VirusTotal

[Greedeks]

A brief, surface-level explanation about viruses in GTweak, for those who have limited understanding of how such utilities work. GTweak does not have a bypass feature and will undoubtedly be flagged as a virus, specifically as a Trojan.
In general, antivirus software will classify it as: Trojan:MSIL/Disabler.92efcdf5, Trojan.MSIL.Disabler, Trojan.DefenderDisabler.Generic, Exe.trojan.disabler, and similar threats.

Bypass allows you to run or use software despite the checks, restrictions, or requirements that are supposed to block it.

It is important to distinguish between temporarily pausing Windows Defender and completely disabling it. The described utility fully deactivates Defender, including its graphical interface. To achieve this, it obtains the necessary TrustedInstaller, administrator, and WD permissions. Simply changing the registry settings is not enough, as SmartScreen continues to run in the background. The most effective way to block the execution of executable files is by renaming them.
Code

Merely inspecting parameters (GTweak checks over a thousand), as well as launching cmd or PowerShell and modifying the hosts file, are actions that easily trigger antivirus alerts.

As of version 5.2.0, this position is considered outdated:
Warnings regarding data transmission or sale violations arose because GTweak sent a request to retrieve your IP address and country code.
The request is made to http://ip-api.com/json/?fields=61439.

In version 5.2.0, three web services are employed. Two of these operate over secure protocols and enforce a daily request limit of roughly 1,000 calls each. In contrast, ip-api.com, although it uses HTTP, allows 45 requests per minute (around 64,800 requests per day). This high request threshold makes it an effective fallback option, ensuring that even if the primary and secondary services reach their daily limits, ip-api.com can still handle the load. Additionally, using three services helps maintain functionality in regions where one or more of them might be unavailable.
Updated request code using three web services

I want to remind you that the code is open-source, and downloading it from third-party sources puts you at risk, as the code could be altered.
I’d also like to remind you about the license - the utility is provided to you on an "as-is" basis. In other words, regardless of whether you use the utility or not, you take full responsibility for the consequences.
License

No one is compelling you; the decision and responsibility rest entirely with you.
Thank you for understanding.

[saper19722303]

Just why after installing this crap Sentinel in Protonmail he signaled sending passwords to postal accounts all over the internet ??? Why were there critical alerts about a burglary attempt? then explain.

[Greedeks]

@saper19722303 Because the utility sends a request to the server to get your ip address and country code. This is considered a potential theft of your data.
https://github.com/Greedeks/GTweak/blob/main/.Source%2FGTweak%2FUtilities%2FConfiguration%2FSystemDiagnostics.cs#L341-L354
Naturally, for protection, this means "stealing/selling" your data. I repeat, the code is open. If necessary, you can build a release version on your computer.