Find us at Sim Global Expo 2027 - oesimracing exhibitor

Why antivirus flags SimHub, and what to do

Last updated · SimHub 9.11.22

SimHub triggers antivirus heuristics because telemetry software has to do things that look like malware: it listens on UDP and TCP sockets, reads another running process's memory, and uses cryptography for licence handling. There is no way to write it without those behaviours. It is a false positive. The fix, in order, is to force a Windows Defender definition update — new releases are usually cleared within about 24 hours — then report the false positive to your vendor, then add a folder exclusion, and only as a last resort install the previous release from GitHub.

This page does not tell you to turn your antivirus off. That advice is common, it is bad, and it is unnecessary here.

Why it happens

Modern scanners do not only match known malware signatures — they watch what a program does and score it. SimHub does four things that score badly, and it cannot avoid any of them:

It listens on network sockets
UDP for games that broadcast telemetry, TCP for the Dash Studio web server your phone connects to. A program opening listening sockets is one of the strongest heuristic signals there is.
It reads other processes' memory
Shared-memory games publish telemetry into a memory region and SimHub reads it directly. Reading another process's memory is exactly what a credential stealer does; the scanner cannot tell why you are doing it.
It uses cryptography
For licence validation. Encryption in an application that also touches the network and other processes' memory reads, to a heuristic, as ransomware.
It is unsigned or newly signed, and changes often
SimHub ships frequently. Every new binary has no reputation, and reputation is a large part of how SmartScreen scores an executable.

Put together, that is a profile which looks alarming and is entirely explained by what the software is for. This is the same reason debuggers, packet capture tools and remote-desktop software get flagged.

How to be reasonably certain it is a false positive

Trusting a webpage that says "it's fine" is not a security practice. Things you can check yourself:

  1. Where did you download it? Only simhubdash.com and GitHub Releases under SHWotever/SimHub are official. Download-aggregator sites repackage installers, and that is where real malware lives.
  2. Upload it to VirusTotal. A genuine threat is detected by most engines. A false positive is typically flagged by a handful, often with generic heuristic names — Trojan.Generic, Heuristic, ML.Attribute, Unsafe.
  3. Look at the detection name. Specific named malware is worth taking seriously. Generic and machine-learning attributions on a widely used application are the signature of a heuristic misfire.
  4. Check whether others are seeing it now. A new SimHub release being flagged is a recurring event with a discussion attached to it.

If you downloaded it from somewhere other than those two sources, treat the detection as real. Everything on this page is about the official builds. A repackaged installer from a download portal that gets flagged should be deleted, not excluded.

The fix, in order

  1. Force a definition update

    Windows Security → Virus & threat protection → Check for updates. New SimHub releases are usually cleared within about 24 hours of being reported, so an out-of-date definition set is often the whole problem. Try this before anything else — it changes nothing about your security posture.

  2. Restore the file from quarantine

    In Windows Security's Protection history. If it is re-quarantined immediately, the definitions have not caught up yet.

  3. Report the false positive

    Microsoft and every major vendor have a submission form. This is what actually gets it fixed for everyone, and it takes two minutes.

  4. Add a folder exclusion

    Exclude the SimHub install folder specifically — not your whole drive, not your user profile. A narrow exclusion on a folder containing one application you chose to install is a reasonable trade; a broad one is not.

  5. Last resort: install the previous release

    From GitHub Releases. Older builds have had time to acquire reputation. Update again in a week, by which time the current release will have been cleared.

What is deliberately not on that list. Disabling your antivirus. It is frequently suggested and there is no reason for it — a definition update or a narrow folder exclusion solves this without leaving the rest of the machine unprotected.

SmartScreen is a different thing

The blue "Windows protected your PC" panel during installation is SmartScreen, not your antivirus. It is a reputation check rather than a malware scan: it has not seen this exact file often enough to vouch for it.

Click More info, then Run anyway. The Run anyway button is hidden until you click More info, which is why people believe they are blocked outright.

New SimHub releases will always trip this at first, because reputation is accumulated per binary and every release is a new binary.

If it was already removed

A quarantined SimHub.exe looks like SimHub failing to start, so this and SimHub won't start overlap. Check Protection history first — if the file was quarantined, you have your answer and nothing else needs investigating.

Your settings, dashboards, profiles and licence live in %localappdata% and are not touched by antivirus removal of the executable. Restoring or reinstalling brings everything back as it was.

Common questions

Is SimHub a virus?

No. It triggers antivirus heuristics because telemetry software must listen on UDP and TCP sockets, read other processes' memory, and use cryptography for licence handling — the same behaviour profile malware has. Download only from simhubdash.com or GitHub Releases, and check the detection name: generic and machine-learning attributions on a widely used application indicate a heuristic misfire.

Why does Windows Defender delete SimHub.exe?

A heuristic detection on a new release that Defender's definitions have not yet cleared. Force a definition update through Windows Security — new releases are usually cleared within about 24 hours — then restore the file from Protection history.

Should I disable my antivirus to run SimHub?

No, and it is not necessary. A definition update or a narrow exclusion on the SimHub install folder solves it without leaving the rest of the machine unprotected. Advice to disable antivirus entirely is bad advice here.

How do I know whether it is a real detection?

Check where you downloaded it — only simhubdash.com and GitHub Releases are official. Upload the file to VirusTotal: a real threat is caught by most engines, while a false positive is flagged by a few with generic heuristic names. And check whether others are reporting the same detection on the same release.

What is the blue "Windows protected your PC" screen?

SmartScreen, which is a reputation check rather than a malware scan — it has not seen this exact file often enough to vouch for it. Click More info, then Run anyway. The button is hidden until you click More info, which is why it looks like an outright block.

Will I lose my dashboards if antivirus removes SimHub?

No. Settings, dashboards, profiles and your licence live in %localappdata%, which antivirus removal of the executable does not touch. Restoring or reinstalling brings everything back as it was.

Sources

SimHub is developed independently by Wotever and is not affiliated with oesimracing. This page was checked against SimHub 9.11.22 on 4 August 2026; where the interface has moved on since, the version stamp tells you how far. More on what SimHub is and what it costs.