compattelrunner.exe update

Granpasso

Hi everyone.
We're seeing a high number of reports of Trojans during the update of the file %windir%\system32\compattelrunner.exe (telemetry) on our clients.
The files involved are in :\Windows\Installer\XXXXX.msi (randomly generated file name).
Yesterday we had some reports on Virus Total (example: https://www.virustotal.com/gui/file/1e13b16e0b5f4571bbcd4afe4fbced659238eb5036262ea3c49889eafaf774a5?nocache=1).

Are you seeing the same cases?

WithSecure Elements,

Thanks in advance.

/NC

Sethu Laks

Hi @Granpasso

Thank you for reporting this, you're not alone, and we're aware of the situation.

We've received similar reports from other partners and customers where compattelrunner.exe and randomly-named MSI files in C:\Windows\Installer\ are being flagged as Trojans (e.g., TR/GenMalicious.EAQ, TR/Dropper.Gen) during Windows telemetry updates.

This is a false positive. The compattelrunner.exe is a legitimate Microsoft Windows component (Windows Compatibility Telemetry), and the MSI files in the Installer folder are standard Windows Installer cache files with auto-generated names — they are expected to appear during updates.

What we recommend in the meantime:

1. Submit a sample for validation through the WithSecure Elements portal: go to Requests → Create Request → Submit sample for validation, select "File" as the category and "FP - Clean file was blocked" as the reason, then attach the detected MSI file. This helps our detection team process the correction faster.
2. Temporary workaround: You can add a file hash exclusion in your Elements security profile for the affected files. Please note that since the MSI filenames and hashes may change with each update, this may need to be refreshed periodically until the detection is corrected.

Once the false positive correction is published, the detections should stop automatically without any action needed on your end.

We appreciate your patience and thank you for flagging this to the community — it helps us respond faster when we know the scope of impact.

Best regards,
Sethu
Community Moderator | Technical Support Engineer

European Cybersecurity for Mid-Sized Businesses | WithSecure