Trojan viknok Activity 3

Hi folks,

I have a users running SEP 12.1 who is getting a pop up message he is infected with Trojan viknok Activity 3.  The message is SID:27601 Trojan.vidnok.activity 3 detected.

He ran a full scan, as well as a Malware Bytes Antimalware scan and it found nothing.  Also downloaded and ran the SymHelp tool and it found nothing.  Is he infected, or are we seeing some kind of false positive.

Any advice on how to proceed?