WD bogus notification: malware detected and cleaned

eLPuSHeR · 27 Jun 2016

Hello.

I received a notification today from WD (at the notifications area) stating that "malware detected and is being cleaned". Funny enough I checked WD history and nothing was found there. I clicked on the notification and nothing was shown there either.

What gives?

I have been scanning several folders (browsers cache, appdata and so on, as well as a quick test) with WD but my system seems to be pretty clean. Could it be that Steam was opened when I got that notification?

simrick · 27 Jun 2016

Hi.
I don't think Steam would cause that.
I would run ADWCleaner just to be sure there's not something on the system that Defender is having trouble with. Please make sure all programs are closed as it will require a reboot if there is anything to "clean". If it does indeed find something, please post the log here for us to have a look. C:\AdwCleaner\AdwCleaner.txt

eLPuSHeR · 27 Jun 2016

I already ran AdwCleaner. Nothing found.

Could it be that the notification system itself is wonky? Sometimes I get the "ding" sound from notification area but nothing is found there. I mean, sometimes Windows10 makes that sound without reason.

But then again, the message "malware found and being cleaned" was clearly there in this case.

simrick · 27 Jun 2016

eLPuSHeR said:

I already ran AdwCleaner. Nothing found.

Good!

eLPuSHeR said:

Could it be that the notification system itself is wonky? Sometimes I get the "ding" sound from notification area but nothing is found there. I mean, sometimes Windows10 makes that sound without reason.

I've had that happen a couple of times myself. Not sure what it was all about either - no notifications anywhere.

eLPuSHeR said:

But then again, the message "malware found and being cleaned" was clearly there in this case.

That is suspicious indeed. Have a look here and see if there's anything (this is supposed to be where Defender puts the quarantine):

Code:

C:\ProgramData\Microsoft\Windows Defender\LocalCopy

Slartybart · 27 Jun 2016

See if this sheds any light on the subject.

PowerShell (run as administrator)

Get-MpThreatDetection
Get-MpThreat

Use PowerShell to See What Windows Defender Detected | Hey, Scripting Guy! Blog

There were no results when I ran them on my machine.

And this details WD events

Troubleshoot Windows Defender in Windows 10 (Windows 10)

eLPuSHeR · 28 Jun 2016

@Simrick

The folder C:\ProgramData\Microsoft\Windows Defender\LocalCopy is empty.

@Slartybart

OK. I got it. WD mistakenly flagged ZHPCleaner as a trojan.

It's a false positive. I think it's because most AV software tends to mistakenly flag all AutoIT software as trojan. It must be some heuristics issue.

Marking thread as solved now.

I really appreciate your help.

Best regards.

simrick · 28 Jun 2016

eLPuSHeR said:

@Simrick

The folder C:\ProgramData\Microsoft\Windows Defender\LocalCopy is empty.

@Slartybart

OK. I got it. WD mistakenly flagged ZHPCleaner as a trojan.

It's a false positive. I think it's because most AV software tends to mistakenly flag all AutoIT software as trojan. It must be some heuristics issue.

Marking thread as solved now.

I really appreciate your help.

Best regards.

Sounds good. Glad you figured it out! :)

eLPuSHeR · 29 Jun 2016

To sum it up, I must say that those Powershell commands pointed me in the right direction.