Stop Trojan:Win32/Occamy.C False Positive Blocking Your Apps

Cause 1: Windows Defender’s cloud-delivered protection misidentifies your file (most common)

This one happens all the time. Your legitimate program—maybe a game trainer, a system utility, or an auto-clicker—gets flagged right after you download it. Windows Defender’s cloud-based machine learning model sees a pattern it doesn’t like and calls it Trojan:Win32/Occamy.C. I’ve seen this hit CCleaner, OBS Studio plugins, and even some Python compiled scripts.

Here’s what you need to do to restore the file and stop Defender from blocking it again.

Step 1: Restore the blocked file from quarantine

1. Click the Start button, type Windows Security, and press Enter.
2. On the left side, click Virus & threat protection.
3. Under Current threats, click Protection history. This shows you every recent alert.
4. Find the entry that says Trojan:Win32/Occamy.C. It will be marked Severe. Click the down arrow to expand it.
5. Click Actions, then click Restore. You’ll see a confirmation window pop up.
6. Click Yes in the confirmation. After you do this, the file is back in its original folder and Defender won’t block it immediately.

That restores the file. But if you don’t add an exclusion, Defender will probably flag it again the next time you run a scan. Let’s fix that.

Step 2: Add an exclusion for the file or folder

1. Go back to Windows Security > Virus & threat protection.
2. Under Virus & threat protection settings, click Manage settings.
3. Scroll down to Exclusions, then click Add or remove exclusions.
4. Click Add an exclusion, then choose File from the drop-down menu.
5. Browse to the file that was flagged. Select it and click Open.
6. You’ll see the file listed under exclusions. After that, Windows Defender will ignore that file completely.

I only recommend exclusions for files you are certain are safe. If you downloaded this from a sketchy site or cracked software, don’t do this. But if it’s a tool you’ve used for years and it just got flagged today, this is the fix.

Expected outcome: Once the exclusion is set, you can run the program without any further alerts. Quick scans and full scans will skip it. No more pop-ups.

Cause 2: A pending Windows Update or definition update hasn’t cleared the false positive

Sometimes the problem isn’t your file—it’s Defender’s outdated definition database. Microsoft pushes new definitions multiple times a day. If you haven’t updated in a few hours, you might be running an old rule set that still thinks Occamy.C is a threat.

This happened to me last month with a Total Commander plugin. I restored the file, it got flagged again fifteen minutes later. A quick definition update fixed it completely.

Force an update

1. Open Windows Security again.
2. Click Virus & threat protection.
3. Scroll down to Virus & threat protection updates and click Check for updates.
4. Wait for the update to download and install. It usually takes 10–30 seconds.
5. After it finishes, close the window and run a quick scan on the file that was flagged. Right-click the file in File Explorer and choose Scan with Microsoft Defender.

Expected outcome: If the false positive was caused by an old definition, the scan will now come back clean. You won’t need an exclusion. The file will run normally.

If it still flags after the update, move on to Cause 3.

Cause 3: Third-party security software or a conflicting antivirus is reporting the false positive

This one is sneaky. You might see the Trojan:Win32/Occamy.C warning in Windows Security, but the real source is another antivirus program you installed—like Malwarebytes, Avast, or McAfee. These tools sometimes register their own alerts inside the Windows Security interface. I’ve seen this with Malwarebytes Premium 4.5.8 and a legitimate AutoHotkey script.

The fix here is to either add an exclusion in that third-party program or disable its real-time protection temporarily.

Check which antivirus is actually flagging the file

1. Open Windows Security and go to Protection history.
2. Click the Trojan:Win32/Occamy.C entry. Look at the Initiating program listed in the details. If it says something like Malwarebytes or Avast instead of Microsoft Defender, that’s your culprit.

Fix it in the third-party software

• If it’s Malwarebytes: Open Malwarebytes, go to Settings > General > Allow List (or Exclusions in older versions). Add the file or folder there.
• If it’s Avast: Open Avast, go to Menu > Settings > General > Exclusions. Add the file path.
• If it’s McAfee: Open McAfee, go to Virus and Spyware Protection > Real-Time Scanning > Excluded Files. Add the file.

After you add the exclusion, restart the program. It should launch without any warning.

Expected outcome: The alert stops appearing in both the third-party tool and Windows Security. The program runs normally from that point forward.

Quick-reference summary table

That's it. Start with Cause 1 because that solves 9 out of 10 cases. If that doesn't work, move down the list. You'll have your program back in five minutes.