Windows defender rootkit?

Question

Hey guys, today i found after deep scan with avast free this:

C:\ProgramData\Microsoft\Windows Defender\Definition Updates{960E7296-B0DD-49C5-BE4F-9AA0EC444E37}\nisbase.vdm ...and the same path but to file  ..nisfull.vdm

Threat:high, rootkit:hidden file, cannot repair/delete/clean as the file(s) are probably in use by windows defender..

Should I worry or is it probably not real?

Im using Win 10 , ultimate edition, 64bits, avast free, all things are updated as of now...

I was trying to google, if it´s something known or old but no hints...

Answer 1

Hey guys, today i found after deep scan with avast free this:

C:\ProgramData\Microsoft\Windows Defender\Definition Updates{960E7296-B0DD-49C5-BE4F-9AA0EC444E37}\nisbase.vdm ...and the same path but to file  ..nisfull.vdm

< SNIP >

If anyone would simply read exactly what's displayed in front of them:

C:\ProgramData\Microsoft\Windows Defender\Definition Updates\

This is clearly in the program data files folder for the Microsoft Windows Defender - Definition Updates.

The files nisbase.vdm and nisfull.vdm are the base and complete definitions modules for the Network Inspection System (NIS) that's been part of the Microsoft security products since Microsoft Security Essentials 2.0.

So obviously the Avast deep scan is detecting the definitions update packages for Microsoft's NIS as malware, likely the signature fragments contained within these that identify specific network attacks, as if they were actually malware.

This is an inherent problem with any security product's full scan (e.g. deep scan) process, since these scans are always looking at files stored in a file system out of context, so these scans will quite often misidentify such items as malware.

This is also why I recommend against using such full or deep scanning unless malware has already been either detected or suspected on a system, since the high likelihood for false positive detections simply adds to confusion and typically does little to find malware not already detected by either the real-time or quick-scan components of the program, which specifically look for malware in the locations they are known to operate.

Rob

Answer 2

Hi,

Seems like the one that you have there is a virus scan result. This will not harm your device and you don't have to worry about this. Scan results are just a log file of your activity.

Let us know if you need further help.

Answer 3

Probably it´s false alarm as doing scans with both Avast and Defender at the same time could cause each one to detect the other...?