This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify
PUPS as a threat. As a result, many are now made aware of their presence. And they are "remediated",
on the spot, to prevent them from causing any mischief.
The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,
and again. It has been determined that this is caused by the presence of the PUP in Protection History.
It appears that the default remediation that Windows Defender applies to PUPs is to Block them,
then leave them in Protection History .
EDIT: It has been found that malware other than PUPS, can require this same procedure.
Some have discovered, that even Trojans exhibit this same characteristic, when remediated by
Windows Defender in W10 v2004.
If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to
it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection
History record, and delete the file that is described. If you can't find or access the file, run the Microsoft
Safety Scanner. It uses the same definitions as Windows Defender, and should remediate the file.
Then proceed to delete the Protection History info.
END EDIT.
Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over
and over again. Even though, other scanners see no evidence of the malware on the PC. It doesn't exist!
Until Microsoft sees fit to fix this problem, you can prevent the repeating error indication, by deleting the
items that are described in Windows Defender Protection History. You can delete them by accessing their files,
that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.
In the "Service" folder, find and delete "Detection History".
Note: ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be
checked. Find the "Hidden Items" check box under the "View Tab".
And, the first time that you access "Scans", you must select "continue", to obtain the permission.
Restart and try another scan. Notifications for the current malware should stop.
However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.
Glen
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Sir, what is "container file"?.
I cannot see any file named container file in the Protection History.
And, I cannot see where's the Detection History option is?
I am really Sorry to disturb you Sir or if I am irritating you.
But please help me resolve this issue.
Thank you, Sir!
Mr. Glen, I am really sorry that I wasn't able to get help from your solution. I request you to please help me with the same problem.
I was not able to access the Protection history record, so, I downloaded Microsoft Security Scanner and scanned my pc. There was no malware or spyware or such programs which could harm the pc were found. It was totally fine. But again that popup of the of the same comes after all scans it is again showing ransomware protection.
It's showing the windows security icon with a symbol of error on it.
And please, if anyone knows the answer to my query then please help me!!
Thank you!
Hi Labeeb,
Your malware has probably already been remediated. Therefore, the Scanner couldn't
detect it. To verify that....
Find the malware "notification" in Protection History, and in the location described in
its "container file", delete the infected file, if it is still present. It probably is not.
Then proceed to delete "Detection History".
If you were unable to access the "Service" folder, to delete the "Detection History", it is
probably because ProgramData is a hidden file.
In order for you to be able access that file, you must first go to File Explorer and select
the "View" tab. Under the View tab find the option for "Hidden Items", and check its box.
This will allow you to see ProgramData and permit you to reach the "Service" folder.
Note: When you access "Scans" for the first time, it will be necessary to click "Continue"
on the popup, in order to gain permission to continue.
When you are able to access the folder "Service", open it and find "Detection History".
Delete that folder, and the notification of your malware in "Protection History", should
be cleared. Defender should no longer alert you to that malware.
Still have questions, please reply.
Good luck, Glen
Mr. Glen, I am really sorry that I wasn't able to get help from your solution. I request you to please help me with the same problem.
I was not able to access the Protection history record, so, I downloaded Microsoft Security Scanner and scanned my pc. There was no malware or spyware or such programs which could harm the pc were found. It was totally fine. But again that popup of the of the same comes after all scans it is again showing ransomware protection.
It's showing the windows security icon with a symbol of error on it.
And please, if anyone knows the answer to my query then please help me!!
Thank you!
Thanks a lot!!!!!
Glen,
I believe my issues were solved with an update to the antivirus software as Defender is no longer detecting the Trojan.
I did however 'check for updates' and then proceed to delete the protection history folder as I believe Defender was still detecting it in that particular folder even after the update. After deleting, it no longer detects the trojan. Went ahead and ran Safety Scanner in safe mode just in case and found nothing as well (even though it did not detect it during a prior scan). Thanks for the help. Hopefully that is the end of that. I will update if anything changes.
Regards,
Brian
