Trojan:Win32/Kepavll!rfn on DLSS 5 Tools: Real or False?

Is Trojan:Win32/Kepavll!rfn a real virus?

Not necessarily. The !rfn suffix marks a machine-learning verdict from Microsoft Defender’s cloud protection, not a match against a known piece of malware. It tends to fire on new, unsigned programs that download or place DLLs in other programs’ folders — which is exactly what DLSS 5 tools do.

In September 2026 the same detection name appeared on three different files in the DLSS 5 ecosystem:

Other machine-learning names appear too. On September 30 a user reported Trojan:Win32/Wacatac.B!ml on the official DLSS5-Swapper-2.2.9-portable.exe, downloaded from GitHub’s own release storage (issue #404); the developer had not replied by October 5. The check below works the same for any detection name.

A false positive on the official file and real malware in a fake download produce the same alert. The detection name alone cannot tell you which one you have — the file’s origin and hash can.

How to decide in two minutes

1. Open Windows Security → Virus & threat protection → Protection history and read the file path in the alert.
2. Find where that file came from. If it came from the developer’s GitHub Releases page, continue. If it came from a mirror, a YouTube description link, another GitHub account or a password-protected archive, delete it and stop here.
3. Compute its SHA-256. The easiest way is the download verifier, which runs in your browser and never uploads the file. You can also run Get-FileHash in PowerShell.
4. If the hash matches an official release, the file is the developer’s genuine build. You can restore that single file from Protection history (Actions → Allow on device).
5. If the hash does not match, keep it quarantined, delete it, and run a full scan.

Never switch off real-time protection or add a whole game or Downloads folder as an exclusion. Allow only the one verified file.

Why this alert appears more on DLSS 5 tools

• Unsigned binaries. None of the community DLSS 5 tools ship with a code-signing certificate, so Windows has no publisher reputation to rely on.
• DLL placement. Installing a route writes files such as dxgi.dll, ReShade add-ons and a copy of nvngx_dlssnr.dll into game folders — the same behaviour Defender watches for in malware.
• Sudden popularity. Hundreds of thousands of new downloads of a brand-new file look unusual to reputation systems.

The same reasons make these tools an attractive disguise for real malware. Look-alike repositories already publish “DLSS 5 Swapper” as password-protected ZIPs or tiny executables. See how to spot fake downloads.

Report a false positive to Microsoft

If your file matches the official hash, you can submit it for review through the Microsoft Security Intelligence file submission page. Choose Incorrectly detected as malware, and include the detection name and the developer’s release link. This helps everyone who downloads the same release.

What this does not tell you

A matching hash proves the file is the one the developer published. It is not an independent audit of the developer’s code. For the wider picture — source, components and account risk — read is DLSS 5 Swapper safe? and online games and bans.