Windows 10: System customization tool: HackTool false positive.

https://go.microsoft.com/fwlink/?linkid=142185&name=HackTool:Win64/ExplorerPatcher!MTB&threatid=2147909543A HackTool definition: Hacktools can be used to patch or "crack" some software so it will run without a valid license or genuine product key.The software detected does not exhibit any ability to patch or crack software to make it run without a valid license or genuine product key. It uses Explorer's built-in features and registry tweaking capabilities to alter its appearance and behavior.

:)

 

False positive for desktop shortcut scanner.lnk

The 1.239.488.0 virus / spyware definition update that rolled out about 24 hours ago appears to be producing a false positive for any shortcut placed on the desktop called "Scanner.lnk". I can consistently replicate a false positive for Trojan:Win32/FakeSysdef
with the following steps.

• Create a shortcut to an exe file.
• Place the shortcut on the desktop.
• Name the shortcut "Scanner".
• Run "Quick Scan".

I don't get the same result by directly scanning the file, nor by uploading the file to www.virustotal.com, so it would appear this is as a result of a heuristic rather than a file content analysis. I also don't get the same result with a shortcut that links
to a website.

Can anyone else replicate? How can we go about getting the Windows Defender team to reconsider this heuristic? It's a bit heavy-handed.

 

Windows Defender Bug - False Positive

Hey Zhang

Thanks for your response

Let me explain you our problem a bit more in detail

We are a company and we have a software product of ours. The installer for this software product is the one which is having the issue of false positive. When our customers run the installers It gives a prompt which says "Windows has protected your PC" . Even I have experienced that when I try to run the installer on my local system. As a result of this I did submit our installers to Microsoft and they did confirm that these are false positives, here is the submission ID d94d850d-dd50-4f29-a318-1635aeed925e. The problem now is that only the installers that were submitted to Microsoft have been fixed. The other installers(of the exact same software) still seem to have this problem. We want this problem to be solved for all of our customers. Please suggest me ways through which our installers when run by customers never get the prompt "Windows has protected your PC" which is a false positive.

Provide me with a solution with which our software product will never be falsely detected by windows and our customers shall never see the "Windows has protected your PC" prompt when they run our software.

Let me know if you have any questions

Thank you

 

Is this a false positive?

Hi, I am Dave, I will help you with this.

That is a false positive if only one AV on VirusTotal flagged that file, and your 4 safety scanner scans did not find any malware on your PC, then you have nothing to worry about and no further steps to perform.