Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Hi Pedro,

After re-examining the article in Microsoft's DOCS, regarding exclusions, I discovered

that exclusions do not function for "On Demand Scans"

"The exclusions only apply to always-on real-time protection and monitoring. They don't apply to scheduled or on-demand scans."   Quoted from DOCS.     (I don't understand the logic)!

That being the case, in order to eliminate the repeated notifications from the PUP, it may be necessary to delete its entry from the "History", manually. Really not desirable, as it will require

a repeat of that action for subsequent PUPs.     Unless...

Only if the "Exclusion" for the "History Log" is applied when the next PUP is detected, in Real

Time, will the exclusion do any good.    We have to wait and see.   Seems doubtful.

Meanwhile, you should be able to eliminate this current notification by deleting its "History".

Navigate through Explorer as follows.

**C:\Program Data\Microsoft\Windows Defender\Scans**(you may have to click "Continue"

to proceed past Scans) \History\Service.  Open each of the folders in "Service" to find

any reference to your PUP.  Delete that one. I don't have a PUP entry, so I cannot define it any closer.

Please let me know how this works out.    Glen

PS;

An OP posted this screenshot. He is having your same problem.

Do you see this in Scan Options when you Scan and get the repeat PUP notification?

   ![](https://learn-attachment.microsoft.com/api/attachments/17615710-4fbd-45df-96d5-0389edc93134?platform=QnA

If you do, have you ever tried to select "Quarantine" instead of "Remove". 

Perhaps if it is Quarantined, Windows Defender will no longer consider it.

Assuming "Remove" just isn't doing the job!!

Please give this a try and let me know if it helped.   Thanks,  Glen

This step fixed it for me perfectly. Thank you for taking the time to type out all of these instructions.

Hello. I have a pua and windows defender is detecting it. I spoke with someone on the microsoft team and they said to download a free trial for malwarebytes. The free trial has just expired but using malwarebytes i quarantined the 3 puas and removed them from the computer. My free trial expired today and i knew i quarantined and removed the puas but for some reason windows defender still alarms me about it.

Perfect solution. Thanks. This was getting to be frustrating. 'Nuff said.

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\Program Data\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  Program Data is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen 

Thank You .  I ran the scan twice  but the MSERT did not remove the file.  Since it has been quarantined does that mean it is basically harmless,  if I do not click on it or try to open it? Thanks again.