Trojan:Win64/Lazy.PGLI!MTB and TrojanDownloader:Win64/Penguish.PO!MTB keep being detected by Windows

[blackostritch2781]

View attachment private-file.pngView attachment private-file.pngAre these false positives or is my computer unsafe? If so, what steps should I take to stop this from happening?

 

[Bot]

Are these false positives or is my computer unsafe? If so, what steps should I take to stop this from happening?

Hi blackostritch2781 — I would not assume these are false positives. The screenshots show two severe detections associated with running process instances about ten minutes apart. That could be one infection chain rather than two unrelated infections, but it is enough to treat the computer as potentially compromised until checked properly.

process: pid:..., ProcessStart:... is not a file path. It identifies the process instance Defender observed at that time; the PID may later be reused, so do not hunt down or delete whatever currently has that number. “Quarantined” means Defender acted on the detected item, not that it has certified the rest of Windows as clean. Microsoft likewise notes that a detected Lazy infection can leave remnants or system changes after automatic removal (Microsoft Security Intelligence).

What to do now​

1. Do not restore, allow or exclude either detection.
2. Check the timestamps in Protection History. Old cards can remain visible, but a genuinely new timestamp after every reboot or program launch means something is being restarted or restored.
3. Update Windows and Defender’s security intelligence, then run:

• Microsoft Defender Offline scan: Windows Security → Virus & threat protection → Scan options.
• After Windows restarts, run a Full scan.

4. Think back to what was downloaded, installed or executed immediately before 8:39 PM—especially unofficial installers, cracks, email attachments or commands copied from a website. Delete the known original installer/archive, but do not start deleting scheduled tasks, registry entries or system files by guesswork.
5. If fresh alerts continue, disconnect the PC from the network and avoid using it for email, banking or other sensitive accounts.

You can obtain better attribution from Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational. Look for events around 8:39 and 8:49 PM and note the Process Name, Path, detection source and origin. Redact your Windows username before posting paths publicly.

Because these detections are recurring and process-based, I recommend opening a case in Windows Malware Removal Help & Support and following its preparation guide. The logs can reveal the executable and any persistence mechanism; do not use an FRST fix script written for somebody else’s machine.

If you knowingly executed a suspicious installer or command, protect important accounts from another trusted device: change critical passwords, revoke existing sessions and enable MFA. That is a precaution—the screenshots alone do not establish credential theft. A false-positive assessment should wait until the actual executable path and origin are identified.

Sources

• Trojan:Win64/Lazy.PGLI!MTB
• malwaretips.com
• **Windows Malware Removal Help & Support

 

[Bot]

Hi blackostritch2781, checking back on this one.

Your two screenshots fit a pattern we have since cleaned on several machines here:

• TrojanDownloader:Win64/Penguish.PO!MTB at 8:39 PM: a downloader fetching the next stage.
• Trojan:Win64/Lazy.PGLI!MTB ten minutes later, at 8:49 PM: the stage it fetched.

In the cases we've seen, this campaign hides in a new folder under C:\ProgramData that contains a legitimately signed program (EaseUS, Tenorshare, PassMark and others). It keeps itself running through scheduled tasks. That is why Defender keeps "quarantining" it while it comes back. See this thread for a recent example.

If you are still getting these detections, or haven't checked since, the logs will show exactly what is installed on your PC, and then I can give you a fix written for your machine.

Farbar Recovery Scan Tool (FRST)​

1. Download FRST64 and save it to your Desktop.
2. Right-click it, select Run as administrator, then click Yes on the disclaimer.
3. Make sure Addition.txt is ticked, then press Scan.
4. Two logs appear next to FRST64: FRST.txt and Addition.txt.

In your next reply, please include:

• FRST.txt and Addition.txt, as attachments
• whether Windows Security → Protection History shows any Lazy.PGLI or Penguish detections after 13-10-2026, and their times
• what you downloaded or ran shortly before 8:39 PM on 13-10 (a game, crack, "free" tool, installer, or a command copied from a website), if you remember

Please don't delete scheduled tasks or folders by hand in the meantime. The logs are more useful while everything is still in place.