Trojan.Win32.Bazon.a: what the Kaspersky alert means and how to clear it
Trojan.Win32.Bazon.a is the name Kaspersky gives to a Windows program it flags by its behaviour, and it is not a program you can uninstall. Check the file first: in most reports it was a known game or installer, and a Safe Mode scan plus Microsoft Defender Offline settle the rest.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like a Kaspersky alert for PDM:Trojan.Win32.Bazon.a in the System Watcher component usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove Trojan.Win32.Bazon.a yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Trojan.Win32.Bazon.a: summary
| Type | A Kaspersky behaviour detection (PDM:) for a Windows trojan family; not a program name |
|---|---|
| Risk | Unknown: no payload is documented. Reports show known programs being flagged; treat as unconfirmed until the file is checked |
| Symptoms | The Kaspersky alert PDM:Trojan.Win32.Bazon.a, Component System Watcher, often with the program deleted or blocked; no other sign was reported in the cases we read |
| How to get rid of it | Check the file first; report a trusted program as a false positive. If untrusted: Safe Mode, full scan, Microsoft Defender Offline, sfc /scannow, System Restore |
| Our check (6 October 2026) | No PC test: we read Kaspersky's naming rules, its support pages and public threads; no sample was run |
| First seen | Reader reports from May 2020; our first guide 11 November 2020 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Detection | Shown by Kaspersky products. No Microsoft detection name is known for it: Microsoft names threats in its own Trojan:Win32/ scheme and none of the reports we read shows one |
|---|---|
| Not to be confused with | Trojan.Win32.Generic, HEUR: detections and UDS:DangerousObject.Multi.Generic, which are other labels |
| Name | Trojan.Win32.Bazon.a |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Kaspersky's naming rules and support pages, public threads from 2020 to 2026 and Microsoft Support pages. We ran no sample and tested no PC; the removal steps follow Microsoft and Kaspersky staff advice and were not tried on a live infection.
What Trojan.Win32.Bazon.a is, and what it is not
Trojan.Win32.Bazon.a is a name Kaspersky's security products give to something they caught by its behaviour, not a program you can look up and uninstall. In the reports we read it nearly always appears as PDM:Trojan.Win32.Bazon.a, which means the proactive defense module flagged a program while it ran or installed.
- 1
What Kaspersky's naming rules say
Kaspersky names every detection as [Prefix:]Behaviour.Platform.Name[.Variant]. The prefix PDM: marks objects found by the proactive defense module, and Kaspersky's rules say there is one platform for that module, Win32. Bazon is the family name and .a the first variant.
- 2
What the alerts show
The alerts we read give Type: Trojan, Threat level: High, Component: System Watcher and Reason: Behavior analysis. That is a verdict about what a process did, not a match against a known file, so the name does not tell you which program is behind it.
- 3
What we could not find
Kaspersky's Threats site has no family page for Bazon: on 6 October 2026 the address for Trojan.Win32.Bazon opens only the general Trojan class page. We found no write-up from Kaspersky or any other vendor that describes a payload for it.
- 4
What our 2020 guide got wrong
It treated the name as proof that an intruder runs in the background and called it a heuristic detection. Kaspersky separates the two: HEUR: is its heuristic analyzer and PDM: is its proactive defense module. Nearly every report we found is a known program, such as a game or an installer, being flagged, so the alert is a reason to check the file and not proof of infection.
- Shown by
- Kaspersky products (Kaspersky Plus and others); we found no report from another vendor
- Usual form
- PDM:Trojan.Win32.Bazon.a, Component: System Watcher, Reason: Behavior analysis
- Platform
- Windows (Win32 in Kaspersky's scheme)
- Is it a file?
- It names the process or installer that was running, for example eso64.exe or Hermes-Setup.exe in the reports below; the file is usually a program someone chose to run
- Not the same as
- Trojan.Win32.Generic, HEUR: detections, or UDS:DangerousObject.Multi.Generic, which are other labels with other causes
The label does not say what the program is. It says Kaspersky's behaviour monitor did not like what the process did, and from there the job is to find out whether the file is one you trust, which the next chapters help you do.
