2

New install of windows 10, have not installed any other AV solution yet. Just started playing with the windows subsystem for Linux.

Went to download XMING, and windows defender keeps identifying it as Trojan:Win32/Vigorf.A, however every scanner at virus total (Including Microsoft) reports nothing...

Confirmed on new clean install of windows 10 in VM environment, so I do not believe that the install itself is infected or particularly in error any more so than any other windows 10 install.

Anyone else every cross something like this, I mean I hate to be the buffoon here and install something against the suggestion of an AV product without knowing for sure, however with a 56 to 1 vote clean, and one of those a second opinion from the same source, what do you do?

Improve this question
6
  • I don't lie defender, it is slow as hell. use a 3rd party tool.
    – magicandre1981
    Mar 7, 2017 at 17:20
  • Just our of curiosity, how does Microsoft feel about the licensing of XMING? This wouldn't be the first time that Windows Defender or Security Essentials had reported something as "malicious" primarily because they think the software might violate their intellectual property licensing.
    – Run5k
    Mar 7, 2017 at 17:49
  • Not sure how I would validate their position on that, it is downloaded form here sourceforge.net/projects/xming though. as far as a reputation, I would think that since virustotal includes Microsoft as one of their scanning engines, that one Microsoft product would favor it no more or less than any other from them. Here is the now more interesting, MS Security essentials on my windows 7 VM does not detect it as malicious either. For a potential false positive, it seems fairly certain it is bad for W10 though?
    – Sabre
    Mar 7, 2017 at 18:31
  • As a further note on the above, their site does specify that Windows is a registered trademark of Microsoft Corporation in the United States and other countries. Microsoft product screen shots: "Used with permission from Microsoft." So again I would assume that it is not some unscrupulous activity on tier part directly in conflict with MS on that matter (Provided they are telling the truth)
    – Sabre
    Mar 7, 2017 at 18:39
  • As of 3/9/2017, Defender is still marking Vigrorf.A as a Trojan and specifically blaming Xming.
    – Beth Lynn Eicher
    Mar 9, 2017 at 21:20

3 Answers 3

Reset to default
1

Thank you all for the input and suggestions. The final verdict ended up being I submitted the file to https://www.microsoft.com/en-us/security/portal/submission/submit.aspx, . That reported as seen below MS Scan results

Today, the same installations are not detecting the same file. So I would say it was a confirmed false positive, and the error was corrected by MS with no further action required by me.

So if anyone comes across this in the future, though I agree with the other posters, I do not suggest windows defender as the only line of defense (Or even part of really), if it is giving you grief, you do have options to potentially get them resolved in this way.

Improve this answer
0

Windows defender should tell you where the virus trojan comes from.

To be absolutely sure on cleaning on your harddrive boot on a usb drive like hirens boot 15.2 and use one of the antivirus available. if not, just google yumi and download an antivirus on its list and use that to boot from that usb and scan your entire system plus the installation of windows just to be sure. that way you'll know where the virus came from and do a complete cleanup. that type of problem can be annoying

Improve this answer
5
  • There is no question where it comes from, I am directly downloading the file in question. The question is geared toward the fact that though the local install of windows defender shows the file to be infected, I cannot get any other service to corroborate that, including Microsoft's other AV products. Do I believe the 56 that say it is clean, or the one that says it is infected?
    – Sabre
    Mar 7, 2017 at 18:26
  • @Sabre, you obviously know much more about XMING than I do. Please see my comment above... this wouldn't be the first time that this has occurred.
    – Run5k
    Mar 7, 2017 at 18:34
  • I commented on it at the same time.
    – Sabre
    Mar 7, 2017 at 18:36
  • 1
    @Sabre - ALL Security products like Windows Defender incorrectly identify a safe file as malicous. So if you trust the application, create an exception for the file, and move on.
    – Ramhound
    Mar 7, 2017 at 19:03
  • i've done some research and xming has been known to give a false positive. It's even written on their history patch note. So personally, I wouldn't worry about it. just do an exception at best and continue working with it
    – Fluffy Destroyer
    Mar 7, 2017 at 20:36
-1

From my experience is Windows Defender an antivirus made for those that doesn't know anything about computers, and makes sure that they don't download stupid stuff. When I googled on XMING to get an idea of what it is it seemed like a perfectly safe program if you know what you do. The only thing that seems like a security risk would be that you download it from another website that's not recommended. You know a lot more about XMING than I do but I hope this can help. I don't think it matters that you have windows as VM even though I have no experience of it.

As an conclusion, I would ignore Windows Defender if I were you.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .