While this is often a false positive caused by the trainer's packing/compression, it requires the user to disable active protection to run the tool.