Skip to main content
miciti
miciti
Visitor III
September 10, 2025
Question

FortiClient Malware Protection quarantined a vmware workstation file - false positive?

  • September 10, 2025
  • 2 replies
  • 410 views

Hi everyone,

 

yesterday FortiClient Malware Protection decided to flag a vmdk (vmware drive file) as malicious with threat "JS/Phish.A9BF!tr". 

 

Is this clearly a false positive? Or is FortiClient able to analyze virtual drive files in detail?

2 replies

sharmar
Staff & Editor
sharmar
Staff & Editor
September 11, 2025

Hello @miciti 

 

You can check the file is false postive or not via using Fortiguard online scanner :

https://www.fortiguard.com/faq/onlinescanner

 

You can also search it through file hash. 

 

Regards

miciti
micitiAuthor
Visitor III
September 11, 2025

@sharmar 

Hi, 

the vmdk (virtual machine drive file) is about 60 GB in size.

 

That is a whole virtual computer stored in this single file - that is why I was wondering if FortiClient even has the capatiblity to analyze this kind of files. 

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!