Share via

Is this virus detected by Defender, Trojan:Win32/Cerdigent.A!dha, a false positive or not?

P. Hollar 0 Reputation points
2026-05-05T13:28:51.78+00:00

Is this virus detected by Defender, Trojan:Win32/Cerdigent.A!dha, a false positive or not?

Microsoft Security | Microsoft Defender | Other
0 comments No comments

2 answers

Sort by: Most helpful
  1. _AW_ 67,251 Reputation points Volunteer Moderator
    2026-05-05T13:31:15.32+00:00
    1 person found this answer helpful.
    0 comments No comments

  2. Q&A Assist
    2026-05-05T13:29:00.93+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    Defender detections such as Trojan:Win32/Cerdigent.A!dha can be either true malware or false positives. The classification as a trojan means Microsoft Defender Antivirus has identified behavior or signatures that match known malicious patterns, but only analysis of the specific file can confirm whether it is truly malicious or a false positive.

    To determine this for the exact file on the device, submit the file to Microsoft for analysis:

    1. Use the malware submission portal to upload the detected file as a suspected false positive or to confirm the detection: Submit a file for malware analysis.
    2. Defender security analysts will examine the file. If the file is clean, Microsoft will adjust definitions so that this file no longer triggers alerts.
    3. Until confirmed, treat the detection as potentially malicious: keep the item quarantined and avoid restoring or running it.

    If this detection appears in Microsoft Defender for Endpoint or Defender for Cloud and is believed to be a false positive in an enterprise environment:

    1. Submit the file via the Submissions page in the Defender portal (Files tab for Defender for Endpoint, or the sample submission portal referenced by Defender for Cloud) as described in the documentation.
    2. Optionally configure alert suppression or allow indicators (for example, by file hash) only after Microsoft has confirmed the file is clean, to avoid suppressing real threats.

    References:

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.