I installed Local from the official LocalWP source on Windows 11. While importing a private WordPress backup and attempting to use localhost Router Mode, AVG Internet Security repeatedly blocked Local-related command helpers.
Detection: IDP.HELU.PSE91 - Command line detection
Status: Blocked
C:\Windows\SysWOW64\cmd.exe
Detection: IDP.Generic - Command line detection
Status: Blocked
Local also reported that it could not update the Windows hosts file. AVG’s Smart Scan subsequently reported zero malware threats.
Closing Local stops the AVG alerts. Reopening Local or opening its Advanced preferences causes the cmd.exe alert to return.
I have not disabled AVG, added exclusions, quarantined Windows system files, enabled Live Links, or opened the imported website. The site remains stopped.
I need the environment to remain private and accessible only from this computer.
Questions:
Is there a supported way to use localhost Router Mode without Local invoking temporary PowerShell or batch-file hosts-maintenance commands?
Why does Local continue trying to modify the hosts file when the site is stopped or localhost Router Mode is being selected?
Can Local provide the expected command structure, helper-file details, or hashes needed to report these detections safely to AVG?
Is there a supported configuration that prevents repeated hosts-file maintenance without disabling antivirus protection or broadly allowlisting cmd.exe or PowerShell?
Please do not recommend disabling antivirus or globally excluding Windows command processors.
Hey @dieterscleaning – welcome to the community and thanks for documenting this so carefully.
I took a closer look at the Windows behavior you’re seeing.
The AVG’s alerts appear consistent with legitimate maintenance tasks performed by Local, rather than Local detecting or installing malware. Behavior Shield is reacting to how Windows tools are being used—not necessarily to a known malicious file. That also aligns with AVG’s Smart Scan finding no malware.
Local uses Windows command tools for a few different jobs, including:
Cleaning up Local services left behind after a previous session
Running WordPress maintenance commands when starting or importing a site
Detecting installed browsers and terminals
Requesting administrator access when the Windows hosts file needs updating
Some of these patterns—especially PowerShell process inspection, temporary helper files, administrator elevation, and hosts-file changes—are also used by malware. It’s understandable that behavior-based protection may flag them, even when they come from a legitimate application.
To answer your questions:
Localhost Router Mode should not require hosts-file maintenance.
Once localhost mode has been selected and applied, Local uses addresses such as http://localhost:10005 and should stop trying to add site domains to the Windows hosts file.
Local may still use cmd.exe or PowerShell for unrelated tasks, so choosing localhost mode will not eliminate every command-tool alert.
In Site Domains mode, hosts entries are maintained for all sites—even stopped ones.
Those entries describe Local’s configured domains and are not based on whether a site is currently running. This is why a stopped site can still lead to a hosts-file check.
Also, changing the router selection does not take effect until the preference is applied. If hosts-file prompts continue after localhost mode has been applied and Local has been restarted, that would be unexpected and worth investigating through the Local logs.
There may not be one stable helper hash to provide to AVG.
The files shown in the alerts are Microsoft’s own cmd.exe and PowerShell. Some elevated maintenance operations also create short-lived helper files whose contents and paths can vary by machine and Local version.
For an AVG false-positive report, the most useful information would be:
The exact Local version
The hash and digital signature of the Local installer/application
AVG’s full detection details
The process tree showing Local as the parent
The approximate time of the detection, so it can be matched with Local’s logs
Localhost mode is the supported way to avoid repeated hosts-file maintenance.
There isn’t a supported setting that keeps Site Domains mode while permanently disabling its hosts-file management. You should not need to disable antivirus protection or broadly allowlist PowerShell or cmd.exe.
For keeping the site private, leaving Live Links disabled is important—Local does not create a public tunnel unless that feature is explicitly enabled. A stopped site is not being served at all.
For the strongest “this computer only” setup, I’d recommend localhost mode with the nginx web server, Live Links disabled, and the normal Windows Firewall protections left enabled. Local is a development environment rather than a security sandbox, so it’s also sensible to scan any backup from an uncertain source before starting or opening it.
If you can share the Local version and the Local logs there should be a little more information. You can get a zip of those logs by clicking the “Download Local Log” button from the “Support” tab of Local. See this help doc for more information:
