When Your In-House Windows App Gets Flagged as a Virus — Handling Microsoft Defender False Positives and Living With the Performance Impact

“Our app got flagged as a virus and deleted on the customer’s machine.” If you distribute in-house or contract-developed Windows apps, sooner or later you’ll get this call. A business app that was working fine yesterday suddenly gets quarantined the moment a Defender definition update lands. Nothing happens on your dev machine, yet it’s flagged only in the customer’s environment. And you certainly never wrote any malware.

This isn’t a rare accident. Modern antivirus software estimates “suspiciousness” not just by matching against known malware but through machine learning, behavior analysis, and cloud reputation, which means a legitimate binary with no track record getting suspected is unavoidable by design. And when it comes to handling a false positive, there’s a clear line between what you should do (report the false positive to Microsoft, apply a narrow exclusion) and what you should never do (disable antivirus protection, apply a broad exclusion).

This article organizes, from a developer’s point of view, how false positives happen, what you can do to prevent them before distribution, the proper procedure once a detection occurs, exclusions as an emergency measure in a customer’s environment along with their risks, and how to deal with the other perennial complaint: “Defender (MsMpEng.exe) is slowing things down.”

1. The Bottom Line First

• Even a legitimate app can trigger a false positive. Since 2015, Defender has moved from a static-signature-centric engine to a predictive model that uses machine learning and cloud protection, so an unknown file can be flagged on “suspiciousness” alone, even without matching any known malware.¹²
• The proper, permanent-fix route is submitting the file to Microsoft (a false-positive report). Submit it as a developer through the Microsoft Security Intelligence sample submission portal and track the verdict. If you disagree with the verdict, you can request a re-investigation through the developer contact form.³⁴
• A quarantined file can be restored. Bring it back from Windows Security’s Protection History, or from the command line with MpCmdRun.exe -Restore.⁵
• An exclusion is a stopgap until your report comes back. An exclusion is a protection gap, and Microsoft explicitly states it should be used sparingly, only for a specific problem, and reviewed regularly. If you add one, scope it to the narrowest possible range using a full path, and keep a record.⁶
• Consistent code signing is the pillar of prevention. Microsoft has no pre-registration program for preventing false positives; the officially recommended path to speeding up provenance identification and getting onto the known-good list is to keep signing consistently with a trusted root CA certificate.⁴
• A self-run scan before release and pre-emptive submission reduce your “zero track record” problem. You can inspect your distributables with MpCmdRun.exe’s custom scan, and Microsoft itself notes that submitting an unknown file as a sample is a way to start building up its reputation.⁷⁸
• “Defender is slow” starts with measurement. Use Performance analyzer (New-MpPerformanceRecording / Get-MpPerformanceReport) to identify which files or processes are the center of the scan load before you think about a fix. An exclusion is the last resort here too.⁹¹⁰

2. Why a Legitimate App Gets Treated as a Virus

If you still think of antivirus software as “something that matches against known virus patterns (signatures),” a false positive looks inexplicable. But modern Defender isn’t that. Microsoft states plainly that in 2015 it moved from a static-signature-based engine to a model that uses predictive technologies — machine learning, applied science, and AI.¹

Detection happens in multiple layers. On the device, lightweight machine-learning models, behavior analysis, and heuristics run first; a file the device can’t settle on its own has its metadata sent to a cloud protection service, which in most cases returns a verdict within milliseconds. If even that can’t settle it, the system asks for a sample of the file and runs it through cloud-side scanning, detonation (execution in an isolated environment), and big-data analysis. In environments where “block at first sight” is enabled, opening a file can even be held back temporarily until a cloud verdict comes in.²¹¹

The implication of this design is clear: the evidence used for a verdict includes not just “a match to something malicious” but also “a track record of being harmless.” Microsoft’s classification criteria explicitly include an “Unknown (unrecognized software)” category, and warnings for unknown programs with little download history are positioned as an early-warning system for malware that hasn’t been detected yet. Not every rare program is malicious, but the risk of the unknown category is high for the average user — that’s the official framing.⁸

In other words, a freshly released in-house app looks, from the Windows security machinery’s perspective, like “a binary with zero track record that no one in the world has ever run before.” And on top of that, suspicion intensifies whenever the following traits pile on.

