Windows 10: the windows defender is showing a threat Win32/Vigua.A

the windows defender is showing a threat Win32/Vigua.A

:)

 

windows defender threats/windows update

this morning, my windows 10 PC showed lock screen, so i know there was an update done.

after logging in, a popup in notification area said windwos defender had found threats.

i clicked on it and when defender opened, it said, "no threats found".

so i checked the history--allowed and quarantined threats both showed 18 instances of "Misleading:Win32/Lodi--all dated today.

then, the "found threats" popped up again--while i was looking. also, at the same time, scan results popup comes up showing "no threats"--and immediately after, the "threats found" comes up.

knowing that there was an update, i looked there.

i checked the history and saw that 34 feature updates failed to install (or one failed 34 times--i don't know)--these going back to january.

there were successful ones as well, yesterday included.

since this shows Win32 as location, i pointed to the windows folder and found modification date as 2/13/2018.

however, the Win32 folder showed a modification as of today--2/14/2018

upon opening the folder, several mods were found with today's date--too many to mention here.

and that stupid "threats found" just popped up AGAIN.

my computer was clear yesterday. now all this.

what is going on?

please advise. i have screenshots, but far too many to show here.

this is driving me nuts.

thank you.

 

Windows defender false positive - forced to allow threat

Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis

 

Windows Defender picks up Win32/deplock but cannot get rid of it?

Dear All,

I wonder whether you've come across this one: I run Windows 20175 and I use MalwareBytes as main protection software. Yesterday I decided to also enable Windows Defender to fully scan the system.

Windows Defender found two trojans: One (which I can't remember its name!) and Win32/deplock. I got Defender to "take action"; It then showed that "dealt with all threats". Upon restart, I run a second full scan; the first threat has not come back since, but win32/deplock keeps appearing. Each time I get Defender to take action, it claims it does, shows that "threats have been dealt with" but after restart and full scan it appears again.

Interestingly, MalwareBytes has never picked either of these two as threats. Needless to say MalwareBytes and Defender are full up-to-date with latest updates.

I have also run Defender in off-line mode, same result, win32/deplock still being picked up.

Booted in Safe Mode, tried to run Defender but it's not enabled as a service under Safe Mode.

Any thoughts? Could it be a false positive?

Has anyone got a similar experience?


Thanks a lot!
Christos