Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Worked for me too.

This may work for some...

https://www.reddit.com/r/antivirus/comments/ndrjw0/windows_defender_states_it_took_action_against/?utm_source=share&utm_medium=web2x&context=3

Thank you for link, I've been facing this problem for a long time.Seriously, thank you so much.

Hi kaanozerr,

There is little doubt that the problem that you are experiencing is an anomaly with Defender.

Since no other scanner can detect it, it must not be real.

So far as Microsoft fixing it, you shouldn't bet on that. The Detection History anomaly has been

around since before June 2020.  Since it is not really affecting your PC, you should just ignore it.

Glen

Hi Andrew,

I believe that your assessment, that it is a false positive, is accurate.

See Rob's answer in this thread, regarding what you are experiencing with the Safety Scanner.

https://answers.microsoft.com/en-us/protect/forum/all/what-is-wrong-with-the-microsoft-safety-scanner/27c95df9-7d49-4d02-b734-bcb16495cfc3

As far as Quick scan saying both, "no current threat" and "1 threat found", that appears to be

related to the misnomer that the Scanner shows.  Especially since there is nothing in Protection

History.

If you can run Defender Offline, without detecting the error, I think you can be assured that it

is just an anomaly, that may be fixed with subsequent updates.

Good luck,  Glen

First of all,Hello,Glen,I have this problem.As you said,I enter files,but there is no Detection History file in the service file.Windows Defender says that when I first scan quickly,it finds 1 threat and blocks it,and then when I scan again,it can't find a threat.And when I look at the protection history,there's no data.Do you think it's a defender's mistake and they'll fix it with an update?By the way,I did a full scan with malwarebytes,kaspersky,and microsoft safety scanner,and they didn't find anything.

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen 

Thank you very much for your kind advice. I did it and problems solved.