Windows 10: False TrojanDownloader:JS/Vdehu.A

Hello,


So Windows Defender is sometimes bad at detecting things but im a little confused about this. I keep getting windows defender notifications saying I have a Trojan in my cache of my browser (Brave). I went inside the file and looked around, of course it was a HTML file with nothing suspicious. I scanned line by line and could find nothing (note I work with python and CLI's not HTML so im a little rusty). Can someone tell me what is going on? I ran it with malwarebytes and nothing; I don't want to ignore it because if my code reading skills deluded me I dont want to have a Trojan on my computer. I dont want to send the file because it was a file of a website with personal information on it.

:)

 

Trojandownloader: O97M/adnel

Hi,

I used the Microsoft Malicious Software Removal Tool to scan my computer. The scan results show Trojandownloader O97M/adnel as malicious software detected but not removed.

The Microsoft Malicious Software Removal Tool did not remove this trojan file. I dont know why.

How do I remove this malicious software?

Thanks

<Moved from Windows 10>

 

check the Windows Store for an app to open TrojanDownloader ;-)

On this pageof the Malware Protection Center:

https://www.microsoft.com/security/...JS/Swabfex.P&threatid=2147708931&enterprise=0

there is a line:

"This threat variant belongs to the TrojanDownloader:JS/Swabfex malware family"

The URL is not of the http:// type, but exactly as the text: TrojanDownloader:JS/Swabfex. If I click that I get a warning first that this webpage wants to open a program on my computer. Interesting! If I continue, Windows goes looking in the Store for an
app "to open trojandownloader". It doesn't find any app for this. Maybe there will be one on April 1st.

BTW the URL whatnonsense:isthis (using Internet Explorer, doesn't work with Edge) makes Windows look in the Store for an app to open whatnonsense.

 

False positive for desktop shortcut scanner.lnk

The 1.239.488.0 virus / spyware definition update that rolled out about 24 hours ago appears to be producing a false positive for any shortcut placed on the desktop called "Scanner.lnk". I can consistently replicate a false positive for Trojan:Win32/FakeSysdef
with the following steps.

• Create a shortcut to an exe file.
• Place the shortcut on the desktop.
• Name the shortcut "Scanner".
• Run "Quick Scan".

I don't get the same result by directly scanning the file, nor by uploading the file to www.virustotal.com, so it would appear this is as a result of a heuristic rather than a file content analysis. I also don't get the same result with a shortcut that links
to a website.

Can anyone else replicate? How can we go about getting the Windows Defender team to reconsider this heuristic? It's a bit heavy-handed.