Trojan:Win32/Gracing.I - false positive?

Question

So one of my binaries got flagged by Windows Defender as containing Trojan:Win32/Gracing.I on one PC, but not a 2nd. As the file was created on the 2nd PC, my initial thought was something got injected during the transfer or on the file sharing site, but in trying to replicate the finding, it seems I can't get the first PC to flag the file again. Even restoring the quarantined file and rescanning, does not retrigger the finding now.

Does restoring the quarantined file implicitly allow-list it so it won't retrigger the finding?

Or maybe was this actually a false positive and my security definitions updated to fix this?

Or is there a "newness" score in Windows Defender that decreased because I've been interacting with this file (and various copies of it) so much that it now thinks the file is safe?

Answer 1

Hi BurntSushi. My name is Ivan, and I am an Independent Assessor. I'd be more than happy to assist you. I'm so sorry that you are experiencing this issue. Don't worry, I'll do everything I can to help you.

This may be a false positive. Windows Defender, like any antivirus software, isn't perfect and can sometimes misidentify harmless files as threats.

1. False positive and definition updates: This is the most likely explanation. Windows Defender periodically updates its virus definitions. The definition that initially flagged your file may have been corrected.

-To check, check for recent Windows Defender updates and compare the detection rates for the file on both PCs.

2. File modifications: Even minor changes to a file can affect how it's scanned. If you've edited the file in any way after the initial detection, it may no longer trigger the alert.
3. Quarantine behavior: Restoring a quarantined file doesn't usually automatically whitelist it. However, some antivirus programs may have additional mechanisms in place. It's worth checking Windows Defender settings for any relevant options.

If you are still concerned about the file, consider using a different antivirus software to get a second opinion.

Keep your operating system and software up to date with the latest security patches.

I hope this information is helpful.