Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Anonymous
2020-06-16T21:00:07+00:00

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

188 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2020-09-22T19:37:27+00:00

    Mr. Glen, I am really sorry that I wasn't able to get help from your solution. I request you to please help me with the same problem.

    I was not able to access the Protection history record, so, I downloaded Microsoft Security Scanner and scanned my pc. There was no malware or spyware or such programs which could harm the pc were found. It was totally fine. But again that popup of the of the same comes after all scans it is again showing ransomware protection.

    It's showing the windows security icon with a symbol of error on it.

    And please, if anyone knows the answer to my query then please help me!!

    Thank you!

    Hi Labeeb,

    Your malware has probably already been remediated. Therefore, the Scanner couldn't

    detect it.  To verify that....

    Find the malware "notification" in Protection History, and in the location described in

    its "container file", delete the infected file, if it is still present. It probably is not.

    Then proceed to delete "Detection History".

    If you were unable to access the "Service" folder, to delete the "Detection History", it is

    probably because ProgramData is a hidden file.

    In order for you to be able access that file, you must first go to File Explorer and select

    the "View" tab. Under the View tab find the option for "Hidden Items", and check its box.

    This will allow you to see ProgramData and permit you to reach the "Service" folder.

    Note: When you access "Scans" for the first time, it will be necessary to click "Continue"

    on the popup, in order to gain permission to continue.

    When you are able to access the folder "Service", open it and find "Detection History".

    Delete that folder, and the notification of your malware in "Protection History", should

    be cleared.         Defender should no longer alert you to that malware.

    Still have questions, please reply.

    Good luck,  Glen

    Was this answer helpful?

    0 comments
  2. Anonymous
    2020-09-23T03:08:51+00:00

    Sir, what is "container file"?. 

    I cannot see any file named container file in the Protection History.

    And, I cannot see where's the Detection History option is?

    I am really Sorry to disturb you Sir or if I am irritating you.

    But please help me resolve this issue.

    Thank you, Sir!

    Was this answer helpful?

    0 comments
  3. Anonymous
    2020-09-23T04:30:15+00:00

    Hi Labeeb,

    Sorry for not making it clear. Just forget about examining Protection History. You

    really do not need to know the exact malware that is causing your problem.

    If you run a full scan with Microsoft Safety Scanner, it will remediate any malware that

    Defender is alerting you to. Since they both use the same definitions for defining malware.

    The Scanner removes the need for you to locate and delete the malware. The problem

    that is bothering you, is caused by Defender re-detecting the malware, that is present in

    its history file. That is the real problem. And the reason for deleting the Detection History.

    https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

    After a full scan, using the Microsoft Safety Scanner, then you need to follow the instructions

    for deleting Detection History, that are on page one of this thread. I will repeat the procedure

    here for clarity.

    1. Open File Explorer and click on the "View" tab.  Find "Hidden Items" and check its box.
    2. Navigate through File Explorer using this path.

        >OS (C:) >ProgramData >Microsoft >Windows Defender >Scans (Note: You may have

        to click on "Continue" on the popup, if it appears)  >History >Serviceand delete the folder

    Detection History.        Close File Explorer and Restart your PC.

    Defender should no longer alert you to the malware. It may be necessary to repeat this

    procedure, if/when, you contract anymore malware in the future.

    Any questions, don't hesitate to reply.

    Good luck,  Glen

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-09-23T07:09:25+00:00

    Thank you Sir!!

    I found the program data file then went to Microsoft then Windows Defender but I was not able to open "Scans", I was repeatedly clicking on it but nothing happened, no popups, nothing.

    What to do, Sir??

    Please help!!

    Thank you, Sir!!

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-09-23T07:52:42+00:00

    Hi Labeeb,

    After you expand Windows Defender, expand Scans, which is right after Quarantine.

    If you see a popup after expanding Scans, click on "Continue".

    Then expand History, which is just two steps after Scans. Ignore the "Scans" below

    History.

    After expanding History, find and expand Service. When you expand Service, you

    will see Detection History.     Delete that folder.

    Glen

    Was this answer helpful?

    0 comments