---
title: Windows Defender generates numerous Emotet-related false positives
description: Shortly after Trickbot was observed dropping an updated version of the Emotet botnet malware, Windows Defender began incorrectly reporting certain executables and Microsoft Office documents as Emotet payloads.
canonical_url: https://www.acronis.com/en/tru/posts/windows-defender-generates-numerous-emotet-related-false-positives/
locale: en
last_updated: 2026-10-27
---

*   [Home](https://www.acronis.com/en/tru/)
*   [Articles](https://www.acronis.com/en/tru/posts/)
*   [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)

05 December 2021

# Windows Defender generates numerous Emotet-related false positives

Shortly after Trickbot was observed dropping an updated version of the Emotet botnet malware, Windows Defender began incorrectly reporting certain executables and Microsoft Office documents as Emotet payloads.

Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)**

[Video 1](https://www.youtube.com/watch?v=Drx7fzUZ_Mk)

Shortly after Trickbot was observed dropping an updated version of the Emotet botnet malware, Windows Defender began incorrectly reporting certain executables and Microsoft Office documents as Emotet payloads.

While Microsoft has not commented on what caused these false positives, it is suspected that the sensitivity of the detection for Emotet-like behavior was misconfigured, erring on the side of caution rather than accuracy. Unfortunately, this nearly shut down some businesses, who thought they were victims of an Emotet attack.

Even without shutting down systems, admins were reporting that numerous documents and applications would not open, causing interruptions to normal business operations. Microsoft has pushed out a fix for cloud-connected users, and are working on a fix for the remaining userbase.

The backup solution in Acronis Cyber Protect allows you to automatically generate an allow list of known safe files and applications, preventing false positives and keeping your business running smoothly.

Related articles

[The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/)  
[Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/)  
[Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/)  
[AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)