• A structure that hides the code’s true substance. Microsoft’s malware classification includes an “Obfuscator” category — code and intent hidden to make detection harder — and software that actively tries to evade security-product detection is also classified as a potentially unwanted application (PUA). Obfuscation tools, self-extracting formats, and packaging that bundles a runtime into a single exe are all structurally hard to distinguish from patterns malware uses heavily, and it’s an area where even legitimate apps easily draw suspicion.⁸
• No signature, no clue to trace the provenance. As discussed in the next chapter, consistent signing is the main clue investigators use to pin down provenance.⁴
• The installer bundles other software. An installer that offers to install software from a different publisher, or software unnecessary for the app to run, is classified as a PUA under “Bundling software.”⁸

One more thing: the blue “Windows protected your PC” warning that appears right after a download is a separate mechanism from Defender antivirus detection (Microsoft Defender SmartScreen). Microsoft’s own developer FAQ states plainly that SmartScreen has nothing to do with Defender antivirus.⁴ We’ve covered SmartScreen and reputation in detail in Why Windows Shows “Windows Protected Your PC”, so start by figuring out which of the two kinds of warning you’re actually looking at.

3. Prevention You Can Do Before Distribution

3.1 Consistent Code Signing — There Is No Pre-Registration Program

It’s a natural idea to wonder, “can I pre-register on a Microsoft whitelist so my app never gets flagged?” The answer is no. Microsoft doesn’t accept applications from developers for known-good list registration or a false-positive-prevention program. Instead, the official FAQ’s guidance is to keep signing your program’s files consistently with a certificate issued by a trusted root certificate authority. With consistent signing, the investigation team can quickly identify the program’s provenance and apply what they already know, which can get the program added to the known-good list faster, and — though less commonly — can even get the certificate itself onto the trusted-publisher list.⁴

Put another way, what signing actually does is bundle “per-file track record” up into “per-publisher track record.” An executable whose hash changes with every build is, file by file, a “never-seen-before file” every single time, but if it’s signed with the same certificate, its provenance stays continuous. For the practical mechanics of signing (certificate types, Azure Artifact Signing, timestamping), see the SmartScreen article above and A Minimum Security Checklist for Windows App Development.

3.2 Scan It Yourself Before You Release

Scanning your own build output as part of the release gate is far cheaper than finding out about a detection after it’s already hit a customer’s environment. Defender ships with the command-line tool MpCmdRun.exe, which you can automate from a script or a scheduled task. It isn’t on PATH by default, so change directory to %ProgramData%\Microsoft\Windows Defender\Platform\<version> (or %ProgramFiles%\Windows Defender if that path doesn’t exist) before running it.⁷

rem Run from an elevated Command Prompt
cd /d "C:\ProgramData\Microsoft\Windows Defender\Platform\<latest version folder>"

rem Custom-scan the release folder (-ScanType 3)
rem -DisableRemediation: don't quarantine or otherwise remediate on detection -- just show the result in the command output
MpCmdRun.exe -Scan -ScanType 3 -File "C:\Release\MyApp" -DisableRemediation

Return codes 0 and 2 are defined, but the thing that’s easy to miss when using this as a gate is that 0 covers not just “nothing detected” but also “detected, and remediation succeeded.” With a plain -Scan, you can end up with the worst possible combination: Defender detects something in your release output, quarantines it, and the return code is still 0 — “clean” — sailing straight through the pipeline. For a custom scan, add -DisableRemediation so nothing gets remediated on detection (the detection result shows up in the command output instead), and make your gate do more than just “stop the release and investigate if 2 comes back” — also check the command output for whether anything was detected, and confirm none of the output files went missing.⁷

3.3 Submit Unknown Files Ahead of Time

Microsoft states plainly that submitting a sample of unknown or suspicious software “helps get it scanned by the system and start establishing a reputation.”⁸ In other words, the sample submission portal isn’t only a last resort you turn to after a detection — it’s also a preventive tool for giving a new, zero-track-record binary its first bit of track record. For a major release — a major version, a change in packaging method, adopting an obfuscation tool, or any other point where the app’s outward shape changes substantially — it’s worth submitting a sample before you start distributing it.

