Windows 10: Windows universal Telemetry Event ID 55 " Is internet Available: True " False positive...

Dear All,I hope someone can shade some light on this weird issue.I've a machine that have no internet access, however it starts logging event id 55 in windows telemetry channel. " Is internet Available: True "Doing deep investigation on the machine, I couldn't find any request to msftncsi.com or any communication with public IPs.Is there a probability that this is a false positive event?If not how can I check further to confirm if the machine really had internet access before during the log of this event?I checked this article and checked all the listed event ids on it and no indication of s

:)

 

Windows universal Telemetry Event ID 55 " Is internet Available: True " False positive occurrence

Dear All,

I hope someone can shade some light on this weird issue.

I've a machine that have no internet access, however it starts logging event id 55 in windows telemetry channel. " Is internet Available: True "

Doing deep investigation on the machine, I couldn't find any request to msftncsi.com or any communication with public IPs.

Is there a probability that this is a false positive event?

If not how can I check further to confirm if the machine really had internet access before during the log of this event?

I checked this article and checked all the listed event ids on it and no indication of successful internet access. however I'm really confused from the telemetry log, can someone trick the machine to log this log although no internet access?

Redirecting

Any help will be much appreciated.

 

False positive for desktop shortcut scanner.lnk

The 1.239.488.0 virus / spyware definition update that rolled out about 24 hours ago appears to be producing a false positive for any shortcut placed on the desktop called "Scanner.lnk". I can consistently replicate a false positive for Trojan:Win32/FakeSysdef
with the following steps.

• Create a shortcut to an exe file.
• Place the shortcut on the desktop.
• Name the shortcut "Scanner".
• Run "Quick Scan".

I don't get the same result by directly scanning the file, nor by uploading the file to www.virustotal.com, so it would appear this is as a result of a heuristic rather than a file content analysis. I also don't get the same result with a shortcut that links
to a website.

Can anyone else replicate? How can we go about getting the Windows Defender team to reconsider this heuristic? It's a bit heavy-handed.