What Trojan.Win32.Bazon.a does on an infected PC
How to read the name, part by part
Here is the name split up by Kaspersky's own scheme.
| Part | What it means in Kaspersky's scheme | In this name |
|---|---|---|
| PDM: | The prefix names the part of the product that found the object. PDM: is the proactive defense module | Behaviour-based: the verdict comes from what the process did |
| Trojan | The behaviour: for trojans it follows the type of payload | A malicious program that does not copy itself |
| Win32 | The platform the code runs on | Windows |
| Bazon | The family name: detections that share origin, working principle or payload | We found no description of the family |
| a | The variant: a letter or number starting from .a | The first variant |
What we checked on 6 October 2026, and what we could not
There is no website to test and we did not run a sample. We read Kaspersky's naming rules and support pages, a Steam thread with 76 replies, a GitHub discussion, a GitHub issue and a Kaspersky forum thread, and ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The alert is a real product messageThe reports show Kaspersky's own event text (Malicious object detected, Component System Watcher), not a web page or a pop-up with a phone number.
- What the file isIt differs per report: a game executable, a game launcher, a build tool, an installer. No single program or family is named in any source we read.
- Real infection or false positiveIn every report we read the program was a known one and the poster or a reply called it a false positive, but only Kaspersky can confirm that for a given file. A few of those replies are opinions, not analysis.
- What it doesNot documented. We found no analysis of a payload for this detection.
- A quiet second scanDoes not clear a file. In the 2020 Steam thread a reader noted only Kaspersky flagged the file on VirusTotal. That fits a false positive, but one scan is one data point, and behaviour-based malware can look clean to other engines.
Check the file before you trust it or delete it Most reports are known programs, so a false alarm is likely, but we could not test your file. Treat it as unconfirmed until you know where the file came from and a second check agrees. This is our reading of reports, and it is not a test of your PC.
How readers met it from 2020 to 2026
Our guide dates from 11 November 2020. The entries below are reader reports from public forums and issue trackers.
22 May 2020
Terraria flagged on launch
A Steam player said Kaspersky blocked the game with PDM:Trojan.Win32.Bazon.a when launching it, and another said Terraria.exe was deleted. The thread reached 76 replies. One reader said the alert came 30 to 40 minutes after Kaspersky updated its database. A reply called it a false positive that can be added as an exception, and a comment said Kaspersky was the only engine on VirusTotal to flag the file.
11 November 2020
Our first guide
The 2020 guide described the name as proof of an intruder and sent readers to a paid scanner. This page replaces it.
22 August 2022
A build tool flagged on a developer's PC
A developer building a React app reported that Vite was detected as PDM:Trojan.Win32.Bazon.a by Kaspersky. They added an exception to continue. A second user wrote "today, me too" on 21 August 2025, so the report was still current three years later.
3 to 8 June 2024
Elder Scrolls Online client deleted
A player said Kaspersky Plus deleted eso64.exe and kept returning after a repair. A forum helper said PDM alerts have no Ignore option and that Kaspersky's Virus Lab has to analyse them, and asked the player to send a false-positive request. Two readers added the file to exclusions to play, and one reported a reply from Kaspersky Support on 8 June.
8 June 2026
An installer flagged on a new product
A user running Hermes-Setup.exe got the alert with Reason: Behavior analysis and a database release of 8 June 2026. The issue on GitHub was still open on 6 October 2026, and later reports on the same thread concern other files. One reviewer there warned against calling it a confirmed false positive without verification.
Programs it has been reported on
These are programs where the alert was reported, taken from public threads. A report is not a verdict: it shows who got the alert, not whether the file was clean.
| Program or file | What was reported | Source |
|---|---|---|
| Terraria (Terraria.exe) | Blocked on launch and deleted by some players, May 2020 | Steam discussion |
| Vite (a JavaScript build tool) | Detected during a build, August 2022; an exception was added | GitHub discussion |
| Elder Scrolls Online (eso64.exe) | Deleted, then returned after a game repair, June 2024 | Kaspersky Support Forum |
| Hermes-Setup.exe (an installer) | Detected while installing, June 2026 | GitHub issue |
| Game clients and launchers (for example lotroclient64.exe after Update 39.1.2, and a launcher for another online game) | Titles of forum threads and their excerpts say the detection was shown; we did not read the full threads | Forum search results |
| Hardware and audio installers (for example aquasuite-setup.exe, and a music-player installer whose thread is titled false positive) | The same: we read only the excerpts | Forum search results |
Why a behaviour detection fires on normal programs
A signature scan compares a file with a known sample. A behaviour monitor watches what a process does and can raise an alert on a program no one has ever seen as malicious.
