Windows Defender detecting Virus JS/Adrozek.A

[burnout426]

burnout426 Volunteer last edited by

I'd copy the file and look at it in a text editor and hex editor to see if there's anything revealing. Might have to run it through a Javascript bytecode decompiler or something too.

Anyone want to zip up the file and make it available for download?

[tjall]

tjall last edited by This post is deleted!

[wanderlei]

wanderlei last edited by

Same issue for me. Opera browser keeps generating this threat. Website visited is irrelevant to its creation.

[leocg]

leocg Moderator Volunteer @wanderlei last edited by

@wanderlei So after you have cleaned cache and the directory mentioned on the alert, you get the alert again in the first page you visit?

[burnout426]

burnout426 Volunteer last edited by burnout426

@tjall, just pasting this part of the URL you posted in Notepad++ triggers Windows Defender for me (in the Notepad++ backup file that gets auto-generated for the document):

I suggest others with this problem look in the detected file to see what URL is listed. Just in case, do a screen shot of it or something so it doesn't trigger defender when users visit this thread

[Svarnoy60]

Svarnoy60 @leocg last edited by

@leocg @vendimia Вам нужно попробовать узнать, с какой страницы он идет. Предположим, что это не ложное срабатывание.

ни с какой страницы. просто при открытии браузера

[vsolanic]

vsolanic last edited by

I have the same issue. Is it clear by now if it is a real virus, or what exactly it is?

[wanderlei]

wanderlei @leocg last edited by

@leocg said in Windows Defender detecting Virus JS/Adrozek.A:

@wanderlei So after you have cleaned cache and the directory mentioned on the alert, you get the alert again in the first page you visit?

What happen with me, I got alert from defender, I removed the suspect file, I start browsing completely different site, the same alert from defender again. This happened 6 times across different sites.

I downloaded and ran malwarebytes but everything thing was clean.

I run a few extensions, I will disable all of those and see what happens.

[mouse]

mouse last edited by

@wanderlei said in Windows Defender detecting Virus JS/Adrozek.A:

wanderlei

I suspect you're right. It's not a bad web page. Not likely that we're all on that web page. This has been happening for just a few days. I think it's a false positive. When I run Super anti-spyware or Spybot on the cache, it picks up no threat. But i could be wrong.

[jclinansmtih]

jclinansmtih last edited by

Same thing just started popping up for me too. Only with Opera. I am starting to wonder if there is something going on with Windows Defender and Opera. We all cant be visiting the same sites who have posted in this thread.

[quocvo]

quocvo last edited by

I just removed a video dowloader extension. And It worked. Hope it help.

[burnout426]

burnout426 Volunteer @quocvo last edited by

@quocvo What's the name and link of the extension?

[leocg]

leocg Moderator Volunteer @Svarnoy60 last edited by

@Svarnoy60 Use English here.

[leocg]

leocg Moderator Volunteer @wanderlei last edited by

@wanderlei So far I didn't get such alert from Windows Defender, so it seems to me that the problem is related to a specific site or to an extension.

[Svarnoy60]

Svarnoy60 last edited by

Removed the SaveFrom.net video upload extension. The threats are gone.
Who has this extension?

[Svarnoy60]

Svarnoy60 @quocvo last edited by

@quocvo SaveFrom.net

[VDNKh]

VDNKh last edited by

Very same problem here, it started to happen from 02/09 browsing ansa.it website: history for the last days recorded negligible browsing with just the usual 3 tabs opened (youtube (for music) , gpone and amazon; no extension added in months.

A full disk scan with Defender found the same threat in 4 different cache files and removed them: alerts still coming from the above mentioned file regenerating in js cache but any new full scan now is clean.

[mouse]

mouse @Svarnoy60 last edited by

@Svarnoy60 - I do not use the savefrom downloader. I have "Force Download 1.08" at ashus.ashus.net. and I have "HD Video Downloader". But I don't use them. I use IDM instead. I will disable the ones I don't use. But this is a hit or miss exercise. Why can't Opera troubleshoot this? I can't open the suspect js cache files because Defender quarantines them.

[leocg]

leocg Moderator Volunteer @mouse last edited by

@mouse said in Windows Defender detecting Virus JS/Adrozek.A:

But this is a hit or miss exercise. Why can't Opera troubleshoot this?

Basically, you already answered your own question. So far there doesn't seem to be a way to reproduce the issue and, therefore, there isn't a way to find out what the problem would be.

Those getting the alert should contact Microsoft and ask why the alert is popping up.

[VDNKh]

VDNKh @leocg last edited by

@leocg said in Windows Defender detecting Virus JS/Adrozek.A:

Those getting the alert should contact Microsoft and ask why the alert is popping up.

The alert pops up when some task in Opera re-creates the file named c0ac6bec106548d2_0 and it happens just leaving the browser open on the home page.

@mouse said in Windows Defender detecting Virus JS/Adrozek.A:

I can't open the suspect js cache files because Defender quarantines them.

You can access the quarantined file closing Opera (just to prevent code execution) and restore them from Defender's history.