Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Anonymous
2020-06-16T21:00:07+00:00

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

188 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2020-12-17T17:44:25+00:00

    Hello Glen,

    I have come upon your thread as it seems the PUP I am encountering is one that someone else encountered earlier this year. However, I have been unable to resolve my problem after reading through this entire thread and attempting the solutions provided. Details here below:

    1. Download Microsoft Safety Scanner
    2. Run safety scanner in Safe mode
    3. Safety scanner encounters no viruses
    4. Restart computer and delete Detection History folder
    5. Restart computer and check windows defender

    The item still appears as shown in the screenshot above and it has become quite annoying to see continually popping up. Any further recommendations to try? I saw something you mentioned about a "container" location but was not able to really find a better explanation of what that involved. Any assistance would be greatly appreciated.

    Thank you!

    Was this answer helpful?

    0 comments
  2. Anonymous
    2020-12-17T22:50:54+00:00

    Hi Matt,

    SAntivirus is a horse of a different color! You need to full scan your PC with MalwareBytes,

    while you are booted into Safe Mode.  https://support.microsoft.com/en-us/windows/start-your-pc-in-safe-mode-in-windows-10-92c27cff-db89-8644-1ce4-b3e5e56fe234

    https://malwaretips.com/blogs/remove-santivirus-protection-lite/

    You can verify that you have eliminated it by examining C:\Program Files(86)\Digital

    Communications\SAntavirus\SAntivirusEngine.Dll.     It should be gone.

    If the notification for "PUA:Win32/Presenoker" is still in place in Protection History,

    go through the procedure for deleting Detection History again.

    Good luck,  Glen

    Was this answer helpful?

    0 comments
  3. Anonymous
    2020-12-18T00:39:13+00:00

    Hi Glen, I went into safemode, downloaded malwarebytes, ran the program, it found 33 threats, quarantined them and restarted. Now when I go to windows defender it says "Malware bytes turned on" and there is no option for windows defender to do a scan. I looked in the file location and the file SAntivirusEngine.dll is still there, but thhe malware bytes software did find a bunch of things that it fixed related to SAntivirus it seems. I ran another scan not in safe mode and the computer came back clean. I saw another commenter said malware bytes fixed their problem but after the free trial the issue came back.

    How will I know the issue is resolved/ will I need malware bytes permanently to solve the issue?

    Thanks!

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  4. Anonymous
    2020-12-19T00:16:17+00:00

    Hi Matt,

    No, you do not need to keep MalwareBytes. However, it is a very good program to

    have around for "on demand" scans. Just turn off all of its "Real-Time" functions. And

    in "Settings" under "Security" >Windows Security Center, turn off "Always register

    MalwareBytes in the Windows Security Center."

    After a restart, Defender should be enabled again. Please reply if it is not.

    Somebody was apparently experiencing difficulties, trying to remove Santivirus

    in normal mode, since they saw it come back.

    If the SantivirusEngine.Dll is still in place, delete it. Use Safe Mode if necessary.

    IF Defender does not re-enable after the changes to MalwareBytes, display Defender's

    "Security at a Glance" screen, by clicking on Defender's Icon on the Taskbar.

    The screen should contain 7 options. 5 of which should be checked green. For any that

    are checked otherwise, try to satisfy the message that they present.

    If you only see 6 options, or the screen is blank, please respond with that info.

    In case that the services that are essential for Defender to function, were corrupted

    in the removal of Santivirus, check in the "Services App" to ensure that these three Services

    have the correct status.

    1. Security Center  Should be running and set for Automatic (Delayed) start.

    1. Microsoft Defender Antivirus Service  Running and set for Automatic start.
    2. Windows Security Service  Running and set for Manual start.

    Please reply if any are not correct.

    Glen

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Anonymous
    2020-12-20T16:15:58+00:00

    Glen,

    Thanks for the help here. To give you an update. I performed the malware bytes changes you suggested to reenable windows defender. As soon as I did that, the alert came back, because the file was still there. I wanted to delete it, but the file was within a folder that appeared to be an entire SAntivirus program, so I was concerned that just deleting the one file would not fully get rid of the virus.

    What I did was I googled the file folder structure "Digital Communications\SAntivirus\SAntivirusEngine.dll" and I found another webpage from the malwaretips website you had provided earlier. The page was: 

    https://malwaretips.com/blogs/remove-segurazo-antivirus/

    The site identifies the item I had as Segurazo Antivirus. Apparently it is a malware pretending to be an antivirus software. I never realized because the program never actually ran on my computer to show the "antivirus program". Not sure what I downloaded that it tagged along for a ride on, but the website recommended an additional program to download called HitmanPro to help eliminate it all together.

    I followed the guide and performed the steps (minus the ADW cleaner step because it seems like that program is no longer offered by malwarebytes).

    The entire "Digital Communications" folder has now been erased from my computer and windows defender is no longer showing any issues.

    I greatly appreciate your help and I have just one last question for you. Malwarebytes and HitmanPro appear to be valuable pieces of software to have permanently to supplement windows defender, but do you have any software you recommend over these two? I am considering purchasing at least one other supplemental program to help keep me a bit more protected.

    Thanks again!

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments