Windows 10: My friend tried to install QBitTorrent and Defender flagged it as a threat. He downloaded...

submitted by /u/bluelagoonstyle
[link] [comments]

:)

 

Defender Flagged Windows ISO

Performed a manual WD quick scan. It flagged a PUA as severe, Active.
PUA:Win32/Shoppers.

Examining (Defender History) the threat with Defender to my surprise revealed:




The ISO was downloaded from the download link provided on (Windows News)this Forum.
Did Windows Defender just shoot MS in the foot. Is it a false positive?
Just to err on the side of caution, I successfully removed the threat, with some difficulties, if you can't trust Windows Defender who can you trust.
Any ideas what this all about would be welcomed.

 

Defender flags a Trojan in Pulse VPN install exe file

Thx for the suggestions. When I looked in properties it seemed to suggest it was v8.x, yet the last version I could find to download was v5.x so seemed a bit of a mismatch. I tried 4 or 5 other anti-virus/malware scanners and none flagged this Trojan in
the file. Anyway I took it to our IT to sort out and they got it installed, although I suspect all they did was treat it as a false-positive and Allowed it Defender!

 

Windows defender false positive - forced to allow threat

Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis