Defender keeps finding the same "Trojan downloader"

For the past week Defender has been going off for a TrojanDownloader:O97M/Donoff or TrojanDownloader:O97M/Dornoe.C!ams. I'm not sure how to stop this happening, I don't download random email attachments or anything like that but the description of it seems to suggest that's how it's executed. Malwarebytes isn't finding anything else besides PUPs.

The location always seems to be in a similar area in AppData:

PHP Code:

C:\Users\Craig\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\75\Facture_Num_J691534[673].doc 


Not sure what to do with this one. I feel like it might be a false positive, but then I don't know where the docs are coming from.

Do you use office a lot. It sounds like the macro is running in office which keeps infecting you the problem being that its not found on a scan as its not active until you run office then you get the hit as then the virus is active.

First you want to open office applications one at a time and see which one triggers the virus wait a while in each application for it to be detected. You may then know which is infected this can scan for macros Macro Virus - How to remove - 2-viruses.com

That's the thing, I don't even have Office installed.

What are you doing when it finds it?

Samuria said:

What are you doing when it finds it?

I mostly come back AFK to find Defender scanned and found it.

Sp its showing a doc file J691534[673].doc what do you use to open them and were did it come from?

I don't open it.

simrick said:

Are you up-to-date with all Windows Updates? Java? Flash? etc.

Java and Flash I don't use, and Windows is always up to date.

If Defender quarentines malware, doesn't that mean I won't be able to upload it to virustotal?

Have you tried running Windows Defender in Offline mode, in case it helps remove the threat permanently ?

See this tutorial:
Windows Defender Offline Scan in Windows 10 | Windows 10 Tutorials

(quote from tutorial : "Windows Defender Offline is an antimalware scanning tool that lets you boot and run a scan from a trusted environment. The scan runs from outside the normal Windows kernel so it can target malware that attempts to bypass the Windows shell, such as viruses and rootkits that infect or overwrite the master boot record (MBR)." )