Windows Defender false positive for Keyran program

Question

Windows Defender false positive for Keyran program

Олег Зеркалий 0

Guys, hello!

I'm desperate, I'm writing here for help and support. Maybe someone will pay attention to my problem..

I am a certified software developer and a legal entity registered in my country. I'm experiencing an issue where Windows Defender Antivirus is falsely identifying my software as malware, and support is refusing to fix the false identification.

Every day I receive dozens and hundreds of requests from clients with this problem, and it negatively affects my reputation. My software has an extended digital signature. I have already sent requests for help to various places, but so far the problem is still not resolved.

Please tell me who can help me solve this problem?

1 answer

Your answer

Answer 1

Reza-Ameri 17,341 Volunteer Moderator

I advise you to report this to the Microsoft Anti-Malware team.

You may visit the following website:

https://www.microsoft.com/en-us/wdsi/filesubmission

And select as developer and follow steps to report this issue.

Олег Зеркалий 0 Reputation points

2023-12-20T06:34:14.2066667+00:00

This is exactly what I did as soon as I received the first request from a client. This week I made several requests, but all were refused.

Among other things, the program is registered with the state intellectual property office in my country. Honestly I don't know what else could help.
Reza-Ameri 17,341 Reputation points Volunteer Moderator

2023-12-20T21:50:41.58+00:00

Do you know what was the reason for refusal?

What if you submit sample to VirusTotal?

Have a look at:

https://www.virustotal.com/gui/home/upload

What is the result?
Олег Зеркалий 0 Reputation points

2023-12-21T07:24:32.31+00:00

I thank you for your answers and desire to help!

Strangely, the false positive result disappeared. Although I still haven't received an official response from Microsoft. I hope that the problem has been resolved permanently. At least the requests from my clients have stopped.

Just the other day I updated my software and the Virustotal results give 2 more false positive results from other antiviruses, this is probably due to obfuscation of the program to protect my intellectual property. I will definitely contact them to resolve this misunderstanding. I am attaching the result with a screenshot.

In fact, I work with several antivirus companies to ensure that there are no false positives before updating the software. But not everyone has programs of this kind, something like "White List" or "Partner Support".
Reza-Ameri 17,341 Reputation points Volunteer Moderator

2023-12-21T21:38:12.2833333+00:00

Thank you for the update, as for the Microsoft if you login with Microsoft Account and submit sample, you should see status of your submission.
Kim Hong 0 Reputation points

2025-04-06T22:53:57.71+00:00

Hello Microsoft Community,

While there is an ongoing debate about Keyran.exe being flagged as a false positive by Windows Defender, I would like to share concrete findings that raise legitimate concerns about its behavior and potential risks.

According to a public sandbox analysis on ANY.RUN (link here), the application exhibits multiple behaviors commonly associated with suspicious or malicious activity:

Drops executable files immediately upon launch.

Self-replicates and launches itself multiple times.

Takes screenshots (YARA rule triggered).

Interacts with Internet Explorer security settings and changes feature browser emulation.

Reads sensitive system information including:

Machine GUID

Windows installation date

Installed software list

Environment variables

Uses tools like ExtremeDumper which are often associated with reverse engineering or obfuscation bypass.

Creates files in temporary directories.

Reads software policy and registry settings.

Although the Keyran developer claims this is a false positive, these behaviors suggest otherwise and cannot be ignored. On top of that, the software does not allow users to delete their accounts, and the website offers no option for account termination, even after direct request. This raises a further privacy and compliance concern.

I understand that not every suspicious action indicates malware. However, based on the comprehensive behavior logs, the concerns seem valid and beyond what's acceptable for a legitimate application. Therefore, I believe the current Windows Defender detection may be justified, and at the very least, warrants an official review from Microsoft.

Thank you for your time and consideration.
Олег Зеркалий 5 Reputation points

2025-04-06T23:30:43.0133333+00:00

I believe your concerns are not entirely justified. At present, the application is not flagged as malicious by any antivirus engine, including Microsoft Defender — VirusTotal shows 0 detections out of 74 engines, Microsoft included. This indicates that either the issue has been resolved or the original detection was a false positive, which was later corrected following an official request from the developer.

The behavior you described can indeed be observed, but only in the “incognito” mode, which is clearly communicated to the user and serves the same purpose as incognito mode in browsers — to enhance privacy in certain usage scenarios.

Regarding the mention of ExtremeDumper — the application does not use it directly, nor is it distributed with any similar tools. However, it does include built-in anti-reverse-engineering mechanisms intended to protect intellectual property. It’s possible that some of these protection techniques might be interpreted by automated analysis tools as suspicious. This is, unfortunately, a common occurrence with commercially protected software.

Finally, regarding account management — since receiving user feedback, the functionality has been improved and the ability to delete an account has been implemented. We fully respect each user’s right to privacy and are committed to complying with relevant standards and expectations.

Share via

Windows Defender false positive for Keyran program

1 answer

Your answer