Windows 10: Trojan Detected in OneDrive

The odd thing is I don't even use OneDrive except to automatically upload photos from my Android phone to my desktop; nothing has been detected on the phone.
I've run another full scan with Bitdefender and Malwarebytes Anti-Malware (free) without any further detection.
Was just wondering if there might be other steps I need to carryout to be sure nothing spreads? Thanks!





:)

 

expressdownloader

cannot detect or delete

know Trojan is there from Malwarebytes - it detects - but fails on delete.

This is a nasty Trojan ... how can this be killed with defender???

 

database of malware producing false positives or false negatives

Many months ago I communicated with Malwarebytes about a trojan that was detected by Defender that was not detected by Malwarebytes. They indicated that Microsoft Defender is likely a false positive and to wait weeks or months for Microsoft to update their
database. To date the Defender continues to detect a trojan that is not detected by Malwarebytes.

Defender does not detect any malware on quick scans. However on full scans it detects this trojan that is not detected by Malwarebytes.

How does an end user determine whether one antivirus program is producing false positives or false negatives?

 

I don't use OneDrive but i am very familiar with the Heur Trojan , it's a complete nightmare and one of the worst i ever experienced .

If it was me i would wipe and re install but i never keep anything of importance on my computer so thats easy for me to say .

I had to use Dban to get rid of that thing completely .

 

I wouldn't be surprised if there are many more Trojan files on One-Drive.

 

I have been checking out different AV's recently, and whilst I liked the look of bitdefender, according to the forum site the free version is not compatible with windows 10, even though it can be installed it is not reliable, could be the reason you got the virus, or maybe bitdefender is giving false info.

Might be worth checking with another AV first. Hope this helps.

Bitdefender Antivirus Free Edition Windows 10 - Bitdefender Forum

 

Thank you, I've uninstalled Bitdefender and reinstalled Avast (donno why I left it in the first place), as well as followed the complete instructions at the following link, without further detection (besides tracking cookies, which were removed).

Remove HEUR.Trojan.Win32.Generic (Virus Removal Guide)

I've also disabled OneDrive on the PC (OneDrive Integration - Enable or Disable in Windows 10 - Windows 10 Forums) and uninstalled it on the phone.

Do you think it's safe to say, I'm safe now?

 

I never assume i am completely clean when i have dealt with the Heur Trojan because i made that mistake before , was convinced it was gone and a day or two later the nightmare repeated.

That link you posted said it is one that often does install a "backdoor" so your just going to have to keep an eye on your system . It is one of the most resistant Trojans i have ever dealt with.

The Free Kaspersky one time scan ALWAYS picks up the Heur Trojan so consider running that one time scan , if that says clean i think your clean because it never misses that Trojan if it's on your system hiding.

Emsisoft and Eset Online Scanner do a great job picking up stuff that others often miss as well .

 

Can I just make an observation here?

From your pic, it appears that the executable OneDrive.exe has been flagged as a virus. This sounds like a FP (false positive) to me.

I would suggest you upload that file to VirusTotal website and see what comes up there.

I have the same file on my system in the same location and it's 536KB. I do not use OneDrive on this particular machine.

I do not think you are infected with anything. Did TDSSKiller find anything on that file?

 

You could give Norton Power Eraser a shot. You can find it here. It would be advisable to read the tutorial.

Norton Power Eraser | Free Tool | Easily remove scamware that traditional virus scanning can’t detect.

 

I suspect you may be correct about it being a false positive (or something to do with Bitdefender). Besides Bitdefender alerting to it, I've seen no signs of infection.
If signs of infection do occur I'll investigate it further, until than I think I'm ok. Thanks all for the help. Peace!

 

Glad to have been of help.

 

Seems to be a regular occurrence with BD..

Google

 

Oh! *Wink