Windows Defender, "Items Skipped During Scan"

Hi, 

I have the same problem since wednesday last week. 

In reddit and in tenforums someone reported the same problem.

https://www.reddit.com/r/techsupport/comments/fgalvt/windows_defender_skipping_files_yet_no_exclusions/

https://www.tenforums.com/antivirus-firewalls-system-security/152000-new-defender-platform-4-18-2003-4-0-items-skipped-during-scan-alert-2.html

I hope Windows fix this soon, it is easy to thing a malware problem, the 3 last Windows Defender Platform updates (4.18.2003.4-0, 4.18.2003.5-0, 4.18.2003.6-0) are not listed in Windows Catalog Update (https://www.catalog.update.microsoft.com/home.aspx)

The last one working fine is 4.18.2001.10. 

I hope that someone can help us.

Regards

Hello Rob.  I would like to apologize to you if you felt that my post was in criticism of your post, as that was not really my intent.  But my intent definitely was to express my frustration with Microsoft for seemingly 'dropping the ball' a bit more than my liking when it comes to pushing out updates that cause apprehension about the safety of sensitive data.  Luckily for me, this latest fiasco only affected my 32-bit Windows Pro box.  It did not affect my 64-bit Windows Pro system nor my Windows 10 tablet with Home Edition.  Nonetheless, it is still very frustrating since I regularly use both the 32 and 64 bit systems throughout the day.  Anyway, rest assured that I appreciate the time and effort you sacrificed to respond back, I just regret that my wording might have caused you to think I was taking issue with your advice when, in fact, all I meant to do was emphasize my disgust with the wasted hours and reasonable apprehension that Microsoft's faulty updates cause when dealing with data that is sacrosanct.  Best wishes to you for a good Spring.... and rest of the year too!

Yes Da Hokester, that was excessive, but it does more to prove the primary point that most here seem to be concerned with, that this notification has nothing to do with a malware infection.

Again, what that message is indicating is simply that some item(s) have been skipped during manual scanning, either due to an exclusion (which nearly no one seems to have present) or network protection settings.

This final mention of network protection settings seems the most likely culprit to me, since the existence of any sort of network drive such as a NAS or simply any external drive mapping might be a portion of the cause.  The other portion as you infer is almost certainly due to something in the March Cumulative Windows update, since both the timing and confirmation of this by most here and in that Reddit thread referenced by SleeplessPoster support this belief.

The key thing to understand here though, is that this notification message is simply that, a notification of items skipped during the scan and noting more.  In truth, this occurs regularly for certain open files or others that for some reason Defender can not access.  However, most of these are well known issues that Defender and all 3rd-party scanners are aware of, so they're designed to ignore them and only display this message for those there's not a known explanation for.

What's happening since the March Cumulative Windows update is that a few systems appear to be triggering this notification that weren't in the past, likely due to some relatively minor change contained in that code relating to either exclusions or network drives.

In fact, that just reminded me that I noticed a separate Update for Windows Defender Antimalware Platform when updating a Microsoft Surface Go tablet running Windows 10 S mode this week.  If that same update is installed for all Windows 10 systems, which seems likely, then it's possible the issue was contained in that smaller update.  It might be a good idea for one of those affected by this issue to try uninstalling that Antimalware Platform update to see if this can be confirmed.

Again, I'm not telling anyone what to do, only possible options to find either the source of the update portion or whatever else on the system such as a network drive might be contributing to the notification.

For most consumers this is a non-issue, since even if it occurs for everyone performing a manual scan, that's a tiny percentage of users today.  In fact, I haven't personally run a manual scan on any of my own systems for a few months, since that's something that Microsoft itself has only recommended if a recent infection is either known to have occurred or suspected.  That information came directly from the lead Development Project Manager (e.g. lead developer) for both Microsoft Security Essentials and it's predecessor the Windows OneCare security suite.

People are making way too much of a minor notification anomaly that in all likelihood will just turn out to be an insignificant software bug or interaction.  Before doing something radical like downloading a 3rd-party security program to replace Defender, I'd simply try downloading the tiny (text) Eicar AV test file instead.  If that's flagged as the "severe" threat that's supposed to display from Defender, then real-time protection is working as expected.

Intended use ° EICAR - European Expert Group for IT-Security

Remember to turn off SmartScreen in your Microsoft browser before downloading, since otherwise that will intercept the file download before Windows Defender has a chance to see it, though in truth the 2 are integrated tightly so it's likely that SmartScreen is simply handing off the scanning process for Defender to do.

Rob