Urgent! Persistent False Positive Detection of Our Software as Trojan:Win32/Kepavll!rfn

Question

Hello,

We are a software development company whose desktop application is being falsely detected as Trojan:Win32/Kepavll!rfn by Microsoft Defender on our users' Windows systems.

We have already submitted our software for malware analysis through the Microsoft Defender Security Intelligence portal https://www.microsoft.com/en-us/wdsi/filesubmission , and the result confirmed that our software contains no malware.

However, one submission status still remains "pending," and in the meantime, our users continue to receive false positive alerts, severely impacting their experience and our business operations.

Could anyone please advise on how to expedite the resolution or provide additional steps we can take to remove this false positive detection?

Answer 1

Hello

As far as I know, this is the only page where users can submit false positive feedback. There is no better channel except for repeated submission or submission to Feedback Hub of Windows system.

Or you can try to submit the issue for discussion here. Maybe other members of the community have better suggestions:
https://techcommunity.microsoft.com/category/mi...

https://learn.microsoft.com/en-us/answers/tags/...

Answer 2

I contacted Microsoft support, and they called me back advising me to seek help in the technical community.

Answer 3

Have you submitted your EXE file to the www.VirusTotal.com web-site, to get over 60 anti-virus products to scan your app?

What are the results?

What anti-virus product do you use on your "development" computer?

When you "build" a new version of your software, is it scanned?

Are you sure that your "development" computer is not virus-infected?

Answer 4

Although this site is called Microsoft Community, those of us who volunteer to assist in this forum are not employees of Microsoft and we have no direct lines of communication with them or their customer service team. That means we cannot speed up the process.

Per How to send malware to Microsoft for analysis, there are 3 methods that you can use to send malware files to Microsoft for analysis...Web-based submission, Submission by Microsoft Customer Support Services and Prompted Submission. 

Quote

Microsoft will send a response message that includes a list of the files in the archive file. If Microsoft has already analyzed the files that you sent, the first response message will include the determination that was made for each file. If Microsoft has not analyzed the files, or if you indicate that the files were incorrectly determined to be malicious software, Microsoft will analyze the files...

...After analysis is finished, another message is sent to the e-mail addresses that you provided. This message includes a final determination of the files.

Per the Microsoft Submission Guide, Section How do I dispute the detection of my program?

Quote

in question as a software developer. Wait until your submission has a final determination.
 
If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We'll use the information you provide to investigate further if necessary.

Answer 5

I'll just comment that this is a user forum and not a way to contact Microsoft.

Are there any contact links on the portal where you submitted the files?