| What you see | What is going on, from the reports | What to do |
|---|---|---|
| The alert comes right after a game or app update | The 2020 Terraria reader saw it 30 to 40 minutes after a Kaspersky database update, and the 2024 and 2026 reports followed new builds | Note when the program updated and when the databases did; put both in your report to Kaspersky |
| The file is deleted or moved to a backup copy | Terraria.exe and eso64.exe were deleted in the reports | Do not clear the backup or quarantine. Restore from it only after Kaspersky says the file is clean |
| There is no Ignore button | A Kaspersky forum helper said PDM alerts do not have an Ignore option, because Kaspersky's Virus Lab must analyse them | Send a false-positive request; do not hunt for a hidden switch |
| Repairing the program does not help | The ESO player repaired the game and got the same alert again | The cause is the verdict, not a damaged file |
| The program is signed and from the vendor | A Kaspersky forum thread about another PDM label shows a signed enterprise installer deleted | A signature lowers the odds but does not settle it: check the file as in the next chapter |
What Trojan.Win32.Bazon.a can steal or download
What a hidden trojan can cost you
No source we read documents a payload for this detection. The risks below are those of trojans in general, from the old guide, and they are possibilities, not findings about every Bazon alert.
- High
Remote control of the PC
A trojan can open a backdoor that gives an attacker access to your machine, which is the worst case the old guide named. Nobody has tied this to the Bazon detection.
- High
Stolen data
A trojan can be set to take data from the machine, such as logins and files. Nothing we read shows this for Bazon.
- Medium
A coin miner that wears the PC out
The old guide listed cryptocurrency mining among trojan activities. Expect heat, fan noise and a slow PC if one runs; again no report ties it to this detection.
- Medium
More malware
A trojan can launch processes, install files, start downloads and put other malicious programs on the PC.
- Medium
A deleted program that you wanted
This is the harm in the reports: Kaspersky removed Terraria.exe and eso64.exe, and a build tool and an installer stopped working. Real, but fixable once the file is cleared.
- Low
Nothing at all
A false positive does no harm to the PC. The danger is the case you cannot tell apart yet.
What you may notice, and what the reports show
The old guide listed slowness, crashes and odd background processes as signs of this trojan. None of the reports we read ties those to the detection.
| Sign | What we found |
|---|---|
| The alert itself | Reported in every thread; it names a program, not a general symptom of the PC |
| The program stops working or is deleted | Reported for Terraria.exe and eso64.exe: the antivirus removed the file |
| The same alert after a repair or reinstall | Reported by the ESO player in June 2024 |
| Slow PC, crashes, high CPU or odd processes | Not reported in any thread we read. Many things cause these; if you have them, scan, but do not blame this alert |
| Nothing | Several readers saw only the Kaspersky alert and no other change |
How to check the PC for Trojan.Win32.Bazon.a
How a real trojan gets onto a PC
No source tells us how any real Bazon sample would arrive. These are the usual routes for trojans, from the old guide, and the route in the reports that is the opposite: a program you installed on purpose.
- 1
A booby-trapped email
A message with an attachment or a link to a site that starts a download. The file can be a program, a document or a PDF, so open only attachments you expected from a sender you know.
- 2
A hacked or fake site
A page that a criminal has taken over, or a copy of one, can push a download. Users who trust a site and use proper software are not immune, because the attacker uses the site's good name.
- 3
Pirated and cracked software
Torrent sites, cracks and keygens are the classic way to get PUPs and trojans onto a PC. Of all the routes here, this is the one to avoid first.
- 4
Another malware
Trojans, worms and ransomware arrive by silent steps, and one infection can drop another, which is why a clean-up of one detection can leave a second one.
- 5
A normal program that behaves oddly
In the reports the file came from a game store, a vendor's installer or a developer tool the reader knew. That is how a false positive arrives: it is just the program you chose to run.
The first sign of a real infection is often only the antivirus alert, because the infection itself is silent. That is why an alert on a file you did not choose to run should be taken seriously.
Check the file before you delete or trust it
Write down exactly what the alert says before you click anything. Kaspersky support asks for the same details.
- 1
Copy the alert
Take a screenshot. Note the Name (with the PDM: prefix), Object name, Object path, MD5 if shown, Component, Reason, and the Databases release date.
- 2
Ask where the file came from
Did you start it yourself, from a source you trust, such as the maker's site or a store? A game that you launched or an installer you downloaded from its vendor is the typical false-positive case in the reports. A file that came in an email, from a crack or from a link you did not expect is not.
