AMSI detected harmful content Reason: TR/W64.agent

Odysseus
Odysseus Posts: 1 New Member
edited January 15 in Device Protection

Hi,

My F-secure software continually reports (every 2 minutes or so) the following message in the Windows notification area:

"AMSI detected harmful content Reason: TR/W64.agent"

Pointing to application Powershell.exe"

How can I find out what is causing this notification? I logged a ticket with customer support and shared the logs. Sadly, even after 4 days I haven't heard a clear resolution to solve the problem.

Please help me.

.

Edit: PII removed

Like Awesome

Answers

  • TVC15
    TVC15 Posts: 212 Rising Star
    edited January 14

    Hi @Odysseus

    Unless something on the English forum were to change for this year 2026, you probably won't get a Mod/employee reviewing your log files and answering your post.

    I would get a hold of chat or phone support and let them know your situation and see if they could escalate your case to help resolve this sooner.

    https://www.f-secure.com/us-en/support

    1Like Awesome
  • Ukko
    Ukko Posts: 4,008 Superuser

    My F-secure software continually reports (every 2 minutes or so) the following message in the Windows notification area:

    Have you tried running a Full Scan with F-Secure (Running a virus scan manually)?

    Besides this, since this happens so often, it might be worth checking if there are any suspicious scheduled tasks in the system (Task Scheduler). This could be something definitely suspicious.

    Also if there is some specific activity known to you when the notification appears and why so often (such as, the use of a certain program or some specific actions), does this happen without using it or without using the system in this way?

    Because AMSI (Using AMSI integration to identify script-based attacks) mainly works with built-in system mechanisms, I think F-Secure's logs in Windows Event Viewer may contain a bit more information about each detection. Maybe a certain command (for PowerShell) or some other background stuff. This way, it can be more clearly indicated whether it is a threat or something less dangerous (like if clearly safe commands by clearly safe trigger).

    To use Event Viewer: select Start on the Windows menu, type Event Viewer, and press Enter to open the Event Viewer; then by expanding 'Applications and Services Logs' you can see something like 'F-Secure Device Protection' with further category 'FSecureSpApi' - check latest events there; by choosing 'more information' - there can be some additional things;

    Example of possible things to note is: AMSI detected harmful content Reason: LNK/Dldr.Agent.VPLZ discussion. It was a bit of 'advanced' by using obscure methods to cover its intention and so on. But still easily spotted by looking at.

    Still.. I think better to work with official Support channels/agents - since they do really able to remotely help and check situation better (as suggested in replies above).

    Thanks!

    1Like Awesome

Categories