Weird. Though there would be value in working with the vendors backing VT to get this fixed as this is just one of the issues with a false positive. Another is

Weird. Though there would be value in working with the vendors backing VT to get this fixed as this is just one of the issues with a false positive. Another is that users who use these products are probably alerted or otherwise prevented from using WinRAR too. VT has it as malicious with the new hash too [1] . Antiy-AVL calls it Win32.Shelma. Only good definition that seems to match that detection is from Kaspersky [2] stating that the 64 bit version is detected as using metasploit [3] components. [1] https://www.virustotal.com/gui/file/21dd688a5371f5b0d297a307fc6f04295f9303bc6864779bde88d5f6ae9f9112/detection https://www.virustotal.com/gui/file/21dd688a5371f5b0d297a307... [2] https://threats.kaspersky.com/en/threat/Trojan.Win64.Shelma/ https://threats.kaspersky.com/en/threat/Trojan.Win64.Shelma/ [3] https://www.metasploit.com/ https://www.metasploit.com/ edited: formatting