Windows 10: Confusing trojan detection/possible false positive? Trojan:Script/Foretype.a!ml

Hello,

I send this as I've just come back to my computer tonight to find that Windows Defender just finished a scan, detecting one threat on my computer, a Trojan labelled as I describe in the subject. The details provided on the scan states that it can initiate commands from an attacker. What I find strange is that the detection was on a zip file I've had an extracted version of on my PC for a while now, downloaded from a place I'm pretty sure I trust, Its a well-known fangame, Mega Man 8-Bit Deathmatch. I assume that if there were similar issues from anyone who downloaded this game, I'd have heard about it by now. that, on scanning, did not turn up the same thing. Two questions occur: Why is it specifically that file, and if I've had this infected file on my PC for about a month now, why is it only being detected now? A part of me is wondering if this could be a false positive, but I don't want to assume anything and leave a possibly severe issue unresolved.

Thanks,

- Alice

:)

 

database of malware producing false positives or false negatives

Many months ago I communicated with Malwarebytes about a trojan that was detected by Defender that was not detected by Malwarebytes. They indicated that Microsoft Defender is likely a false positive and to wait weeks or months for Microsoft to update their
database. To date the Defender continues to detect a trojan that is not detected by Malwarebytes.

Defender does not detect any malware on quick scans. However on full scans it detects this trojan that is not detected by Malwarebytes.

How does an end user determine whether one antivirus program is producing false positives or false negatives?

 

False Positive - Rundas!plick Trojan

We have a small "exe" that we use extensively at "Return to Misty Moorings" This is for our "Season Switcher". When the program is run, the software is quarantined as a Rundas!plick Trojan. There is no Trojan or any other problem with this software, Malwarebytes
and Spybot both show it does not have a problem. But every time our users try it with Defender, it is "quarantined". This is giving our site and our efforts for our fans a bad name from Microsoft's false positive. The program can be found at:

Return to Misty Moorings - NOTAMS

The "solution" from the Microsoft "help" chat was to "Turn off Windows Defender". That we can do and I can tell my thousands of followers on the site that this is Microsoft's suggestion (not a very good marketing idea). We need someone on the Defenders
team to get our software "CLEARED" so this does not keep showing up as a Rundas!plick Trojan.

Please tell us who to contact or what needs to be done next.

Doug Linn/RTMM

 

Sandboxie 5.28 - Trojan or False Positive - Inquiry

Hello Andre:

I have not installed Sandboxie 5.28 on my computer. Just want to check it out for malware before installing.

Did other scans on Sandboxie using other online scanners. No malware detections. Still I am suspicious.

I had a similar experience with another program, only 1 false positive so I installed it. Later on I did a virus scan with Fix Me Stick, & sure enough it was a Trojan. Don't want to make the same mistake again.