Share via

A trojan virus found by Defender in a Microsoft patch.

Anonymous
2018-03-02T15:34:46+00:00

Updates and fixes were recently applied to Windows 10 on my laptop. A day or two later Windows Defender found a trojan virus in one of the patch files.

How can I check to find whether this patch has been applied?

Has this been reported previously?

Is there a chance this virus was installed through the patch onto my system?

Information reported by Defender:

Trojan:JS/Flafisi.D

Alert level: Severe

Status: Quarantined

Date: 3/1/2018

Recommended action: Remove threat now.

Catagory: Trojan

Details: This threat is dangerous and executes commands from an.....

Affected items:

file: C:\Users\Steve\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC#!001\MicrosoftEdge\Cache\IF2CB6U3\microsoft-patch[1].hta

file: C:\Users\Steve\Downloads\microsoft-patch.hta

webfile: C:\Users\Steve\Downloads\microsoft-patch.hta|https://d3e7d762rhxjf6.cloudfront.net/78125936121012/1519966303244803/microsoft-patch.hta|pid:11616,ProcessStart:131644398323836421

Windows for home | Windows 10 | Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2018-03-10T18:28:38+00:00

    The Microsoft-patch.hta file is normally detected by Windows Defender as Trojan:JS/Flafisi.D in Windows 10 – but might not be detected as malware on another version of Windows. The download page is most likely a new template being deployed by the Kovter Group malvertising campaign – and these pages frequently reappear with repeated connections to the malware-ridden domain(s):

    https://www.proofpoint.com/us/threat-insight/post/kovter-group-malvertising-campaign-exposes-millions-potential-malware-and-fraud

    These attacks are potentially very damaging because these HTML apps can actually be downloaded, and presumably executed, after Windows Defender has detected and “quarantined” them; as I’ve shown for the FlashPlayer.hta file in this discussion thread:

    https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/im-seeing-trojanjsflafisid-detections-and-tech/8fbe8eaf-1af0-4e76-9ab0-57828f631a5f

    The download somehow evades detection by the Defender IOAV post-download scan and isn’t detected with a context-menu scan. Since these Kovter template HTML apps are known to contain highly obfuscated JavaScript code that runs a PowerShell downloader, they should always be presumed to be “armed and dangerous”:

    The best defense would most likely be an ad-blocker like uBlock Origen that selectively blocks suspect domains:

    Settings and More > Extensions > Get extensions from the store

    GreginMich

    Was this answer helpful?

    3 people found this answer helpful.
    0 comments
  2. Sumit 43,801 Reputation points Volunteer Moderator
    2018-03-02T15:44:12+00:00

    Microsoft never releases a patch in .hta format. From where did you download the patch?

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Sumit 43,801 Reputation points Volunteer Moderator
    2018-03-03T04:35:50+00:00

    To be sure off,

    Scan using Malwarebytes:

    https://www.malwarebytes.com/

    Perform a Windows Defender Offline Scan:

    https://support.microsoft.com/en-in/help/17466/...

    Was this answer helpful?

    0 comments
  4. Anonymous
    2018-03-02T16:13:35+00:00

    I normally keep my network connection as a "metered connection" to keep control over when fixes and updates are downloaded and applied. I turned that setting off the day before Defender found this trojan. Fixes were downloaded and applied that same day automatically by Windows. I did not initiate the download. The next day, March 1, Defender found the virus.

    Was this answer helpful?

    0 comments