Trojan:Win32/Sabsik.FL.A!ml Detected in x64 about urh HOT 9 CLOSED

After a full system update, I have scanned the same installation file this morning and no malware was detected. It appears that your report helped them correct the problem. Thank you for the wonderful software!

from urh.

After reporting to Microsoft, I did not receive a response, but after re-installing and scanning several times, it has not been flagged, so I guess they have fixed the problem.

from urh.

Awesome, let's hope they fixed it for good this time. Thanks for getting in touch with Microsoft and providing them with the logs.

from urh.

Most likely a false positive. I just uploaded the installer to Virustotal and it reported no hits:

See also my comment here on that matter - please report this to your antivirus vendor.

from urh.

Thank you for the link to the other report. I am not sure how to report this to the huge dark hole that is Microsoft so I will probably just go over to Linux where I should have been doing this. BTW, here is the result after opening URH:

from urh.

I just reported the installer file here as misclassified malware and linked this issue for reference. Let's hope Microsoft will review this soon.

I will close this issue as there is nothing more we can do from our side.

from urh.

Thank you!

from urh.

Here is the response from Microsoft:

We cannot reproduce any detection on the file. If the detection is still observed, follow the steps below to capture support log files from the system reporting detection.

From an elevated command prompt, change to directory "%programfiles%\windows defender" and execute mpcmdrun.exe with option GetFiles:
cd "%programfiles%\windows defender"
mpcmdrun.exe -GetFiles

All created log files will be compressed into MPSupportFiles.cab. Please send us the detected file and MPSupportFiles.cab using https://aka.ms/wdsi. We will continue the investigation once we receive the support log files.

Thank you for contacting Microsoft.

Could you please run Windows update and check whether the installer is still marked as malicious afterwards? If so, I appreciate if you could send them the support log files as outlined in their answer.

from urh.

Windows Defender again flagged URH as Trojan Malware. I have submitted the log files to Microsoft.

from urh.