Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Anonymous
2020-06-16T21:00:07+00:00

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

188 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2020-08-05T14:35:27+00:00

    hey thanks a lot i've been searching whole day try other anti virus. didn't work only this. thankssss u save my life. i can sleep now and have a peace of mind :))

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  3. Anonymous
    2020-08-02T06:11:08+00:00

    hey man thanks for the solution. It really WORKED. After trying too many internet tutorial like Updating windows 10, running sfc scan and many more finally your method worked.

    Here's what i get know about this situation.

    1. The threat is no longer available at the file location because its already deleted.
    2. Windows defender has recorded the threat in history and popping it again and again.
    3. Simply just ignore the notification as the threat is no longer exist or remove it by following the steps below.

    Go to C:\Program Data\Microsoft\Windows Defender\Scans\History\Service and delete all the files reside in it.

    No matter what file you see the defender will automatically recreate the correct files and the PUA notification will be gone forever.

    I usually don't reply to comments but you really helped me, so i am replying back.

    Thanks man, you are a real champ.

    Was this answer helpful?

    10 people found this answer helpful.
    0 comments
  4. Anonymous
    2020-08-01T09:14:34+00:00

    I did this and had the exact same problem, and this really helped so much

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-08-01T09:13:12+00:00

    Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

    PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

    on the spot, to prevent them from causing any mischief.

    The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again, and again.

    It has been determined that this is caused by the presence of the PUP in Protection History.

    It appears that the default remediation that Windows Defender applies to PUPs is to Block them, then leave

    them in Protection History .

    Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the PUP over and

    over again.  Even though, other scanners see no evidence of the PUP on the PC.

    Until Microsoft sees fit to Quarantine the PUPs, you can prevent the repeating error indication, by deleting them.

    They are described in Windows Defender Protection History. You can delete them by accessing their files, that

    are located in C:\Program Data\Microsoft\Windows Defender\Scans\History\Service.

    Note:  Program Data is a hidden file. In order to access it, the "Hidden Files" option in "File Explorer" must be

    chrcked.  Find the "Hidden Files" check box under the "View Tab".

    In the "Service" folder, delete any file that references the PUPs (PUA).  They should be in "Detection History".

    If you can not see your PUP (PUA), just delete "Detection History".

    Restart and try another scan.    Notifications for the current PUPs should stop.  

    However, this program miscue will probably reoccur, when the next PUP is encountered.  

    Glen 

    Thank you, THANK YOU, for real

    I've deleted a pup exe file from downloads ( I haven't opened it at all) and it kept saying it was still there, even in the details. I looked for it in the task manager and even in the extra apps and uninstalls but it didn't exist, strangely it said that it was currently running and active but since I did what was above, it resolved the issue with a full system scan.

    I think its a bug for removing certain pups since it said it was a win32 install core pua. I haven't opened it like I said again. Perhaps its a problem with the file running from the security history, because once I've deleted the folders inside the detection history, it was resolved.

    Like I've said, thank you

    It was a hassle to deal with using malware bytes as I was all like "Strange, it doesn't exist, I've even made sure in the settings to check everywhere" but Windows security kept duplicating it and showing me that file extension to downloads file.

    I hope that bug can get fixed in later updates, even an "override" function would help so that it can sweep through the system for that file.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments