Either a false positive, or something else installed the malware.