4. The Proper Response Path Once You’ve Been Flagged

4.1 Confirm the Facts First — Protection History and the Event Log

First, confirm whether a report of “it disappeared” or “it won’t launch anymore” is actually caused by a Defender detection. In the GUI, Windows Security’s Virus & Threat Protection → Protection History keeps a record of detections and quarantines, and you can filter the view down to quarantined items.⁵

If you want it as a log, or need to check remotely, use the event log. Defender’s events are recorded under Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational, and you can also pull them with PowerShell’s Get-WinEvent.¹² The detection itself is logged as event ID 1116 (malware or unwanted software detected), and the resulting action — quarantine and so on — as ID 1117.¹³

# Check Defender's detection (1116) and action (1117) events, newest first
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' |
    Where-Object { $_.Id -in 1116, 1117 } |
    Select-Object TimeCreated, Id, Message -First 10

At this stage, record the threat name (a detection name like Trojan:Win32/Wacatac.B!ml) along with the path and version of the flagged file. Both your Microsoft submission and your explanation to the customer start from these two pieces of information. The structure of a detection name (type/platform/family name) follows the CARO malware naming convention, and a suffix like the trailing !ml can sometimes hint at where the detection came from.¹⁴

4.2 Report the False Positive to Microsoft

This is your permanent fix. Submit the mistakenly flagged file through the Microsoft Security Intelligence sample submission portal (microsoft.com/wdsi/filesubmission). Submission requires signing in, and once you’re signed in you can track your submission’s verdict status. Samples are not accepted by email.³

As a developer, submit the file as a software developer. Wait until the verdict is finalized, and if you disagree with it, you can contact Microsoft through the developer contact form attached to the submission result and request a re-investigation.⁴ A submitted file is scanned immediately by an automated system first, and if the file has already been processed elsewhere, a verdict comes back quickly. For submissions that haven’t been processed yet, analysis prioritizes files with broad impact and submissions from enterprise customers holding a Software Assurance ID.¹⁵

Once Microsoft updates the definitions to reflect a false-positive verdict, that file stops being detected from then on. Put the other way around: unless you report it, the detection keeps happening in every other customer’s environment, no matter how many exclusions you paper over it with. There’s also a route available even for a behavior-based detection that leaves no file behind: submit the diagnostic file (MpSupportFiles.cab) that MpCmdRun.exe -GetFiles generates, and request analysis on that.¹⁵⁷

If the customer’s organization has Microsoft Defender for Endpoint (EDR) deployed, there’s also an administrator route: the customer’s security administrator submits through the Submissions page in the Microsoft Defender portal and, alongside that, uses an “Allow” indicator to suppress the false positive across the organization.¹⁵ In this case, don’t try to handle it entirely on your own — coordinate with the customer’s IT department.

4.3 Restore a Quarantined File

A file you’re confident is a false positive can be restored from quarantine. In the GUI, select the item from Protection History and choose “Restore.” From the command line, use MpCmdRun.exe.⁵

rem List quarantined items
MpCmdRun.exe -Restore -ListAll

rem Restore to its original location by specifying the quarantined file's path
MpCmdRun.exe -Restore -FilePath "C:\Program Files\Contoso\ContosoApp\ContosoApp.exe"

You can also use the -Path option to restore to a different folder (in that case, the item also stays in quarantine).⁷ That said, restoring before the definitions are updated obviously risks getting detected again, so in practice it’s safer to proceed in this order: false-positive report → a temporary exclusion if needed → restore.

4.4 If It’s Detected by a Third-Party Antivirus Product

A detection by an EDR or a third-party antivirus product rather than Defender isn’t resolved by reporting to Microsoft. You need to submit separately to each vendor’s own false-positive submission channel for the product that flagged it. Most vendors provide a dedicated form, so search for “ false positive submission" to find it, and submit with the same detection name, file, and signature information as you would for Defender. If multiple products flag it at once, that's also a signal to suspect something on the build side — obfuscation, a packer, or bundled content.

