WD bogus notification: malware detected and cleaned

  1. eLPuSHeR's Avatar
    Posts : 2,190
    Windows 10 Home x64
       #1

    WD bogus notification: malware detected and cleaned


    Hello.

    I received a notification today from WD (at the notifications area) stating that "malware detected and is being cleaned". Funny enough I checked WD history and nothing was found there. I clicked on the notification and nothing was shown there either.

    What gives?

    I have been scanning several folders (browsers cache, appdata and so on, as well as a quick test) with WD but my system seems to be pretty clean. Could it be that Steam was opened when I got that notification?
      My Computer

  2. simrick's Avatar
    Posts : 15,923
    W10Prox64
       #2

    Hi.
    I don't think Steam would cause that.
    I would run ADWCleaner just to be sure there's not something on the system that Defender is having trouble with. Please make sure all programs are closed as it will require a reboot if there is anything to "clean". If it does indeed find something, please post the log here for us to have a look. C:\AdwCleaner\AdwCleaner.txt
      My Computer

  3. eLPuSHeR's Avatar
    Posts : 2,190
    Windows 10 Home x64
    Thread Starter
       #3

    I already ran AdwCleaner. Nothing found.

    Could it be that the notification system itself is wonky? Sometimes I get the "ding" sound from notification area but nothing is found there. I mean, sometimes Windows10 makes that sound without reason.

    But then again, the message "malware found and being cleaned" was clearly there in this case.
      My Computer

  4. simrick's Avatar
    Posts : 15,923
    W10Prox64
       #4

    eLPuSHeR said:
    I already ran AdwCleaner. Nothing found.
    Good!
    eLPuSHeR said:
    Could it be that the notification system itself is wonky? Sometimes I get the "ding" sound from notification area but nothing is found there. I mean, sometimes Windows10 makes that sound without reason.
    I've had that happen a couple of times myself. Not sure what it was all about either - no notifications anywhere.
    eLPuSHeR said:
    But then again, the message "malware found and being cleaned" was clearly there in this case.
    That is suspicious indeed. Have a look here and see if there's anything (this is supposed to be where Defender puts the quarantine):
    Code:
    C:\ProgramData\Microsoft\Windows Defender\LocalCopy
      My Computer

  5. Slartybart's Avatar
    Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #5

    See if this sheds any light on the subject.

    PowerShell (run as administrator)
    Get-MpThreatDetection
    Get-MpThreat

    Use PowerShell to See What Windows Defender Detected | Hey, Scripting Guy! Blog

    There were no results when I ran them on my machine.

    And this details WD events

    Troubleshoot Windows Defender in Windows 10 (Windows 10)
      My Computer

  6. eLPuSHeR's Avatar
    Posts : 2,190
    Windows 10 Home x64
    Thread Starter
       #6

    @Simrick

    The folder C:\ProgramData\Microsoft\Windows Defender\LocalCopy is empty.

    @Slartybart

    OK. I got it. WD mistakenly flagged ZHPCleaner as a trojan.

    It's a false positive. I think it's because most AV software tends to mistakenly flag all AutoIT software as trojan. It must be some heuristics issue.

    Marking thread as solved now.

    I really appreciate your help.

    Best regards.
      My Computer


  7. simrick's Avatar
    Posts : 15,923
    W10Prox64
       #7

    eLPuSHeR said:
    @Simrick

    The folder C:\ProgramData\Microsoft\Windows Defender\LocalCopy is empty.

    @Slartybart

    OK. I got it. WD mistakenly flagged ZHPCleaner as a trojan.

    It's a false positive. I think it's because most AV software tends to mistakenly flag all AutoIT software as trojan. It must be some heuristics issue.

    Marking thread as solved now.

    I really appreciate your help.

    Best regards.
    Sounds good. Glad you figured it out! :)
      My Computer

  8. eLPuSHeR's Avatar
    Posts : 2,190
    Windows 10 Home x64
    Thread Starter
       #8

    To sum it up, I must say that those Powershell commands pointed me in the right direction.
      My Computer


 

Related Threads
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 05:18.
Find Us




Windows 10 Forums