I don't know if this is related in any way, but years ago I used to send out emails to clients. It was getting blocked, so I had to convert the pdf file attachment to a simple text file.

Two years later, another one of my information files was getting blocked by clients with gmail accts. I created a gmail account and tested enough to determine gmail was content screening.

So I stripped off all file attachments. it was still being blocked! So I then started deleting sentences in the body of the email message, starting with suspect things like links. Then I searched for names and any inflammatory comments.

After 5 hours, I traced the string of text that gmail was rejecting. It was just a few innocuous words from a sentence. i can't remember the words, but I was shocked. The words were completely innocuous and ordinary. It contained now names of people or things. nothing.

I've learned a lot since then. Lots of reasons why ESPs would black list or gray list an ip address. But also, as the story reflects, how fickle and erratic that content screening can be.

So can it be possible that whatever is was that was triggering Defender alerts was something we wouldn't even consider suspect. Unless MS announces what it was, we may never know. Does that make sense?

Tried with and without 'save from' extension. Manually searched for the "c0ac6bec106548d2_0" and it is no longer being generated.

I'm no expert either, I guess maybe false positive.

I have 44,450 files in my js folder. I found "https://lookmeet.tv/" in 20 of those files. Yet I had no Defender warnings since 9-8 @11:24AM (ie over 24 hrs). Either it's not the threat or else Microsoft turned off the warnings for that site. But I'm no expert in this stuff.

But, today it doesn't - the file exists.
Wtf, are you sure you guys don't have the file still?
Please try to search "c0ac6bec106548d2_0"

Seems like the Microsoft AV likes the file now... :S

Same, not getting alerts from defender anymore but I searched and found the same file.

@Svarnoy60 said in Windows Defender detecting Virus JS/Adrozek.A:

Removed the SaveFrom.net video upload extension. The threats are gone.
Who has this extension?

I have that extension.

The file has link to https://lookmeet.tv/ a russian site.

I will delete file and disable extension and see if it regenerates again.

Removed the SaveFrom.net video upload extension. The threats are gone.

Upload extension or download extension? As in, is it this one https://addons.opera.com/en/extensions/details/savefromnet-helper/?display=en?

I installed that one and don't get the problem. I looked at the source briefly, but there's a lot of code in there.

@burnout426 - i think this is it: https://addoncrop.com/en/

The Youtube Downloader one? I checked it out and it doesn't seem like that's the culprit. It does contain some obfuscated strings in its apps/scripts/background.js file though, so I wouldn't totally trust it without looking more into it and decoding the string escapes.

But what is the suspect link now? Someone sounded like we know what it is.

Removed the SaveFrom.net video upload extension. The threats are gone.
Who has this extension?

I had it, though I'm not sure it was it.

HD Video Downloader

Link? I see a Chrome app for it, but not an extension.

have "Force Download 1.08" at ashus.ashus.net.

I checked out the source of that one. It looks fine at least.

But, today it doesn't - the file exists.
Wtf, are you sure you guys don't have the file still?
Please try to search "c0ac6bec106548d2_0"

Seems like the Microsoft AV likes the file now... :S

The alert pops up when some task in Opera re-creates the file named c0ac6bec106548d2_0 and it happens just leaving the browser open on the home page.

Most probably the file is being cached from a visited page or from an extension. That's why me and others don't see the alert. And that's why Microsoft needs to say why the file is being considered a threat.

Those getting the alert should contact Microsoft and ask why the alert is popping up.

The alert pops up when some task in Opera re-creates the file named c0ac6bec106548d2_0 and it happens just leaving the browser open on the home page.

@mouse said in Windows Defender detecting Virus JS/Adrozek.A:

I can't open the suspect js cache files because Defender quarantines them.

You can access the quarantined file closing Opera (just to prevent code execution) and restore them from Defender's history.

But this is a hit or miss exercise. Why can't Opera troubleshoot this?

Basically, you already answered your own question. So far there doesn't seem to be a way to reproduce the issue and, therefore, there isn't a way to find out what the problem would be.

Those getting the alert should contact Microsoft and ask why the alert is popping up.

A full disk scan with Defender found the same threat in 4 different cache files and removed them: alerts still coming from the above mentioned file regenerating in js cache but any new full scan now is clean.