This is an ongoing issue for the Windows version of rtibuilder_2_0_2_setup.exe file. I likewise get a notification from Windows Defender. It is infected with what MS calls "Win32/Dynamer!rfn". It also has a growing consensus among virus scanners, up to 10 now with Microsoft and Cylance being the most reputable, and filescan results can be seen here on Virustotal: https://www.virustotal.com/gui/file/a531b6de3861d3ac1f2ac2ca4d3ebefec1e65d3d50a44c957a8e345d79d26f5b/detection Virustotal also runs various website scanners which are also reporting malicious and malware at the link. https://www.virustotal.com/gui/url/26a92d3b13309e7e21169ecfca0a790752dafbc8c5b097c5b7fa989a86eb3256/detection Microsoft description can be seen here: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fDynamer!rfn&threatid=2147721515 Windows Defender and/or Essentials are not automatically configured on all machines. Some machines may have other anti-virus that do not detect it yet. At any rate some will see it and some will not. It's also possible that an already infected machine may not see it any longer, as the trojan may hide it or disable AV. At any rate the evidence that this current file is carrying a trojan is pretty good.