Defender blocked a threat (elevated risk) - How do I find out which program?

rogerrabbit said:

I don't really understand your last sentence and why you put a link to my profile.

Click to expand...

Hi, thanks for replying. The link to your profile is a Tag. If you place @ in front of a username, it tags the user and shows up in the bell icon (Älerts).
If you type @ then start typing a username @roge a list of usernames will show (if more than one) In short, we tag to get a members attention. Quoting will also do this. As will a notification if a new post is made to a thread that you are "Watching



My comment was in relation to system backups. We encourage this. If you had a system image, you could return to a safe state prior to your infection.
You can use a program like Macrium Reflect or Hasleo Backup Free (my fav)

To be clearer...


A System Image is a full, exact snapshot of your entire Windows installation — the OS, settings, installed programs, and all selected partitions. Tools like Hasleo Backup Suite create these sector‑level images so you can restore the system to the exact state it was in when the image was made.

System Image vs Standard Backup


In short:
System image = complete system restore.
Standard backup = files only.



If you don't have a system image to resort to, I would encourage you to reinstall. (But that's just me)

rogerrabbit said:

<SubjectUserSid>S-1-5-21-3795828713-1622907658-1058423388-1000</SubjectUserSid>

Click to expand...

Malware can impersonate your token, steal your token, or run under your session, this only means the action was performed using your security context.. So there is still doubt. = Clean install.

0x52e4a

Click to expand...

If malware was running inside your session (e.g., via a scheduled task, injected process, or elevated payload), it will show your logon ID

9492

Click to expand...

If you look up PID 9492 in the corresponding time window, you should be able to identify exactly what executable cleared the log.

Event 1102 is one of the classic “cover your tracks” events.

I did some digging...

No surprise of course, attackers and malware clear the Security log to hide:

privilege escalation, credential theft, LSASS access, persistence installation, certificate store tampering, lateral movement attempts.

And you already have:

HackTool:Win64/Mimikatz.A detection
Trojan:Win32/Cerdigent.A!dha installing rogue root certificates
... now the Security log cleared under your SID?

This is not a normal combination. This is not a false positive pattern. This is not typical of benign tools.

This is the exact sequence seen when malware: Gains elevated privileges, Performs credential or certificate manipulation, Clears the Security log to hide the evidence.

There is so much more, but seriously, everything I've read lays doubt in the surety of a clean system. = Clean install.

Given the combination of...

Mimikatz detection
Trojan installing root certificates
Security log cleared
Action performed under your SID
Unknown process PID 9492 clearing logs

In my opinion: This is not normal Windows behavior. This is not a benign tool. This is not a harmless false positive.
This is the pattern of a real compromise attempt or a malicious tool bundled inside something they ran.

After a clean install, consider looking into System Images. This would all be over in 10 minutes if you had one.



Long thread with much detail >
I'm not to versed on Macrium, there may be better internal links for it.

And @kelper started a thread.. But I think it was made prior to Hasleo's take-off into "Top-Tier"" software

Thank you @antspants, @echo2446 and @Try3 for the very clear explanations.

As I said I regularly create images with the old Win 7 program in the control paneel which still works fine according to my experience. And I also do weekly backups with Hasleo (and daily incrementals). I recently switched to Hasleo from Macrium.
But these backups all were made after May 3, 2026, date at which the very nice vbs script from Try3 already showed two threats.

So I began to do a clean install (after removing the external drives). I hadn’t done it since long time. It installed and worked fine at the beginning (I downloaded the iso filefor Windows 11 26200.8655 and put it on an USB stick prepared with Rufus 4.15).

Rant:
But when installing my programs, Defender began to really annoy with its « folder acces control » notifications (ransomware protection). So I disabled the folder access control completely. I didn’t remember that I had done that before. Defenderis really more and more complicated to manage and I feel Microsoft should stop to put always new Defender modules in place.
Rant finished

But this was not all. Then one of my a programs required dotnet 3.5. And it was not possible to install it. There was apparently an irrecoverable installation error; I don’t know whether the error was due to my downloaded iso file or to Rufus.

