My antivirus flagged python.exe or a suspicious website - is that Booked Solid?

Modified on Tue, 4 Aug at 6:33 PM

Your antivirus threw a red banner and the wording was not reassuring: Generic.HTML.Redirector.B.6EC20422, Accessed by: python.exe. One customer described it exactly the way most people feel it: My bitdefender caught python trying to do something illegal, followed by a warning email from my internet carrier. Booked Solid was open at the time, so the real question is the blunt one: my antivirus flagged it, is the app doing something it shouldn't?

The honest answer is that it may well have been us, and this article is how you tell. Booked Solid does run python.exe. Your lead engine is a Python program, and its job takes it out onto the public web, which is precisely the kind of traffic that trips a redirector alert. That is not a confession that something is wrong. It means the process name on its own settles nothing, and there is one check that does.

Yes, Booked Solid runs python.exe

The app itself is an Electron app, so most of what you see runs on Node. The lead engine is the exception. It is a Python program that ships inside the installer, and when a lead run starts the app launches it by running python with the arguments -m bsleads.run. On Windows that shows up in Task Manager as python.exe. It is started with its console window hidden, which is why you have never seen it go by, and that is the whole reason it can feel like something sneaking about.

One detail matters before you start hunting. The app uses the Python already installed on your computer, the one on your system PATH. It does not ship its own copy of Python. So right-clicking the process and choosing Open file location opens wherever Python lives on your machine, and tells you nothing either way. That is the dead end almost everyone hits first. Skip it.

What the lead engine is doing when it browses

The lead engine's job is sourcing: finding the people who book acts like yours. Corporate event planners, galas and fundraisers, agencies and speaker bureaus, venues, associations, colleges. Finding them means reading pages out on the open web, at a pace no human types at. That is all it is, ordinary web reading done on your behalf.

Now hold that next to the alert. Generic.HTML.Redirector is not a report that a program on your computer is infected. It is a report that something on your computer asked for a page that redirects somewhere your antivirus does not trust. Venue and event listings go stale constantly. A directory entry points at a venue, the venue closes, the domain lapses, and somebody parks it on a redirector that serves ad junk to whoever still follows the old link. A lead run that follows that link produces exactly what you saw, with Accessed by: python.exe attached, because the lead engine is what asked for the page. That is why a virus warning can land in the middle of perfectly normal work.

The part worth holding onto: your antivirus blocked it. Nothing was installed and nothing loaded. A warning note from your internet provider around the same time is usually the same event seen from their side, not a second, separate problem.

The one check that actually settles it

Plenty of software runs Python, so the name python.exe is not evidence on its own. What you need is the command line, and Windows hides that column by default.

Press Ctrl+Shift+Esc to open Task Manager.
Go to the Details tab.
Right-click any of the column headers and choose Select columns.
Tick Command line, then click OK.
Find python.exe in the list and read its new Command line column.

A Booked Solid lead run shows -m bsleads.run in that column. Anything else is some other program's Python and has nothing to do with us. Without that column you are guessing, and so are we.

There is a real catch. This only works while the process is still running. If the alert fired an hour ago and the run has already finished, python.exe is gone from the list and there is nothing left to read. When that happens, fall back to the two softer signs below.

Two softer signs it was a lead run

Open the app and look at the Activity button, which sits beside Chat and Power view above the conversation. A green dot on it means a job is running right now. A job running at the moment your alert fired is a strong match.
Open your Booking HQ folder and look for a bsleads folder with a runs folder inside it. That is where lead runs write their output. A run whose timestamp lands on the minute of the antivirus alert is about as close to proof as you will get after the fact.

Being straight with you about the limit: what those two tell you is whether the lead engine was awake, not which page your antivirus objected to. Awake at the right minute is usually enough to stop worrying.

Could a lead run have started without you?

Worth settling before you go further, because it changes what a match means.

On Pearl the lead engine runs on command. It starts because you asked for it, from a setup recipe such as Set up my lead engine, or from lead work you asked for in chat. On Otto the same engine can additionally run unattended on a schedule, because standing scheduled work is the Otto capability. Let Otto run on its own covers what that schedule can start. The difference matters here. If you are on Pearl and you started nothing, look elsewhere. If you are on Otto, a lead run really can begin at three in the morning with nobody at the keyboard, and that is the product working as sold rather than something loose on your machine.

If it matches a lead run

Then it was us, and it was expected. The lead engine read a page that turned out to redirect somewhere junk, your antivirus caught the redirect before it loaded, and the run carried on. Nothing was installed, your Booking HQ, your leads and your gigs are untouched, your licence is unaffected, and there is nothing to repair or reinstall. If the same alert keeps landing on the same run, open a ticket and tell us which city and segment you ran, and we will look at which source is dragging in dead domains.

If it does not match

Then treat it as unrelated to Booked Solid and handle it the ordinary way. Run a full scan in your antivirus rather than a quick scan, let it finish, and do what it recommends. The alert is still real, it just belongs to something else on the computer.

What not to do

Do not uninstall anything on the strength of this alert, and that includes Python itself. A blocked redirect is not evidence that a program is malicious, and removing Python because it showed up in a warning will break the lead engine and quite possibly other software you did not know depended on it. A full scan is the proportionate response.

Adding Booked Solid to an antivirus exception list will not quiet this either. The alert is about a web address, not about our files, and the Python it names does not live in our folder anyway. An exclusion would change nothing here while quietly lowering your protection.

A blue install screen is a different thing

If what you actually saw was a blue Windows protected your PC panel while installing, that is Windows SmartScreen checking an installer it does not recognise yet. It is not a virus warning, no threat was named, and none of the above applies. Install Booked Solid on Windows covers what to click there.

Still not sure?

Open a ticket at support.booked.kivimedia.co or email bookedsolid@kivimedia.freshdesk.com, and send four things: the exact threat name, the full Accessed by line, the Command line column value if you managed to catch the process while it was running, and the date and time of the alert. In Settings, click Generate Support Bundle and attach the file it saves, which gives us the app's own record of what was running. We would far rather read it with you than leave you carrying a security worry about software you paid for.