Windows SmartScreen warning

Symptom: running vfxm-win.exe shows a blue “Windows protected your PC” screen.

Cause: two things feed that screen — whether the file carries a signature from a publisher Windows can name, and how many people have already run that exact build.

From version 1.2.3 the installer, its uninstaller and reaper_virtue.dll are code-signed and timestamped. So the first half is answered: the security prompt names the publisher as Rodney Florencio da Costa, the name on the certificate, instead of saying the publisher is unknown. Certum Code Signing 2021 CA issued it, and it runs until 19 December 2027.

The second half still has to be earned. It is a standard code-signing certificate, which carries no automatic reputation, and it is new — so SmartScreen’s score for it starts at zero and climbs with installs. Some people will keep meeting the blue screen for a few weeks after a release. Seeing it does not mean anything is wrong with the file.

Installers for 1.2.2 and earlier were never signed, so on those Windows has no publisher to name at all. If that is the download you have, the page below is still exactly right for you, and the checksum is the only thing that proves the file is ours.

Fix

The full click-through steps live on the Install on Windows page: click More info, check that the publisher reads Rodney Florencio da Costa, then click Run anyway.

Check the file before you click through

Two checks, answering different questions. The publisher line on the prompt says the file was signed by Rodney Florencio da Costa and has not been altered since — on 1.2.2 and earlier there is no such line. The checksum says it is the same file we published, and it is the one check that works on every version. Download only from virtuecreativesystems.com, then compare the SHA-256 published on that page:

Get-FileHash .\vfxm-win.exe -Algorithm SHA256

or, in Command Prompt:

certutil -hashfile vfxm-win.exe SHA256

If it does not match, do not run it, and please tell us. A SmartScreen warning is also the symptom a genuinely malicious download would produce — the checksum is what tells the two apart, not the warning.

If the warning doesn’t go away after reinstalling

That’s expected — SmartScreen’s reputation score is per-file-version, not per-machine. Every new VFxM release has to accumulate its own runs, regardless of how many times you’ve installed a previous version. Now that builds are signed, the certificate accumulates a score of its own that later releases draw on, but it started at zero on 2026-09-17 and takes time to build.

Now that it is signed, has the warning stopped?

Not by itself. Signing changed one specific thing: the prompt names Rodney Florencio da Costa as the publisher rather than calling the publisher unknown, so you can see who built the file. Reputation is a separate score, and it is earned through download volume. Since March 2024 no class of certificate buys an instant pass, so a brand new build can still draw a caution screen for a while after it is signed.