Windows 10: Problem with "Threat found - action needed." Trojan:HTML/Phish!MSR

I keep getting this threat notice. I have run windows update and did a quick scan and also did a Windows Defender Offline scan but the threat notice is still there. And I also checked this folder: C:\Users\tigerlyb\AppData\Local\Temp\chocolatey

and it's actually empty. It looks like the file is already removed but I still get this notice. Can anyone help?

:)

 

Trojan Found and Deleted....but it Returns (Trojan: HTML/Phish.AB!MSR)

Windows defender periodically finds a Trojan in a .htm file in my Windows Communications appdata area (see attachment). You will notice that the file is in the Attachments folder. Windows defender seems to delete this threat but after a few days or a couple
weeks, the threat will return in the exact same location.

I have no evidence that the Trojan is actually running on my computer. I believe it is just sitting in the file waiting to be executed. I have not knowingly run this file and am usually careful about phishing attacks.

Only Microsoft Defender will find it. I tried using Malwarebytes, Bitdefender and Microsoft Safety Scanner. None of these even finds it.

MS-Defender says that it is successful at removing it and a scan immediately after the clean will not find the Trojan.

A few troubleshooting actions to date:

• Have removed the threat and immediately opened all known Microsoft communications programs (Outlook, Windows Calendar/Mail, Skype, Skype-Biz, Teams). I then reran a scan but did not find the Trojan. Nevertheless, it did return a couple weeks later.
• I have started my computer in Safe Mode and deleted the entire package folder. After rebooting, the Trojan is no longer found by Defender. However, the folder and its content is eventually recreated along with the Trojan threat.
• I had a case opened at Microsoft (who more-or-less had me repeat everything I had already done). MS ultimately recommended that I rebuild/refresh my entire computer. I am not adverse to doing this but I am worried that since the Trojan appears to be in
  an attachment within Windows communications, it will simply return. I do not want to waste my time.

I currently run a daily scan of the appdata\package folder so that I can identify when the file returns.

MS-Surface Pro i7/16GB/512GB with all Windows 10 Pro updates completed.

Office 365 environment with most all files stored in OneDrive or SharePoint.

Thank you for any further thoughts on this issue.

-bs

 

Recurrent trojan, HTML/Phish quarantined by Windows Defender, and don't have active option/button to remove as suggested.

Hi!

Currently have,

edition Windows 10 Pro

version 1803

OS Build 17134.48

Slow ring with active development

For the last several build downloads, Windows Defender has been quarantining a severe trojan, HTML/Phish, providing file details, the suggestion to remove, but no obvious way to do so, like a "remove threat" button.

Two file examples are:

trojan : HTML/Phish

affected items:

file: C:\Users\3orch\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\116\GEUSE7738644[1175].html

C:\Users\3orch\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\116\GEUSE7738644[1719].html

Now, I will share my lack of expertise by asking why does this trojan keep recurring once quarantined by Windows Defender from build to build?

Is a clean install the only option I have? Kinda' thought that was done with each new build download? Also thought Windows Defender is adaptive/preventive in it's way of staying ahead of threats?

Thank you for any kind instruction and enlightenment.

Kind Regards,

 

Trojan malware: The hidden cyber threat to your PC

Trojan malware: The hidden cyber threat to your PC | ZDNet