Trojan:Win64/Lazy.PGLI!MTB and TrojanDownloader:Win64/Penguish.PO!MTB keep being detected by Windows

[blackostritch2781]

Are these false positives or is my computer unsafe? If so, what steps should I take to stop this from happening?

 

[Bot]

Are these false positives or is my computer unsafe? If so, what steps should I take to stop this from happening?

Hi blackostritch2781 — I would not assume these are false positives. The screenshots show two severe detections associated with running process instances about ten minutes apart. That could be one infection chain rather than two unrelated infections, but it is enough to treat the computer as potentially compromised until checked properly.

process: pid:..., ProcessStart:... is not a file path. It identifies the process instance Defender observed at that time; the PID may later be reused, so do not hunt down or delete whatever currently has that number. “Quarantined” means Defender acted on the detected item, not that it has certified the rest of Windows as clean. Microsoft likewise notes that a detected Lazy infection can leave remnants or system changes after automatic removal (Microsoft Security Intelligence).

What to do now​

1. Do not restore, allow or exclude either detection.
2. Check the timestamps in Protection History. Old cards can remain visible, but a genuinely new timestamp after every reboot or program launch means something is being restarted or restored.
3. Update Windows and Defender’s security intelligence, then run:

• Microsoft Defender Offline scan: Windows Security → Virus & threat protection → Scan options.
• After Windows restarts, run a Full scan.

4. Think back to what was downloaded, installed or executed immediately before 8:39 PM—especially unofficial installers, cracks, email attachments or commands copied from a website. Delete the known original installer/archive, but do not start deleting scheduled tasks, registry entries or system files by guesswork.
5. If fresh alerts continue, disconnect the PC from the network and avoid using it for email, banking or other sensitive accounts.

You can obtain better attribution from Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational. Look for events around 8:39 and 8:49 PM and note the Process Name, Path, detection source and origin. Redact your Windows username before posting paths publicly.

Because these detections are recurring and process-based, I recommend opening a case in Windows Malware Removal Help & Support and following its preparation guide. The logs can reveal the executable and any persistence mechanism; do not use an FRST fix script written for somebody else’s machine.

If you knowingly executed a suspicious installer or command, protect important accounts from another trusted device: change critical passwords, revoke existing sessions and enable MFA. That is a precaution—the screenshots alone do not establish credential theft. A false-positive assessment should wait until the actual executable path and origin are identified.

Sources

• Trojan:Win64/Lazy.PGLI!MTB
• malwaretips.com
• **Windows Malware Removal Help & Support