Trojan:Win32/Bluteal.B!rfn

Question

been getting this trojan message through windows 10 defender periodically today which gets quarantined by defender. malewarebytes, microsoft safety scanner and adwcleaner do not find anything, is Trojan:Win32/Bluteal.B!rfn a false positive by windows 10 defender.

Answer 1

microsoft says not malware in my opinion its a false positive, but im curious as what triggers it, i never open attachments in emails and very rarely download programs, i will let you know if i get any more info. thanks for your time it's very much appreciated

Answer 2

Click Start > Settings > Apps > Apps & features

Look through the list for any entries for suspicious software installed

Select it then click uninstall

Reset all your web browsers to their original factors state

In Microsoft Edge - Click Start > Settings > Apps > Apps & features > Microsoft Edge

Select it, click Advanced options > Reset

Reset Chrome settings to default - Google Chrome Help

https://support.google.com/chrome/answer/329621...

Refresh Firefox - reset add-ons and settings - Mozilla Support

https://support.mozilla.org/en-US/kb/refresh-fi...

Use Malwarebytes to scan and clean the computer.

https://www.malwarebytes.com/

Also use ESET Sysrescue offline scanner to scan and clean the computer, see instructions in the following article:

https://www.groovypost.com/howto/clean-virus-in...

Note: This is a non-Microsoft website. The page appears to be providing accurate, safe information. Watch out for ads on the site that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the site before you decide to download and install it.

Answer 3

Upload the potential virus to virustotal:

https://www.virustotal.com/#/home/upload

Defender should show you the file/folder which has been quarantined.

If it says it’s OK then it’s a false positive, if not then you may wish to skip to part two of this:

Try running these programs:

MBAM free: https://www.malwarebytes.com/mwb-download/

Eset online scanner: http://www.eset.com/us/online-scanner/

Adwcleaner: https://toolslib.net/downloads/viewdownload/1-a...

If these do not fully remove the virus/malware then it will be wise to register with a malware removal site to receive dedicated malware removal instructions, an expert will remain with you throughout the process until confirmation that your PC is 100% clean.

Malwarebytes virus/malware removal forum:

https://forums.malwarebytes.com/forum/7-windows...

Bleeping computer malware/virus removal forum:

https://www.bleepingcomputer.com/forums/forum22...

Disclaimer - This post contains reference to non-Microsoft websites and there may be ads on the page for products & services including products frequently classified as a PUP (Potentially Unwanted Product). Please thoroughly research any product / service advertised on the page before you decide to use them. Your discretion is very much advised.

Answer 4

thank you for replying so quick VirusTotal reports 67 virus vendors say its clean with 1 saying its unsafe. still dont know what caused this right enough.

Answer 5

It may be within an email or in a program recently downloaded.

I had Norton & it would block every program update saying it was a virus - this was due to the file being less than 5 days old, it was very annoying.

I’d say it’s a false positive. Upload the file to WD for analysis:

https://www.microsoft.com/en-us/wdsi/filesubmis...