- 3
Look at its signature
Right-click the file, choose Properties and open Digital Signatures if the tab exists. A valid signature from the expected publisher lowers the odds of malware. It does not clear the file, as the signed installer in the Kaspersky forum shows.
- 4
Get its hash and look it up
Open Windows PowerShell and run
Get-FileHash -Algorithm SHA256 "C:\path\to\file.exe". Check the result on Kaspersky OpenTIP and VirusTotal. If the vendor publishes the hash, compare it. In the 2020 Steam thread a reader said only Kaspersky flagged the file on VirusTotal, which points to a false positive but is not proof. - 5
Look for a second antivirus
Open Settings > Apps > Installed apps and look for another security product with live protection. Two of them can set each other off.
- 6
Check what else changed
Press Ctrl + Shift + Esc, open Startup apps and note names you do not know. Open Installed apps, sort by Install date and look at what was added just before the first alert.
How to remove Trojan.Win32.Bazon.a
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like Trojan.Win32.Bazon.a add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Trojan.Win32.Bazon.a, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Trojan.Win32.Bazon.a that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Trojan.Win32.Bazon.a can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Could it be a false alarm?
Often, going by the reports. These are the signs that point each way.
| Points to a real infection | Points to a false positive |
|---|---|
| The file came from an email, a crack, a fake update or a link you did not expect | You started a known program or installer from its maker or a store |
| Several tools from different vendors flag the file | Only Kaspersky flags it, as in the 2020 Terraria thread |
| Other signs appeared: unknown startup items, new accounts, odd network use | The PC works normally and only the alert is odd |
| The alert returns after a clean reinstall of Windows | The alert started right after a program update or a Kaspersky database update |
| The file has no valid signature and no known publisher | The file has a valid signature from the expected publisher |
If you think it is false, send the case to Kaspersky: its support page says a blocked application may be a false detection and asks for the file in a password-protected archive.
If it is a program you trust: report it to Kaspersky
You cannot ignore a PDM alert, so the clean fix is a reanalysis by Kaspersky. These steps follow Kaspersky's support pages.
- 1
Update the databases and check the file
Update your Kaspersky databases, then check the file on OpenTIP. If you disagree with the result, click Submit to reanalyze on the results page and enter your email address.
- 2
Send a request to Customer Service
Use the Kaspersky Customer Service contact form for home products. Choose Request type: Malware and Request topic: False positive, give the product name and version, the Windows version and the database date, and attach the file in a password-protected archive with the password infected. Add a screenshot of the detection.
- 3
Add the PDM files if they ask
For a PDM detection Kaspersky lists the application trace file, System Watcher logs and the detected file and its extension. Customer Service guides you through collecting them.
- 4
Expect a delay, and keep the backup
In June 2024 a reader waited about two days for a human reply. A forum helper said such replies usually say the detection will disappear within 12 hours after the databases update, and to write back if it does not. Keep the quarantine or backup copy until then.
- 5
If you must run the program meanwhile
Players in the reports added the file to exclusions or to trusted applications. In older Kaspersky versions the path was Settings > Additional > Threats and Exclusions; we did not verify the current menu names. Use this only for a file you have checked as above, and remove the exclusion after the fix, because an exclusion also hides a real threat.
If it is not a program you trust: remove it from Windows 11 and Windows 10
Do the steps in order and stop when a scan from Safe Mode and a Microsoft Defender Offline scan are clean and the alert has not returned. We did not run these steps against a live infection. They follow Microsoft's pages and the advice in the Kaspersky forum threads.
- 1
Disconnect, then back up documents
Turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 2
Start in Safe Mode with Networking
Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says Safe Mode loads only the essential drivers and services.
- 3
Run a full scan
Start your security product by hand and run a Full scan. Then run a Full scan in Windows Security > Virus & threat protection > Scan options. A full scan is the best way to look for every piece of a trojan, but no scanner promises it finds all of them.
- 4
Run Microsoft Defender Offline
In Windows Security > Virus & threat protection > Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it restarts the PC and scans before Windows loads, which gives hidden malware a harder time. Review the result under Protection history.
- 5
Scan with a second tool from Kaspersky if you use it
Kaspersky's free Virus Removal Tool scans on demand and gives no live protection. Use it when Kaspersky's own product keeps flagging the file.
