Ok, here's the high-level overview. An antivirus scanner uses the following (basic) types of detection: 1. Hash-based. This isn't as common nowadays, as ther

Ok, here's the high-level overview. An antivirus scanner uses the following (basic) types of detection: 1. Hash-based. This isn't as common nowadays, as there's a lot of malware that will generate a unique copy every hour or so. 2. Signature. This can be as simple as a byte sequence (i.e. anything with "C:\Badfile.exe" in it is a virus), to more complicated code using wildcards. 3. Heuristic. This can refer to anything from "files with an invalid digital signature are bad" to "files that have a high entropy and have no publisher are bad". 4. Emulation. The AV runs the file in a CPU emulator, tracks what it does, and attempts to determine if it's bad. 5. Behavioural. The AV lets the file run, tracks what it does, and then might stop it if it does enough "suspicious" actions. So, in short, with all the various types of detection that modern antiviruses use, false-positives are almost inevitable. The teller is how fast the vendor reacts - and in this case, Microsoft seems to have reacted rather quickly.