windows defender flagging xyplorerfree.exe with trojan

[rpesq]

Win 10 Pro 64 bit. Running under a limited user account (not as admin).

xyplorerfree.exe is flagged by Windows Defender as having trojan win32/fethar.b cl

Obviously downloaded from your site, and obviously scanned with virustotal and no hits. Downloaded it multiple times over last several hours.

But this is real strange behavior. Defender does not flag the zip file. It does not flag the exe file when you scan it manually, and you can also run the file. But spontaneously it will, all of a sudden, quarantine it, then of course the file is no longer present. File is not even running and it flags it.

Also, I tried to submit the file to MS for analysis, but it shows as "not flagged".

To elaborate, how weird this is... I scanned with zip and the individual exe many times, and nothing. Then, all of a sudden, it gets quarantined.

I DL the file again. Nothing. Run the file, no flag. Scan the file, nothing. Reboot, log in to the limited user account, and it immediately removed the file even though I had not run it, and it is extracted to just a temp folder on a E:/ drive.

Any ideas?

This is a new Win 10 Pro install on a brand new PC. Scanned PC with many A/V engines and nothing found, which should be obvious being it is a new Win10 install on a new PC and has all Win updates current.

[highend]

Welcome to the forum.

Why did you post it as a bug report then? The bug is not: XY (free) is infected but a bad / strange acting Windows Defender (so blame it on Microsoft). My advice: Disable it, use a different Antivirus product (or if you don't want that: Exclude the "xyplorer.exe" process from being scanned -> This automatically excludes it's file)

[jtruchon]

Same Problem...Tried the beta and a fresh 17.0 install, must be something with Defender. I excluded the XYPlorer folder from Defender and it's working now.

[admin]

It almost seems to show that Windows Defender uses a random generator as part of its heuristics.

Anyway, there is another plus with excluding XY from Windows Defender: XY will act faster since Windows Defender slows down certain operations.

(I moved the topic to the Q & A forum.)