I think this is pretty interesting. Ed Bott from Zdnet tried to get an answer about the other 20% and recieved an evasive one stating that Microsoft would not be able to share specifics and that those mostly resulted from “activities such as various forms of tampering and unauthorized OEM installations.” The only conclusion that I can come up with is that there is most likely a large number of false positives and Microsoft does it´s best to keep this number secret.