This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify
PUPS as a threat. As a result, many are now made aware of their presence. And they are "remediated",
on the spot, to prevent them from causing any mischief.
The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again,
and again. It has been determined that this is caused by the presence of the PUP in Protection History.
It appears that the default remediation that Windows Defender applies to PUPs is to Block them,
then leave them in Protection History .
EDIT: It has been found that malware other than PUPS, can require this same procedure.
Some have discovered, that even Trojans exhibit this same characteristic, when remediated by
Windows Defender in W10 v2004.
If you have any malware, remediated by Windows Defender, that alerts repeatedly, this procedure applies to
it as well. In order to cleanup the malware completely, find the file in the "container file" in the Protection
History record, and delete the file that is described. If you can't find or access the file, run the Microsoft
Safety Scanner. It uses the same definitions as Windows Defender, and should remediate the file.
Then proceed to delete the Protection History info.
END EDIT.
Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the malware over
and over again. Even though, other scanners see no evidence of the malware on the PC. It doesn't exist!
Until Microsoft sees fit to fix this problem, you can prevent the repeating error indication, by deleting the
items that are described in Windows Defender Protection History. You can delete them by accessing their files,
that are located in C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service.
In the "Service" folder, find and delete "Detection History".
Note: ProgramData is a hidden file. In order to access it, the "Hidden Items" option in "File Explorer" must be
checked. Find the "Hidden Items" check box under the "View Tab".
And, the first time that you access "Scans", you must select "continue", to obtain the permission.
Restart and try another scan. Notifications for the current malware should stop.
However, this program miscue will probably reoccur, when the next PUP / Malware is encountered.
Glen
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
Hi Toby095,
Please explain further, regarding your problem in deleting Detection History.
ProgramData is a hidden file, and you must check the box for "hidden items" in
File Explorer under the "View" tab, before you can see it.
The first time that you attempt to expand "Scans", you must click "continue" on
the popup that is presented.
If these fail to solve your problem, please reply.
Glen
im having trouble deleting the Detection.log
Hi Yunus,
I am unable to read your screenshots of Protection History, so I don't gather much from them.
But I have seen your participation in other threads, that do have screenshots that I can read.
Have you examined **C:\user**(*username)*AppData\Local\Temp\IOC70DB.tmp. From one
of the threads, I got the impression, that was the location the "Container File" described.
You could try deleting this file, then see if Defender continued to alert. (After deleting history).
Since no other Security program detects the item that Defender finds, it would appear to
be a false positive. Maybe Defender is identifying a component already in Protection History,
that it considers to be your problem. One would think that you would have eliminated that
possibility, by deleting all that you did already. But maybe not! It may be stored elsewhere.
Using Windows PowerShell (Admin) you could purge all of the history, after a one day delay.
Open PowerShell Admin, and type this Cmdlet.
Set-MpPreference -ScanPurgeItemsAfterDelay 1 <enter>
Exit <enter>
This will empty all of history, including Quarantined items, after one full day.
After your test, you should re-run the Cmdlet using 1E (30 days)
For what is worth, if you did not see it in the other threads that you visited, An OP declared
that they solved this problem, by removing a USB drive. One that they always left plugged in.
Tests on the USB, showed no problems.
Other OPs declared that this problem began for them, when their free subscription for
MalwareBytes ran out!!!
Hopefully, you can solve your problem by some other means, but one OP declared that if
malware had really attacked your UEFI, you would have to replace your machine!!!
I can only wish you, Good luck Glen
Hi Matheo D,
You are right! It was complicated, because my first attempt at correcting this problem.
involved using the Windows Defender "Exclusion" feature. When I discovered that it
would not work for this situation, I just edited around the process. I should have removed
it instead. Subsequent to your post, I have done just that, and I believe you will find it
easier to follow now.
Exclusion would have been the better fix, since subsequent PUPs would not have failed.
However, exclusion just doesn't function in this case.
Good luck, Glen
complicated