5. Emergency Response in a Customer Environment — Exclusions and Their Risks

5.1 Where Exclusions Fit — Not a Permanent Fix

In a situation where the customer’s business grinds to a halt while waiting for the false-positive report’s verdict, a Defender exclusion becomes the emergency measure. But you must not misunderstand what it is. As Microsoft itself repeatedly warns, an exclusion is technically a protection gap, and the official principles are: (1) use it sparingly, (2) use it only for a specific problem such as a performance issue or app compatibility, and (3) keep a record of why the exclusion was needed and review it regularly.⁶ Note that the exclusion described here is specifically an exclusion from Defender antivirus scanning (scheduled, on-demand, and real-time protection). In an environment with Microsoft Defender for Endpoint deployed, EDR alerts and other detections can still fire even for an excluded file.¹⁶ “I added an exclusion but I’m still getting alerts” is expected behavior under this design, not a malfunction.

And even if you do add an exclusion, suggesting a customer disable real-time protection itself or Defender entirely is out of the question. That machine’s defenses drop across the board, against threats that have nothing to do with your app too. Having ever asked a customer to disable a security feature in the name of handling a false positive is guaranteed to come back as a finding in a later security audit.

5.2 How to Add One Correctly — Full Path, Narrowest Scope

You can add an exclusion from the Windows Security GUI too (Virus & threat protection settings → Exclusions), but if you’re putting this in a runbook, PowerShell is the reliable option. Manage the exclusion list with Add-MpPreference (add), Remove-MpPreference (remove), and Set-MpPreference (replace the entire list). Set-MpPreference overwrites the existing exclusion list, so always use Add-MpPreference when adding an entry, to avoid wiping out exclusions that already exist in the customer’s environment.¹⁶

# Run from elevated PowerShell

# Per-file exclusion (narrowest scope -- the executable's full path, not a folder)
Add-MpPreference -ExclusionPath "C:\Program Files\Contoso\ContosoApp\ContosoApp.exe"

# Check the current exclusion settings
Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

# Remove it once the false positive is resolved
Remove-MpPreference -ExclusionPath "C:\Program Files\Contoso\ContosoApp\ContosoApp.exe"

-ExclusionPath can target either a single file or an entire folder, but pointing it at a folder pulls in every subfolder underneath, so consider a per-file exclusion first.¹⁶ The other option, -ExclusionProcess, is easy to misread from its name: it doesn’t exclude the specified process itself — it excludes the files that process opens from scanning. The official guidance is that if you want to exclude the process’s own executable, use -ExclusionPath instead.¹⁷ Use -ExclusionProcess when detections or performance problems come from an app opening a large number of data files, and -ExclusionPath when the executable itself is the thing being misidentified.

You can verify an exclusion took effect as intended with MpCmdRun.exe -CheckExclusion -Path <path>.⁷ In a managed environment, the assumption is that you manage exclusions centrally through Intune or Group Policy (Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions) rather than setting them by hand on every endpoint. Microsoft recommends using Intune to define and edit exclusions.¹⁶¹⁵

5.3 Exclusions You Must Never Add

An excluded folder is also a place attackers can exploit as “somewhere Defender doesn’t look.” Microsoft specifically lists items that “should not be excluded, even if you trust them not to be malicious.”¹⁸

• Excluding a generic folder such as C:\, C:\Temp, C:\Users\, or %Windir%\Temp. Excluding an entire temp folder for the sake of your own app hands every piece of malware a safe zone.
• Excluding by extension, such as .exe, .dll, .tmp, or .zip.
• Excluding a generic process, such as cmd.exe, powershell.exe, msbuild.exe, or java.exe.
• Excluding by bare filename with no path (e.g., ContosoApp.exe). Malware with the same name gets excluded no matter where it’s placed, so always specify the full path.

To sum it up: an exclusion should be full-path, narrowest-scope, recorded, and time-boxed. Share the fact that you added an exclusion, and why, with the customer’s IT administrator, and remove it once you’ve confirmed the false-positive report’s verdict has come back and the detection has stopped.