- 6
Uninstall what you did not choose
Open Settings > Apps > Installed apps, sort by Install date and uninstall programs you do not know, mostly remote access or support programs and anything added just before the alert. Disable unknown entries in Startup apps.
- 7
Repair damaged Windows files
If a scan found and removed something, open Command Prompt as administrator and run
sfc /scannow. Microsoft says it scans protected system files and replaces damaged ones. This is the built-in way to repair damage the old guide warned about. - 8
Try System Restore
If the alert began after a recent install, press Windows logo + R, type
rstrui.exeand choose a restore point from before it. Microsoft says System Restore reverts system files, registry settings and installed programs and leaves personal files alone. It will not help if no restore point exists. - 9
Last resort: reset Windows
Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore documents only, with no programs and no full system image.
Never download a removal program because a pop-up or a stranger tells you to. A real threat does not need a phone number or a payment page to fix. Removal also depends on how long the malware ran, which no source documents for this detection, so repeat a full scan after a week.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A Kaspersky alert for PDM:Trojan.Win32.Bazon.a in the System Watcher component in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
If it was real: what to do about your accounts
The scans deal with the PC. These steps deal with what a trojan could have seen.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in. Do this before you use banking on the infected PC.
- 2
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working.
- 3
Check your money
Look at card statements and any wallets for payments you did not make.
- 4
Look for remote access tools
Open Settings > Apps > Installed apps and uninstall remote access programs you did not install.
- 5
Scan again in a week
A clean scan today does not clear code that hides. Run another full scan and a Defender Offline scan a week later and keep the alert screenshot.
Keep trojans off your PC
The 2020 advice was to avoid shady emails. It still holds; here it is with current details.
Do
- Keep one security product with Real-time protection on. Microsoft Defender is built into Windows 11 and 10.
- Install Windows Update monthly, and update browsers and PDF readers.
- Open attachments only when you expected them and the sender's address matches. Delete the rest.
- Download programs from their makers' sites or the Microsoft Store.
- Keep a backup of documents on a disk you unplug (File History or OneDrive), so a deleted or damaged file is never a disaster.
- Use a password manager and two-step sign-in so one stolen password does not open every account.
Don't
- Do not run cracks, keygens or fake update prompts.
- Do not run two antivirus programs with live protection at once.
- Do not turn off protection to get an installer to run before you have checked the file.
- Do not call a number shown in an alert.
Questions about Trojan.Win32.Bazon.a
What is Trojan.Win32.Bazon.a?
It is a Kaspersky detection name, not a program you can uninstall. In the reports we read it appears as PDM:Trojan.Win32.Bazon.a, which means Kaspersky's proactive defense module flagged a process by its behaviour.
The alert shows Type: Trojan, Threat level: High and Reason: Behavior analysis, and it names the file that was running, for example a game executable or an installer.
Kaspersky's Threats site has no page for the Bazon family, and we found no analysis of a payload. Treat the alert as a prompt to check the file, which the chapters above explain, and not as proof of infection.
Is Trojan.Win32.Bazon.a a virus or a false positive?
In the reports we read it was a known program every time, such as Terraria, the Vite build tool, Elder Scrolls Online or an installer, and posters or replies called it a false positive. Only Kaspersky can confirm it for a given file, and a reply on a June 2026 GitHub issue warned against calling it confirmed without checks.
Find out where the file came from, check its signature and hash, look it up on OpenTIP and VirusTotal, and send it to Kaspersky for reanalysis. If the file came from a source you did not choose, treat it as real and follow the removal steps.
Why does Kaspersky flag a game or an installer I trust?
Because PDM judges behaviour, not a known file. A game client or installer may write files, change firewall rules or start processes in ways that match a malicious pattern. A Terraria player in 2020 saw Kaspersky mention two firewall rules changed, and the alert came 30 to 40 minutes after a database update.
The cause was not confirmed by Kaspersky in any thread we read. Send the file to Kaspersky as a false positive. A signed installer being flagged in a related forum thread shows that a signature does not stop it.
Can I ignore or whitelist PDM:Trojan.Win32.Bazon.a?
You cannot ignore it: a Kaspersky forum helper said PDM alerts have no Ignore option, because Kaspersky's Virus Lab has to analyse them. Players in the reports added the file to exclusions or trusted applications to keep playing, and older Kaspersky versions place this under Settings, Additional, Threats and Exclusions.
