Threat description




Trojan:W32/Fakedoc.variant!Online is a detection from the F-Secure Security Cloud for a document file that contains harmful characteristics or behavior.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.


Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Contact Support

F-Secure customers may request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

This detection identifies document files that have been altered to include embedded code or other harmful content.

The document file may have been deliberately created to be harmful, or it may be a legitimate document that has been tampered with (also known as trojanized) to insert the unwanted content.

Usually, if the document file is opened by an unsuspecting user, the embedded code is silently launched and run on the machine. Effects of the code can vary, including:

  • Displaying unwanted advertising content
  • Performing clickjacking fraud
  • Harvesting sensitive information from the device
  • Granting a remote attacker access to the device
About the Security Cloud

F-Secure Security Cloud is a cloud-based reputation service that hosts up-to-date lists of popular or common files and web sites. Each listed file or site has been analyzed and given a reputation rating that indicates if it is considered 'safe' or 'harmful'.

Whenever an F-Secure security product encounters a questionable file or site, it sends a query over the Internet to the Security Cloud to check for the file or site's latest reputation rating. Based on that information (and if needed, further analysis), the product may then delete, quarantine or block the file or application, or allow it to proceed.

This reputation-based analysis provides an important additional layer of security and is used to complement Generic Detections and local behavioral analysis (Heuristic Detections) to provide comprehensive protection. For more information about the Security Cloud, see:

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Scan & Clean Your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

More Info