So I abandoned the clean install, and tried to recover the Windows image of June, 18, 2026. But there was again an error message: the Win PE was corrupt. Fortunately I still have a recovery CD (and a CD drive) which repaired the WIN PE and I could finally recover my Windows 11 version of June 18, 2026. As suggested, I run Kapersky Virus Removal Tool on all my disks (to be sure that the threat did not exist already before June, 18), which didn’t find anytyhing.

Then I remembered that I had recently switched my phone - PC connection from USB to wifi (because the USB connection only worked very sporadicly, not to say never) and thought that this scan could have been the root cause of the issue. I use MyPhone Explorer to synchronise my agenda and my contacts (I think it’s the best existing program to synchronise without Google), and this program required me to scana QR code to establish the connection. (The connection can be set to be automatically interrupted after 5 minutes, when there is no activity, which is a very nice feature, because we are talking about a wifi connection). Ineeded to do the scan again because I had switched from USB to wifi after June 18 and thus run Kapersky again, because I have heard that QR codes could easily introduce viruses. But it didn’t find anything.

So I really hope everything is fine now.

Thanks again to all of you !

rogerrabbit said:

As I said I regularly create images with the old Win 7 program in the control paneel which still works fine according to my experience.

Click to expand...

I've never had an issue with Backup & Restore (Win 7) but I moved on to supported 3rd party, Hasleo. Its free version is top notch, but I bought a couple of Lifetime licenses as support.

rogerrabbit said:

So I began to do a clean install (after removing the external drives). I hadn’t done it since long time. It installed and worked fine at the beginning (I downloaded the iso filefor Windows 11 26200.8655 and put it on an USB stick prepared with Rufus 4.15).

Click to expand...

Perfect

rogerrabbit said:

folder acces control

Click to expand...

rogerrabbit said:

dotnet 3.5. And it was not possible to install it.

Click to expand...

Install .NET Framework 3.5 via Windows Features

• Press Win + R, type optionalfeatures, press Enter.
• In the Windows Features window, find and tick .NET Framework 3.5 (includes .NET 2.0 and 3.0).
• Click OK.
• If asked, choose Download files from Windows Update.
• Wait for installation to complete.
• Restart Windows if prompted.
• After reboot, you'll probably have an update in Windows Update.

I have an appointment at the Hospital soon and it's annoying making informative posts on a phone

antspants said:

1. Install .NET Framework 3.5 via Windows Features


2. I have an appointment at the Hospital soon and it's annoying making informative posts on a phone

Click to expand...

ad 1. Did not work, i Tried it out. There was really a problem with the installer in my Windows installation
ad 2. Good luck !

Roger

rogerrabbit said:

ad 1. Did not work, i Tried it out. There was really a problem with the installer in my Windows installation
ad 2. Good luck !

Roger

Click to expand...

Coincidentally, I just installed 3.5 this week due to a game GTAV
I did have problems, it was stubborn. I was persistent with the online loader, the online complete standalone, and the process I described.
I actually truly believe the difficulty is caused by a server issue at MS

Even with the standalone, it still has to download from the net.

rogerrabbit said:

Unfortunately the output only shows two threats from 03/05/2026 at not the one of this morning 02/07/2026 at 08:31 (see attached).

View attachment 175780

Click to expand...

I think these are almost certainly false-positive flags from the bad Defender update. You can check the Windows Defender events 1116–1117 at the time of removal; you should see (this is from my system, with the same problem on the same date):


Note the "Security intelligence Version: AV: 1.449.425.0, AS: 1.449.425.0, NIS: 1.449.425.0," which is known to be bad. See this discussion on MalwareTips, containing links to other social media reporting the problem.

You may have cleared the virus on the image restore, but I would do at least quick checks on:

Windows Security > Virus & threat Protection​

And check to make sure that there is no unfamiliar exclusion.

And the latest Windows Defender event ID 1151:​

Check that the states are all enabled, and the versions are up-to-date.

echo2446 said:

Note the "Security intelligence Version: AV: 1.449.425.0, AS: 1.449.425.0, NIS: 1.449.425.0," which is known to be bad.

Click to expand...

It was not a widespread “everything is malware” situation — only apps that extract .node modules at runtime. Correct?

antspants said:

It was not a widespread “everything is malware” situation — only apps that extract .node modules at runtime. Correct?

Click to expand...

As far as I know, it was bad for false-flagging two root Digicert certificates. Subsequent updates fixed the "removal" (if it actually did) silently.