Windows 10: applications: "Online-Guardian.exe" is it a threat ?

hi every one ... i noticed this app recently . idont know exactly how long it was there!

is it safe ? or i need to remove it ? if so how to remove it properly ?

i didnt notice any problem with it . just some times it uses some network data as seen in screen shots it the one shown as application (32bit) in task manager

some website says it could be harmless if it was a system app

my defender didnt catch it as virus and i dont have any 3rd party anti V



:)

 

Faulting application name: bad_module_info when trying to run exe installer

Hi,



Thank you for writing to Microsoft Community Forums.



In order to help you with the appropriate troubleshooting steps, please reply with the following details:

• Do you receive any error message when you run the .exe installer?
  
• Which version of Windows is installed on the computer currently? To check type:
  winver in the search bar on the Taskbar and hit Enter.
  

As you have mentioned that you have Kaspersky installed on the computer, it could be that Kaspersky is blocking the installers to run. I suggest you to try disabling Kaspersky and see if that helps. Please follow the steps to disable Kaspersky:

1. Type Kaspersky in the search bar on the
   Taskbar and open it from the search results.
   
2. Now, click on Settings.
   
3. Click on Additional and then click on
   Self-Defense.
   
4. Clear the check box for
   Enable Self-Defense to disable Kaspersky.
   
5. If you receive any prompt, click on Continue.
   
   Note: Disabling Antivirus software may open the computer to threats. Make sure to enable it after performing the troubleshooting.
   

You can also check if the application that you are trying to run is Quarantined by Kaspersky. If the application is Quarantined, restore the application and see if that helps. Please follow the steps mentioned below:

1. Type Kaspersky in the search bar on the
   Taskbar and open it from the search results.
   
2. Click on More tools.
   
3. In the Tools window, click on
   Quarantine.
   
4. Look for the .exe installer that you are trying to run. If you find the installer, right click on it and select
   Restore to restore it to its original location.
   

Please reply with the status of the issue, we will be glad to help you further.



Regards,

Nikhar Khare

Microsoft Community - Moderator

 

Windows defender false positive - forced to allow threat


Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis

 

NESHTA.A VIRUS REMOVED BUT .EXE NOT WORKING

Hi Khaled,

It is possible that you .exe is not working due to corrupted system files or account. To assist you better, kindly answer the following questions:

• Does this happen with a specific application or with all of your application?
• Have you tried creating a new admin account to check if the issue also with new account or only with the current account?

In the meantime, we suggest that you follow the steps in this article on how
to create a new admin account.

Let us know if you need further assistance.