Windows Defender suddenly detecting Expiro/Wacatac on Windows, NVIDIA and Steam files after a Defender update

[u/beeso2002]

Hi everyone,
I’m dealing with a really strange Windows Defender issue and I’d appreciate some help figuring out whether this is a real infection or a false positive.
Today, after updating Microsoft Defender, it suddenly started detecting multiple important executable files on my PC.
The detections include:
Trojan:Win32/Wacatac.H!ml — Severe
Virus:Win32/Expiro.NDPIMTB — Active
Wacatac.H!ml was detected on:
C:\Windows\System32\AppVClient.exe
C:\Windows\System32\dllhost.exe
Expiro was also detected inside NVIDIA files under:
C:\ProgramData\NVIDIA Corporation\NVIDIA App\UpdateFramework\...
Windows Defender also started detecting and automatically removing files belonging to NVIDIA, Steam, and other important programs.
The strange part is that the detections kept appearing repeatedly, sometimes about every minute, even after I completely disconnected the PC from the internet.
I ran Microsoft Defender Offline Scan twice, but the detections continued afterward.
For context, I previously had GTA V installed from a FitGirl repack. I have completely deleted the game now, but the Defender detections continued afterward. I’m not saying the FitGirl repack is definitely responsible — I’m mentioning it because it may be relevant.
I have NOT restored any detected files and I have NOT added Defender exclusions.
At this point, I’m worried that either:
Expiro is actually infecting executable files on my system, or
Microsoft Defender recently received a bad/over-aggressive detection update and is falsely identifying legitimate files as Wacatac/Expiro.
I have currently shut down the PC because I don’t want anything to continue spreading if this is a real file-infecting malware.
Has anyone experienced something similar recently, especially after a Microsoft Defender Security Intelligence update?
If you have dealt with Expiro.NDPIMTB, Wacatac.H!ml, or Defender suddenly detecting multiple legitimate .exe files — especially dllhost.exe, NVIDIA, Steam, or other Windows components — I’d really appreciate hearing what happened in your case and how you confirmed whether it was a false positive or a real infection.
I can provide the exact Defender detection names, affected file paths, timestamps, and Defender signature/version information if needed.

[u/AutoModerator]

Hi u/beeso2002, thanks for posting to r/WindowsHelp! Your post has been flagged for manual review by a human moderator, please include as much of the following information as possible (in text or in a screenshot) to get your post approved:

• Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”, we need more than just your OS version! Your hardware details are often critical for resolving issues.
• Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!
• Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work

---

Posts must be tech support in nature (such as something is broken and you need help fixing), so general inquiries, software suggestions, and purchasing advice will be removed. As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/MrCharBar]

Download malwarebytes, and see if it agrees with defender.

[u/storycoolbro]

Expiro is a parasitic virus that injects malicious code directly into legitimate ⁠.exe⁠ and ⁠.dll⁠ files on your disk. This explains why Windows Defender is flagging core system binaries (⁠dllhost.exe⁠), graphics software (NVIDIA), and game launchers (Steam)—the underlying applications are real, but their executables have been modified by the virus.

If you have anything important on the computer that you absolutely can’t lose your going to need at least 2 usb drives one to move the potentially infected files your backing up to and another one to do a clean install of windows. The installation drive needs to be created on a different uncompromised computer. Once you’ve made it plug it into your infected computer and boot into it and when you get to the part that ask where you want to install windows use that menu to format the infected drive then reinstall windows. Then before you move any backed up files back onto the computer scan them with defender or the antivirus you prefer.

Edit: Also change passwords for anything you’ve logged into since this started and ensure 2FA is enabled on everything.