Windows defender detected HTML/Phish.refb!MTB in Windows server 2016 VHDX file

Question

Today Windows defender has detected Malware (HTML/Phish.refb!MTB) in VHDX file in the hyper-v host server.

When checked the VHDX file is added in quarantine for action. Also in C:\ProgramData\Microsoft\Windows defender\Resource data\97 a file is present with the same size of the VHDX file. This occupied Hyper-V host machines C:\ space. VHDX file is nearly 900 GB so equivalent to 900 GB another file is created in Windows defender quarantine folder.

I need to remove the quarantine file but, i am afraid removing the quarantine file will delete the original VHDX file from VMs folder.

I am stuck with my C:\ drive space is fully used

Answer 1

Hello

Thank you for your question and reaching out. I can understand you are having issues related to Windows defender detected HTML/Phish.refb!MTB in vhd file.

First of all please take back up of existing .vhdx file to avoid Defender to delete or quarantine the file.

Then do the FULL scan to remove this infection from vhdx and see if Defender can heal it without deleting the vhdx file.

----------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--