Windows 10: Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Guus20B · Mar 5, 2025

Hello! Stupidly I ran a fake captcha resulting in LummaStealer being installed. Microsoft Defender however says it has blocked the threat. Saying it is now quarantined and will be deleted automatically. Does this mean I just got really lucky? Or do I need to take additional steps to make sure everything is safe? As of writing this, I am running a full scan by Microsoft Defender.Thank you!

:)

Anne Ros · Mar 5, 2025

Windows Defender is blocking too much saying it viruses

Hi Sam,

Based on the screenshot that you've provided, Controlled Folder Access is turned on, blocking most apps that you're using. We suggest that you turn it off to allow blocked apps in Windows Defender. Follow the steps below:

Select Start > Settings.

Choose Update & security > Windows Defender.

Select Open Windows Defender Security Center.

Select Virus & threat protection, and then choose Virus & threat protection settings.

Under Controlled folder access, turn it on or off.

Once done, try accessing the apps and see if you can now access them.

Should you need further assistance, feel free to post back.

Brink · Mar 5, 2025

Microsoft: Additional steps to help keep personal information secure

We’re committed to helping our users keep their personal information secure and private. A key part of our work is identifying and preventing unauthorized access to your Microsoft Account (including Outlook.com email and OneDrive) by anyone other than you.

We’re taking an additional step today. We will now notify you if we believe your account has been targeted or compromised by an individual or group working on behalf of a nation state.

We already notify users if we believe their accounts have been targeted or compromised by a third party, and we provide guidance on measures users can take to keep their accounts secure. We’re taking this additional step of specifically letting you know if we have evidence that the attacker may be “state-sponsored” because it is likely that the attack could be more sophisticated or more sustained than attacks from cybercriminals and others. These notifications do not mean that Microsoft’s own systems have in any way been compromised.

If you receive one of these notifications it doesn’t necessarily mean that your account has been compromised, but it does mean we have evidence your account has been targeted, and it’s very important you take additional measures to keep your account secure. You should also make sure your computer and other devices don’t not have viruses or malware installed, and that all your software is up to date.

The evidence we collect in any active investigation may be sensitive, so we do not plan on providing detailed or specific information about the attackers or their methods. But when the evidence reasonably suggests the attacker is “state sponsored,” we will say so.

There are some important steps that everyone should take to help keep their Microsoft Account and their online personal information secure including:

Turn on two-step verification: This makes it harder for hackers to access your account even if they guess your password because if they try to sign in on a device Microsoft doesn’t recognize, we’ll ask for an extra security code (which you can get from a special app on your phone, sent to a different email address or via SMS text message).

Use a strong password and change it often: Make sure your password contains a mix of letters, numbers and symbols, isn’t a complete word and is different than the password you use on other sites. Be sure to change your password often.

Watch for suspicious activity on your account: The “Recent Activity” page on your Microsoft Account shows recent sign-ins and changes to your account, and allows you to let Microsoft know if you were not the person making these changes.

Be careful of suspicious emails and websites: Don’t open emails from unfamiliar senders or email attachments that you don’t recognize. Be careful when downloading apps or files from the Internet, and make sure you know the source.

Keep your computer software, including your Web browser, up to date and run an up-to-date anti-virus program: For Windows PCs, you should turn on Windows Update to ensure your PC and Microsoft software stay up to date. You should install a reputable anti-virus/ anti-malware software. Both Windows 8.1 and Windows 10 already include free anti-malware software called Windows Defender.

You can read more about the steps you can take to better protect your personal data and make any necessary changes on the Microsoft Account Security Page.
Click to expand...

Source: Additional steps to help keep your personal information secure - Microsoft on the Issues

zebal · Mar 5, 2025

Windows Defender/Security - no option to "Allow" potential threats?

If you want to control what does defender do to threats you can do it trough GPO in the following location: Computer configuration\Administrative templates\Windows components\Microsoft defender antivirus\Threats Here configure option: Specify threats upon which default action should not be taken when detected Threats are categorized by level, you assign default action per threat level.

This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken.
Click to expand...

EDIT: Btw. to open GPO (Local Group Policy) follow these steps: 1. click on start button 2. type: gpedit.msc 3. right click on gpedit.msc and run as Administrator

Windows 10: Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps? - Similar Threads - Lummastealer Threat Blocked

Lummastealer Threat Blocked by Microsoft Defender, do I need to take additional steps?

Threat Blocked: How do I remove a quarantined threat.

Threat Blocked: How do I remove a quarantined threat.

Threat Blocked on Microsoft Defender

Need help with 'Microsoft Defender Antivirus found threat'

Windows Defender threat block

Do I need another Security Program in addition to Microsoft Defender?

Do I Need Additional Anti-Malware along with Windows Defender

do i need additional security or will Defender be enough