Do that only for a file you have verified, and remove it after Kaspersky fixes the detection, as an exclusion would also hide a real threat. Do not turn off protection altogether to run an installer.
How do I remove Trojan.Win32.Bazon.a from Windows 11 or 10?
First check whether the file is one you trust. If it is not, disconnect and back up documents, start in Safe Mode with Networking, run a full scan with your security product and Microsoft Defender Offline, and uninstall any programs you did not choose.
Run sfc /scannow to repair system files, and try System Restore if the alert began after a recent install. Reset Windows only as a last resort.
We did not test these steps on a live infection; they follow Microsoft's pages and Kaspersky forum advice. If the file is a program you trust, report a false positive to Kaspersky instead.
How do I report it as a false positive to Kaspersky?
Update your databases and check the file on OpenTIP, then click Submit to reanalyze if you disagree. If the problem remains, open a request with Kaspersky Customer Service:
- Request type Malware
- Request topic False positive
- with the product version
- Windows version
- database date
- a screenshot
- the file in an archive protected by the password infected
For PDM detections Kaspersky also asks for the trace file and System Watcher logs. A forum helper said replies usually say the detection will disappear within 12 hours, and a 2024 reader waited about two days for the first reply.
Does Windows Defender detect Trojan.Win32.Bazon.a?
We found no Microsoft Defender name for it. Microsoft names threats in its own Trojan:Win32/ scheme, and none of the reports we read shows a Defender alert for the same file. That fits a Kaspersky-only behaviour verdict, but it does not clear a file: engines use different signals.
Run a full scan and a Microsoft Defender Offline scan as a second opinion. If both are clean and the file comes from its vendor, a false positive is likely, but ask Kaspersky to confirm.
Does Trojan.Win32.Bazon.a steal my passwords?
No source we read says so. We found no analysis of a payload for this detection, so any claim about password theft, backdoors or mining is a possibility for trojans in general, not a finding. If the file came from an email, a crack or a fake update and you cannot clear it, assume it could be real:
- change passwords from another device
- sign out of every session
- turn on two-step sign-in
- check your card statements
If it was a known program from its maker, a false positive is likely and no passwords were taken.
Why did the detection disappear after a day?
Probably because Kaspersky updated its databases. In June 2024 a forum helper said Kaspersky's replies to false-positive reports usually say the detection will disappear within 12 hours and ask to write back if it does not.
If the alert vanished without you sending a report, a database update fixed the verdict, but we could not confirm that for your case. Keep the screenshot, and if it returns after a program update, send it again.
Will Fortect remove Trojan.Win32.Bazon.a?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Trojan.Win32.Bazon.a, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Kaspersky IT Encyclopedia: Rules for naming (read October 6, 2026)
- Kaspersky Threats: Trojan.Win32.Bazon (no family page; the address opens the Trojan class page) (read October 6, 2026)
- Steam Community, Terraria: Trojan Bazon Detected by Kaspersky (May 2020) (read October 6, 2026)
- GitHub, vitejs/vite: vite.js as a PDM:Trojan.Win32.Bazon.a detected by Kaspersky (August 2022) (read October 6, 2026)
- Kaspersky Support Forum: Kaspersky Plus is accusing Elder Scrolls Online to be a trojan (June 2024) (read October 6, 2026)
- GitHub, NousResearch/hermes-agent: Kaspersky: virus false positive (June 2026) (read October 6, 2026)
- Kaspersky Support Forum: Get PDM:Trojan.Win32.Generic report while installing application (January 2024; a signed installer, another PDM label) (read October 6, 2026)
- Kaspersky Support: Files to send to Kaspersky technical support in case of PDM malware detection (read October 6, 2026)
- Kaspersky Support: What to do if a Kaspersky application blocks my website or application (read October 6, 2026)
- Kaspersky Support: False detections by Kaspersky products. What to do? (read October 6, 2026)
- Kaspersky Support: How to exclude files, applications and URLs from scanning in Kaspersky Internet Security 2018 (read October 6, 2026)
- Search results for PDM:Trojan.Win32.Bazon.a (excerpts only: lotroclient64.exe, aquasuite-setup.exe, a Roon thread) (no longer online) (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)
- Microsoft Support: Use the System File Checker tool to repair missing or corrupted system files (read October 6, 2026)
- Kaspersky: Virus Removal Tool (free on-demand scanner) (read October 6, 2026)