exact names vary, but the process is usually the same: open your antivirus app, find Quarantine, Protection history, or Detected threats, then restore or allow the CnCNet syringe.exe entry.

If your antivirus offers exclusions, add an exclusion for your CnCNet game folder after restoring the file. Only do this for the folder where your trusted CnCNet installation is located.