Windows search serachprotocolhost.exe opening files with virus/trojans

I had received a file with was suspected malicious, but was tested online and was passed by 41 different virus engines as

"No Threats found",  The file was a word document XP447949.doc which contained macro's that were suspected as Malicious.  The file was NOT opened with word as it warned about suspect macro's.

However much to my surprise our Antivirus software Blocked An attempt to execute code out of the blue the following day, The file was the XP447949.doc and the offending program was windows search!

This Means that any potential Virus/Trojan/Malware that has been downloaded but not run could be installed when the indexing service does its rounds!  Surely this cant be right...

Hopefully someone at Microsoft can look into how this can be made more Secure.

November 18th, 2014 8:16am

Anti-Virus software has an engine which detect malwares based on their behaviors and when you open the file it might behave in a way that is accidently detect as malware. The best way is to contact your Anti-Virus manufacturer's support and report this issue and submit this sample and they could try reproduce it and check whether it is actual virus or false positive.
Free Windows Admin Tool Kit Click here and download it now
November 18th, 2014 4:11pm

It could be false positive detection by your Anti-Virus, I suggest contact support of your Anti-Virus vender and submit sample of this file and explain the issue to them.
November 18th, 2014 4:39pm

The Trojan found was reported by the antivirus as 'LooksLike.Macro.Downloader.a (v)'

The Antivirus did not find problems when it scanned the file.  (Neither did 40 other products)

The active protection part found the file when windows search attempted to access the file, this concerns me somewhat that the search indexer is activating hidden malware.

If there was no active protection what would have happened?

Free Windows Admin Tool Kit Click here and download it now
November 19th, 2014 4:47am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics