I wanted to copy from a local publish location of my ASP.NET Core project on a production IIS Server, and Windows Defender detected a Trojan in my main executable file. When I scan this folder on my local machine, Defender does not find any threat. enter image description here

I made a deployment package in Visual Studio, on my computer there are no threats, only thing I can refer to is that ASP.NET Core app creates an EXE that opens HTTP ports. Do I have a real problem, or Windows Defender is not right about my application?

1 Answer 1


The Win32/Cloxer.D!cl detection is a machine-learning derived signature:


Because of this, it could be flagging on any number of behavioral indicators including network connections, loaded libraries, or functions calls.

While it's possible that your packager or compiler is infected(a la XCodeGhost), it's much more likely that it's a false-positive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.