Windows: libsafewoo DLL deleted by Chinese antivirus software (360, Huorong)

Summary

Windows users in China are experiencing app startup failures because antivirus software is deleting/quarantining the libsafewoo_amd64.dll file after installation.

Sentry Issue: ELECTRON-7F

• Events: 160 total (87 in last 24h)
• First Seen: 2025-12-13
• Release: safewoo@1.4.3
• Priority: High

Error

Error: Library initialization failed: Library file not found: 
C:\Users\...\Safewoo\resources\app.asar.unpacked\node_modules\libsafewoo\lib\libsafewoo_amd64.dll

Evidence

Analysis of 100 events shows:

1. Diverse Install Paths (59% non-standard)

15 C:\Users\Administrator\AppData\Local\Programs\Safewoo  (standard)
 6 F:\下载\Safewoo                    (download folder)
 5 D:\vpn\Safewoo                     (custom)
 3 D:\应用\Safewoo                    (applications folder)
 2 D:\360安全浏览器下载\Safewoo        (360 browser download!)
 1 D:\BaiduYunDownload\Safewoo        (Baidu cloud download)

2. Repeated Events from Same Users

• 160 events but 0 unique users tracked
• Same install paths appearing 2-15 times (user reinstalls, DLL deleted again)

3. Chinese AV Software Indicators

• D:\360安全浏览器下载\ path indicates 360 Security Suite
• Predominantly zh-CN locale users
• Files in download/temp folders get extra AV scrutiny

Root Cause

The libsafewoo_amd64.dll is being quarantined by Chinese antivirus software (360 Security, Huorong, Tencent PC Manager) because:

1. Unsigned DLL - Not recognized by AV signature databases
2. VPN/proxy behavior - Heuristics flag network interception as suspicious
3. Custom install locations - Download folders get extra scrutiny

Proposed Solutions

1. Code Sign the DLL (High Priority)

Sign libsafewoo_amd64.dll with a valid EV code signing certificate. Chinese AV software is less likely to quarantine signed binaries.

2. Improve Error Detection & User Guidance

// Detect AV deletion scenario and show helpful dialog
if (!fs.existsSync(dllPath)) {
  dialog.showMessageBox({
    type: 'warning',
    title: 'Security Software Interference',
    message: 'A required file was removed, likely by antivirus software.',
    detail: '1. Add Safewoo to your antivirus whitelist\n2. Reinstall to C:\\Program Files\\Safewoo'
  });
}

3. Warn About Install Location

• Detect installation in download/temp folders
• Recommend installing to Program Files instead

4. Add Chinese AV Whitelist Documentation

Provide instructions for:

• 360 Security (360安全卫士)
• Huorong (火绒)
• Tencent PC Manager (腾讯电脑管家)

Affected Code

• electron/src/modules/vpn/safewoo.ts:131-210 - initSafewoo() with retry logic
• libsafewoo/src_napi_addon/libsafewoo-napi.js:166-231 - MihomoClient.initialize()

Environment

• Platform: Windows 10 (various builds)
• Architecture: x64
• Electron: 39.0.0
• Release: safewoo@1.4.3