6. Living With the Performance Impact — “MsMpEng.exe Is Slowing Things Down”

Right alongside false positives, performance is the other perennial complaint. Symptoms: MsMpEng.exe (the Antimalware Service Executable) is eating CPU in Task Manager, or your app’s file output or builds are slow. MsMpEng.exe is Defender antivirus’s core service, and real-time protection’s default behavior is to scan synchronously the moment a file is opened (“open now, scan now”).¹⁹ That means a workload that opens and closes a large number of small files — builds, fine-grained log writes, heavy use of temp files — triggers more scans, and its structure makes it especially exposed to the impact.

6.1 Measure First — Performance Analyzer

Before jumping straight from “it’s slow” to “exclude it,” measure what’s actually at the center of the scan load. Defender has a dedicated Performance analyzer: capture a scan performance recording (ETL) with PowerShell’s New-MpPerformanceRecording, and aggregate it with Get-MpPerformanceReport.⁹

# Run from elevated PowerShell

# Start recording, reproduce the heavy operation (a build, batch processing, etc.), then press Enter to stop
New-MpPerformanceRecording -RecordTo .\Defender-scans.etl

# Show the top files by scan time and the scan breakdown for each of those files
Get-MpPerformanceReport -Path .\Defender-scans.etl -TopFiles 3 -TopScansPerFile 10

Beyond -TopFiles / -TopScansPerFile, you can also aggregate by process and by extension, so you can pin down exactly which of your own app’s file accesses are triggering scans. One caveat: the official documentation itself is careful to note that this tool is for gaining insight into problem files — it is not meant to suggest exclusions.¹⁰

6.2 What You Can Do on the App Side Before Reaching for an Exclusion

If measurement shows that the large volume of temp files your own app writes out is at the center of the scanning, there’s room to reconsider the app’s write pattern before reaching for an exclusion. Since real-time protection triggers on a file being opened¹⁹, design changes like the following reduce the number of scans themselves.

• Consolidate a process that opens and closes thousands of small intermediate files into appending to a handful of files, or into in-memory processing
• Reduce the pattern of repeatedly writing a temp file and then renaming or deleting it
• Stop opening and closing the log for every single line, and write instead with the stream held open

For actually measuring which process touches which file at what frequency, Process Monitor works as-is. See The Practical Process Monitor (ProcMon) Guide for the steps.

6.3 On a Dev Machine, Use Dev Drive’s Performance Mode

In the context of a slow dev-machine build, Windows 11’s Dev Drive plus performance mode is the first thing to reach for. On a Dev Drive (a ReFS-based volume for development), Defender’s real-time protection runs in an asynchronous “performance mode.” Instead of scanning synchronously when a file is opened, it uses an “open now, scan later” approach that scans with a delay after the open completes, and Microsoft positions this as improving performance while keeping substantially stronger protection than a technique like a folder exclusion that stops scanning entirely.¹⁹ The standard move is moving your source tree, package cache, and build output onto a Dev Drive.²⁰

That said, performance mode only works on a Dev Drive, and it assumes real-time protection is enabled. Also, it doesn’t address the symptom of “MsMpEng.exe’s CPU or memory usage is high” — performance mode isn’t built for that; official guidance in that case is to narrow down the hot process and path with the Performance analyzer covered above.¹⁹

One more thing worth knowing: if on-demand scans (a scheduled full scan, etc.) get heavy during business hours, MpCmdRun.exe -Scan has a -CpuThrottling switch. Turning it on applies a cap (50% by default) to the scan’s CPU usage.⁷ It isn’t a format where you pass a number to the switch to pick an arbitrary percentage, though. The cap itself is configured through a policy setting (ScanAvgCPULoadFactor), and that value isn’t a hard limit — it’s a target given to the scan engine, meaning “don’t exceed this percentage on average.”²¹

7. Decision Table — Actions by Symptom

What’s common across every case is three things: first pin down the facts (the detection name, the target, which product detected it); always run the permanent fix of reporting it; and treat an exclusion or a restore as a temporary measure kept to the narrowest scope.

