File integrity warnings

GalShelf remembers the digest of each game's launch programs (the accepted baseline) and warns you when a file later differs from it. A changed file can mean a legitimate patch or update, or tampering, for example by a worm or virus. GalShelf tells you that the file changed; it doesn't guess why.

Everything is on a work's page under 文件与完整性 / Files & integrity, with the choices on the card 检查与隐私选项（这台电脑） / Checks and privacy (this PC) and in Settings → 隐私与安全 / Privacy & Security.

What "modified" means#

• Desktop appAvailable in 0.2.8
• WebsiteNot applicable

When a launch program no longer matches its accepted baseline, the work and the file show a persistent warning, and a notification is added:

文件已被修改：可能是补丁、更新或病毒篡改，请核实来源并扫描。
This file has been modified. It may be a patch, an update or tampering by malware; check where it came from and scan it.

The warning shows the affected file, when the baseline was recorded and when the change was found. It stays, also after restarting, until you resolve it.

File states#

Baselines#

• A launch program's baseline is recorded the first time it is verified.
• Ordinary checks, background checks and cache refreshes never replace a baseline and never clear a warning.
• Every change to a baseline is kept in its history with the time and the reason.
• A warning disappears only when you accept the new file, or when a fresh hash shows the file matches its baseline again. 暂时忽略 / Dismiss for now hides it from the list, but the launch check still asks.

After a patch or update#

Game updates, fan translations and store repairs change files legitimately. When you see a warning after one of these:

1. Open the details and check which file changed and when.
2. Make sure the new file came from a source you trust. If in doubt, use the original store's or publisher's repair function, and scan the file.
3. Choose 接受为新基准 / Accept as new baseline, optionally with a note. The new digest becomes the baseline and the old one stays in the history.

GalShelf never deletes, quarantines, reinstalls or uploads a file on its own, and never accepts a replacement just because it still matches the same work. If the file changed again after you reviewed the warning, GalShelf asks you to recheck first. 完整重新核对 / Full recheck hashes the files again without using the cache.

Scan with Microsoft Defender#

• Desktop appAvailable in 0.2.8
• WebsiteNot applicable
• Real scan verdicts are available only where Microsoft Defender is the active antivirus.

Scan launch file with Defender and Scan game folder with Defender use Microsoft Defender, the antivirus built into Windows.

• GalShelf runs Defender's own command-line scanner for just those files, with remediation turned off: Defender reports what it finds but doesn't quarantine or delete anything during this scan.
• A scan can take up to 5 minutes for a file or 30 minutes for a folder, and can be cancelled.
• 未报告威胁 / No threat reported means only that Microsoft Defender reported no threat at that time. GalShelf never calls a file "virus-free".
• If Defender is turned off or not present, for example because another antivirus is active, the result is 无法使用杀毒扫描 / Antivirus scan unavailable, and GalShelf names the antivirus products Windows reports so you can scan with that product instead.
• A timeout, a cancellation or an empty answer from the scanner is shown as an error or as cancelled, never as a clean result.

GalShelf never installs or enables an antivirus, changes Defender settings, asks for administrator rights or sends your files anywhere.

When malware is detected#

Only a real scanner verdict may say 检测到病毒/蠕虫 / Malware detected. Then:

• Starting the work shows 已阻止启动：检测到病毒/蠕虫 / Launch blocked: malware detected with a link to Files & integrity.
• Remove or repair the files with your antivirus or the original distributor, then scan again; a scan that reports no threat clears the detection.
• If you are sure it is a false positive, you can mark it as one by typing the file's name to confirm.

Checks before launching#

The launch check (integrity.prelaunch) has three settings:

• If the launch program was modified, you see 取消启动 / Cancel launch, 用 Defender 扫描 / Scan with Defender and 仍然启动 / Continue anyway before the game starts.
• The check waits up to 6 seconds; if hashing takes longer you see 仍在核对启动文件 / Still verifying the launch file and can wait or continue.
• A malware detection blocks the normal launch button.

What it can't do#

• The background check (后台检查已记录的文件 / Check recorded files in the background) looks at file sizes and dates about every 10 minutes, starting two minutes after launch, and hashes only files that changed. A change that keeps both the size and the date is invisible to it; a full recheck, or the Always launch setting, catches that.
• There is no instant file watcher, so a change is found at the next check, not the moment it happens.
• A digest mismatch says the file changed. It doesn't say how or why.