Windows Defender Identifies The SAME PUP As A Threat Repeatedly

What effect does this have in the Registry

Dbarselow

Hi Dbarselow,

Deleting the Detection History folder does not directly change the Registry.

Anymore than any other file deletion.

Windows can detect that the folder has been deleted, and rebuilds it when it is next needed.

This question has never been asked before. Have you experienced a problem from deleting

the History folder?

Others have deleted the entire "Service" folder, without ill effects.

Glen

Glen,

Seeing this discussion brings to mind a thought I had recently regarding this long-running apparent issue with Defender false detections, which I'd also initially tended to blame on Microsoft.

However, the length of time involved along with the apparent inconsistency as to which specific malware detections trigger it are what brought another possibility to mind.

That thought was that though I'd seen this issue myself shortly after it was first noticed and this thread created, I've not seen it again, so the combination of transient issues required to cause it must be relatively unique. That led to a belief that this isn't a simple flaw in the Microsoft scanner, but more likely the more typical combination failure where 2 or more applications, most often security apps, are interacting to cause the failures.

The immediate question then became, what other application might be involved, since I haven't personally installed an active 3rd-party AV app since roughly 2005 when the first beta versions of the Microsoft scanners became available.

Or so I thought anyway, since it then occurred to me that I'd unintentionally been doing just that a few times a year, though for various reasons I'd never considered this a potential issue.

The potential offending 3rd-party app? Malwarebytes Anti-Malware, one of the very sanity check tools we recommend in order to confirm that these or other spurious detections aren't truly malware.

The issue here is that in more recent releases, the "free" version of Malwarebytes AM is exactly the same as the trial of the Premium version, which now automatically enables itself for the 14-day trial period unless you specifically turn it off.

So what if the minimal AV portions of Malwarebytes, along with other overlapping protections for items such as PUPs, which Microsoft themselves only more recently enabled for automated detection, might somehow be interacting during these short trial periods?

Now we have a possible explanation for apparently random, but relatively regular events that also seem to come in batches, similar to the update cycles for a security app release. In fact, I personally just received one of these updates on the only Windows 10 system where I have Malwarebytes installed, while I can say with certainty I've never seen this spurious detection issue on any other Windows 10 or 8.1 system I own.

Unless I'm deluding myself I think I may have found the elusive combination of apps and mostly transient update and trial period situations, which must necessarily coincide with at least one current (or possibly recent) Defender detection incident in order to trigger the initial false positive.

Which app is specifically at fault isn't truly important, since in all such cases it's always both, as the conflict they're creating is something that neither developer has anticipated within their own app, while the particular combination of events should never occur.

So asking whether those affected by future incidents had either Malwarebytes Anti-Malware trial or possibly another 3rd-party security app active in parallel with Defender's real-time protection when the initial looping false positive issue began, might be something that should be asked in future threads.

Rob

Hi Rob,

Thanks for the input. Of course the "compatible" MalwareBytes has been involved in many

problems associated with Defender. The "Always Register" case, for one.

I can't say whether any of the Defender false positives were caused by conflict between

Defender and MalwareBytes or not. But that is an interesting hypothesis. In the beginning

it only involved PUAs. And I believed that was caused by the remediation for them, that was

just to block them. And a fault in Defender allowed it to "detect" the blocked item in Protection

History. Microsoft has had more than ample time to correct that situation though.

Then it appeared, that the same "repeat" detection was occurring with other malware, as well.

That which was not just blocked. However, removing these items from the History would

also eliminate the alerts. I suppose that these problems might be brought on by conflict.

But probably not one that I will have the chance to investigate. There are so many "advisors"

now days, who have discovered that Repair Upgrade will fix almost anything, and get them

an "Answered", that it is difficult to to have a chance to "diagnose" any problem. Even though

their approach can be compared to driving a thumb tack with a sledge hammer, it resonates

with many who post in the Community. I have reduced my participation, somewhat.

EDIT: Rob, my response to a post by Kaanozeer, is what you responded to in this thread.

      I had some difficulty in finding this, or I would have included it in my response above.

     It turns out that Kaanozeer located a solution to his Defender problem, which did involve

     a conflicting application. *Intel Driver & Support Assistant / Intel Computing Improvement*

     *Program*.  See this link... (it will not insert)  **HTTPS://www.reddit.com/r/antivirus/comments/**

ndrjw0/Windows_Defender_states_it_took_action_against/?utm_source=share&utm_medium=

web2x&context=3

    ****        This may be fuel to accommodate your hypothesis.                  ****          

Best of luck to you, Glen

So deleting detection history won't release the virus from quarantine? Cos I'm scared as I'm just facing the same issue and the threat turns out to be severe.