How To Report a Trojan Malwarebytes did not find?

[RedstoneJoe]

I had a trojan for 6 months that malwarebytes never found, but out of the blue I tried AVG, also not found, then if you can beleive this turned on Windows defender and it found it.

 

should up-date malware bytes somehow to also find this trojan.

 

Joe

[LDTate]

Hello  and

 

Do you still have the file?

Please go to  http://www.virustotal.com click on Scan, and upload the file for analysis:

**(Full Path To File)**

Then click Scan it Tab.  Allow the file to be scanned, and then please copy and paste the link to the results page here for me to see.

 

[RedstoneJoe]

Windows defender found it, removed it, not sure if quaranteened it, or plain removed it, where would it be if in quaranteen?

 

I'm doing a new scan again right now to make sure it is still gone.

[LDTate]

Try this:

https://www.thewindowsclub.com/manage-quarantined-exclusions-windows-defender-security-center

[RedstoneJoe]

Ok, I'm still scanning right now still got 6 hours to go,

 

But I looked in my history and got the name of it. now.

 

Now,,, I have been for countless years been a promoter and supporter of Malwarebytes. And was amazed that it did not catch this one.

 

If I tell you what it is so you can protect the thousands of others out there, good for a years subscription?

 

Joe

[LDTate]

6 hours?

Quote

Now,,, I have been for countless years been a promoter and supporter of Malwarebytes. And was amazed that it did not catch this one.

Not sure at this point if it's really a bad guy or not.  Defender has had false positives before.

That's why we need it uploaded and checked at VirusTotal

Quote

If I tell you what it is so you can protect the thousands of others out there, good for a years subscription?

I would have no control over that.

[RedstoneJoe]

heres the name.

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fZpevdo.A&threatid=2147727143

 

[LDTate]

In order for the MBAM Team to add detection's, they'd need a sample of the file.

The definition isn't helpful without the file.

[David H. Lipman]

@RedstoneJoe

 

Please reference the following on how to provide sample submissions such that Malwarebytes' Anti-Malware (MBAM) can detect targeted but presently undetected threats.

Malware Hunters group
Purpose of this forum

The Forum location for Windows malware file submissions is;  Newest Malware Threats

 

[LDTate]

David,

That won't do much good without the file

[David H. Lipman]

True - But he'll know what to do with it when it is found ( assuming it wasn't permanently  removed by Windows Defender ) or any other files he might find now or in the future.

[RedstoneJoe]

1 hour ago, LDTate said:

Hello  and

 

Do you still have the file?

Please go to  http://www.virustotal.com click on Scan, and upload the file for analysis:

**(Full Path To File)**

Then click Scan it Tab.  Allow the file to be scanned, and then please copy and paste the link to the results page here for me to see.

I do not see "SCAN"

1 hour ago, LDTate said:

 

 

[LDTate]

Click on Choose File

[RedstoneJoe]

40 minutes ago, RedstoneJoe said:

I do not see "SCAN"

 

I am sorry, None of this is visible. I go there and do not see any file name but it is still listed in the history

[LDTate]

That's too bad as we'd really like to find out what file caused it.

If that ever happens again, before doing anything with the file, have it checked at VirusTotal.

The information at VirusTotal, is shared with all the major AV's.

 

[RedstoneJoe]

But see even if it happened again nothing would be different, so lets take this one step at a time, I go to that link and I see this,

Now what is my next step?

 

Joe

[LDTate]

You click Choose File

You should then be able to go to where the file is and select it

[RedstoneJoe]

Bingo,

 

That's just it, I have no idea where defender put it. any suggestions?

 

Joe

[LDTate]

Did you try this?

https://www.thewindowsclub.com/manage-quarantined-exclusions-windows-defender-security-center

[RedstoneJoe]

Great!

 

Yeah I went there and it listed the file name as was sent in the other e mail. but all it did was list what it quaranteened.

 

There is no location mentioned about it or where it is,   and now when I go and look again now there are none listed at all UG!

 

So how does this work anyway, now that it is was quaranteened, it is not don't worry about it?

I wish I could have given it to you. any other way?

Joe

[LDTate]

Once it's quarantined, it's not active so it can't do any harm.

I don't know how long Defender keeps a quarantined file before deleting it.

Sorry there's nothing else we can do.

[RedstoneJoe]

Thanks for trying, sadly just like 30 minutes ago it was still there he he he Now gone. Oh well,  Now hopefully never again, first issue since 1994 in my computer lifetime!

 

Now if it was there, where do I look to see where it is holding it?  so I can send it in the future.

 

Joe

[LDTate]

The link I gave you should show where it would be held.

https://www.thewindowsclub.com/manage-quarantined-exclusions-windows-defender-security-center

 

[RedstoneJoe]

you would think so, but all it does is list what it quarantined, and provide a link to that web page I sent ya that tells what it is, in no way does it tell you where it is held.

[LDTate]

I found these doing a Google Search

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus

 

1. Open windows defender.

2. Go to history tab.

3. In the history tab check for quarantined items.

4. Click on view details.

5. In the description it shows you the file path and you can select the check box and restore the files.

 

If you tell Windows Defender to allow files that it wants to quarantine on Windows 7, it puts them in the following directory:

C:\ProgramData\Microsoft\Windows Defender\LocalCopy

 

Location in Windows 10 is C:\ProgramData\Microsoft\Windows Defender\Quarantine