8. Summary

• Modern Defender judges files not by signature matching but through machine learning, cloud protection, and track record (reputation). A new binary with zero track record getting suspected is an inherent consequence of the design, and a structure that “hides its substance” — obfuscation, self-extraction — draws even more suspicion.
• The pillar of prevention is consistent code signing with a certificate from a trusted certificate authority. There’s no pre-registration program for preventing false positives. A self-run scan with MpCmdRun.exe before release, and a pre-emptive sample submission for a release whose outward shape changes substantially, are also effective.
• Once detected, pin down the detection name and target using Protection History and the event log (IDs 1116/1117), and submit through the Microsoft Security Intelligence sample submission portal as a developer. A quarantined file can be restored from Protection History or with MpCmdRun.exe -Restore.
• An exclusion is a temporary measure until your report comes back with a verdict. Full path, narrowest scope, keep a record, and remove it once resolved. Excluding a temp folder, an extension, or a generic process is strictly forbidden, because it creates a hiding place for malware.
• For a performance problem, measure first with the Performance analyzer, consider improving the app’s write pattern and Dev Drive’s performance mode, and only think about a narrow exclusion if it’s still needed after that. Asking a customer to disable real-time protection is out of the question.

Related Articles

• Why Windows Shows “Windows Protected Your PC”
• Designing Secure Auto-Update — Why HTTPS Alone Isn’t Enough
• A Minimum Security Checklist for Windows App Development
• Choosing a Windows App Deployment Method — MSI / MSIX / ClickOnce / xcopy / a Custom Updater
• The Practical Process Monitor (ProcMon) Guide — Pinpointing “Settings Not Loading” and “ACCESS DENIED” in 10 Minutes

Related Consulting Areas

Komura Software LLC handles consulting on establishing a response policy for false positives and SmartScreen warnings on distributed apps, designing a distribution and update setup that includes code signing, and measuring and diagnosing performance problems caused by antivirus software.

• Windows App Development
• Technical Consulting & Design Review
• Contact

References

Related Articles

Recent articles sharing the same tags. Deepen your understanding with closely related topics.

Related Topics

These topic pages place the article in a broader service and decision context.

Where This Topic Connects

This article connects naturally to the following service pages.

Frequently Asked Questions

Common questions about the topic of this article.

My own app got flagged as a virus by Microsoft Defender. What should I do?

First, don't panic and rush straight to an exclusion or disabling Defender. The proper, permanent-fix route is to submit the file through the Microsoft Security Intelligence file submission portal (sample submission) as a software developer. Sign in and you can track the status of your submission; once it's judged a false positive, a definition update stops it from being detected from then on. A file that already got quarantined can be restored from Windows Security's Protection History or with MpCmdRun.exe's -Restore.

How do I report a false positive to Microsoft?

Submit the file through the Microsoft Security Intelligence sample submission portal (microsoft.com/wdsi/filesubmission). Submission requires signing in, and once submitted you can track the verdict status on the portal. A submitted file is first scanned immediately by an automated system, and an analyst reviews it further as needed. Submit as a developer, and if you disagree with the verdict, you can request a re-investigation through the developer contact form attached to the submission result.

Is it OK to have exclusions set up in a customer's environment?

It can be an option as a temporary measure until your false-positive report comes back, but it must never become the permanent fix. An exclusion is a setting that puts a hole in Defender's protection, and Microsoft itself explicitly states it should be used sparingly, only for a specific problem, and reviewed on a regular basis. If you do add one, scope it as narrowly as possible — the full path to the executable, not a whole folder — keep a record of who added it, why, and until when, and remove it once the false positive is resolved. Broad exclusions like an entire folder, C:\Temp, or an extension such as .exe amount to creating a hiding place for malware.

Does code signing eliminate false positives?

There's no guarantee, but it has a large effect. Microsoft doesn't offer any false-positive-prevention program like pre-registering on a known-good list; instead, its recommendation is to keep signing consistently with a certificate from a trusted root certificate authority. Consistent signing lets the investigation team quickly identify a program's provenance, which can speed up its addition to the known-good list. Conversely, a binary with no signature — one that offers no clue to its provenance from build to build — gets suspected from scratch, every single time, as an unknown file with no track record.

Author Profile

Profile page for the article author.

Go Komura

Representative of KomuraSoft LLC

Focused on Windows software development, technical consulting, and investigations into failures that are difficult to reproduce.