Windows Defender, "Items Skipped During Scan"

The IBM Trusteer Rapport software has been around for over a decade and has had a varied history of negative comments by users, though it's sometimes been pushed by various banks around the world that have been having significant issues with fraud and malware capturing passwords.

We've mostly heard about it here relating to issues with stable operation of the web browser and interactions with the Microsoft security products, but it's been a while since I've seen any.  This decade old article by KrebsonSecurity, a well known reputable security researcher, gives a good explanation of how the product worked at the time, as well as his thoughts on it's purpose and operation.

A Closer Look at Rapport from Trusteer — Krebs on Security

In general, Trusteer monitors the browser by intercepting calls to the APIs that most malware also use in order to capture passwords or perform other attacks.  Since to an antimalware/antivirus program these actions could easily look like the malware that Trusteer is trying to protect against, it's relatively obvious why it's both occasionally detected by them, as well as can sometimes create undesired overhead.

Since that Bkav AV product comes from Vietnam, it's not surprising they might detect this as potential malware, since their customer base isn't likely to use this Trusteer software that's more commonly provided by banks in the Western world.

At the same time, it's worth reading through that Krebs on Security article, since the decision whether to continue using the Trusteer software that IBM acquired shortly after that article is probably more related to its potential misuse and unintended issues than this specific detection.

Along with this, the web browsers have changed drastically since that time to include protections like operating in a sandbox (Edge & Chrome), as well as other protections within the browser, Windows and Defender that perform the sort of monitoring or blocking of the very same attacks that Trusteer was designed to watch for.

In other words, it's a valid question whether Trusteer even has a purpose on a modern Windows 10 system, since the issues it was created to deal with have mostly been resolved or are at least better monitored by the built-in protections that Windows 10 provides.

Rob

I run a scan everyday.  Just got the error message today

I update and quick scan frequently. Today was the first time " WDA scan skipped an item due to exclusion or network scanning settings".

I proceeded to run a full scan with same message displayed. I have made no changes, done nothing to cause this message.  Just updates.

If the detections go away simply by uninstalling RapportMgmtService, it's another indication it isn't a real virus. A real one would be much harder to be rid of. Rob Koch offers a good explanation for why Bcav (& the other stray antivirus app) are confusing it with a real virus, namely it does the same things a virus might do (but not intending ill). Also, I believe Windows Defender & the many other protections Microsoft has put into Windows are sufficient protection these days. Especially if it is a processor hog -- uninstall it! Did you install that in the first place? Or did it come in from your online banker? My online banking works just fine with no such thing installed.

Definitely, it has nothing to do with that "items skipped" message. You'll still have that afterward when running a manual Defender scan. But I believe it is bogus, & Microsoft should fix it soon enough. The automatic Defender scan gives no such message, & neither does an Offline scan. Also I don't get it when running a selective scan of any particular folder, not even the OneDrive folder (right-click & select "Scan with Windows defender").