Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Anonymous
2020-06-16T21:00:07+00:00

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat.  As a result, many are now made aware of their presence.  And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,

and again. It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is to Block them,

then leave them in Protection History .

EDIT:  It has been found that malware other than PUPS, can require this same procedure.

           Some have discovered, that even Trojans exhibit this same characteristic, when remediated by

          Windows Defender in W10 v2004.

If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to

it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection

History record, and delete the file that is described. If you can't find or access the file, run the Microsoft

Safety Scanner. It uses the same definitions as Windows Defender, and should remediate  the file.

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download 

Then proceed to delete the Protection History info.

END EDIT.

Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over

and over again.  Even though, other scanners see no evidence of the malware on the PC.       It doesn't exist!

Until Microsoft sees fit to fix this problem,  you can prevent the repeating error indication, by deleting the

items that are described in Windows Defender Protection History. You can delete them by accessing their files,

that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.

In the "Service" folder, find and delete "Detection History". 

Note:  ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be

checked.  Find the "Hidden Items" check box under the "View Tab".

And, the first time that you access "Scans", you must select "continue", to obtain the permission.

Restart and try another scan.    Notifications for the current malware should stop.  

However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.  

Glen

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

188 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2020-09-24T16:10:59+00:00

    Sir, I did what all you said- Opened Command prompt and did all which you said and it really worked it said that it found some threats and repaired them(I haven't given a try to open "Scans" till this time) but I also thought at that time that; actually I had a game in my pc with the extension .exe so I was just giving a deep thought about my pc issues and suddenly then it clicked my mind that I don't think so that .exe file is good for pc and I Googled it, hopefully found it so I at the very moment deleted that game and then came back and tried to open "Scans" and I was able to to the same and a popup showed to "Continue" or "Cancel". Honestly Sir, I was totally stunned at that very moment, I was so happy.

    That moment was unexplainable. Furthermore, I did what all You said and finally deleted the "Detection History" folder then restarted my pc and tbh I was very hopeful and scared at that moment. The error was no longer there and I was so happy.

    Actually all this time I was so panicked just because this is my first personal pc and it's expensive and it's been just, I think 4-5 months since I bought it so I don't want a threat so early in my pc.

    Thank you very much, Mr. Glen!!

    I am really very grateful to you.

    It's all because of you!

    All this time you helped me so much!!

    It wouldn't be enough if I even thanked you a thousand times coz' I irritated you so much and maybe at some times I even frustrated you as of my circumstances.

    Once again, Thank you very much, Sir!

    And just a last question Sir (not sure if it is actually), is .exe a virus??

    And if it is then I want to ask that Sir, I deleted the .exe game I had in my pc so will it cause a threat now after deleting it or am I safe now??

    And the same last repeating request- "Please help??"

    Thank you, Sir!!

    Have a great day and a great year, actually a great life.

    Labeeb Khan.

    Was this answer helpful?

    0 comments
  2. Anonymous
    2020-09-24T06:27:33+00:00

    Sir, My account is an Administrator Account but then too I cannot open "Scans".

    Okay, I will try the second option that you said.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2020-09-23T07:52:42+00:00

    Hi Labeeb,

    After you expand Windows Defender, expand Scans, which is right after Quarantine.

    If you see a popup after expanding Scans, click on "Continue".

    Then expand History, which is just two steps after Scans. Ignore the "Scans" below

    History.

    After expanding History, find and expand Service. When you expand Service, you

    will see Detection History.     Delete that folder.

    Glen

    Was this answer helpful?

    0 comments
  4. Anonymous
    2020-09-23T07:09:25+00:00

    Thank you Sir!!

    I found the program data file then went to Microsoft then Windows Defender but I was not able to open "Scans", I was repeatedly clicking on it but nothing happened, no popups, nothing.

    What to do, Sir??

    Please help!!

    Thank you, Sir!!

    Was this answer helpful?

    0 comments
  5. Anonymous
    2020-09-23T04:30:15+00:00

    Hi Labeeb,

    Sorry for not making it clear. Just forget about examining Protection History. You

    really do not need to know the exact malware that is causing your problem.

    If you run a full scan with Microsoft Safety Scanner, it will remediate any malware that

    Defender is alerting you to. Since they both use the same definitions for defining malware.

    The Scanner removes the need for you to locate and delete the malware. The problem

    that is bothering you, is caused by Defender re-detecting the malware, that is present in

    its history file. That is the real problem. And the reason for deleting the Detection History.

    https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

    After a full scan, using the Microsoft Safety Scanner, then you need to follow the instructions

    for deleting Detection History, that are on page one of this thread. I will repeat the procedure

    here for clarity.

    1. Open File Explorer and click on the "View" tab.  Find "Hidden Items" and check its box.
    2. Navigate through File Explorer using this path.

        >OS (C:) >ProgramData >Microsoft >Windows Defender >Scans (Note: You may have

        to click on "Continue" on the popup, if it appears)  >History >Serviceand delete the folder

    Detection History.        Close File Explorer and Restart your PC.

    Defender should no longer alert you to the malware. It may be necessary to repeat this

    procedure, if/when, you contract anymore malware in the future.

    Any questions, don't hesitate to reply.

    Good luck,  Glen

    Was this answer helpful?

    0 comments