Windows 10: Random Subfolders are Added to MS Defender Exclusion Cannot Be Deleted

Hi, just recently my laptop was infected with serious malware. Had to restore Windows 11. I am now seeing randomly added subfolders in MS Defender exclusion settings and I cannot remove them. Has anyone here experienced this and was able to remove these? Here's a snapshot.

:)

 

Unable to Remove Exclusions from Windows Defender

Thank you for posting back. If you trust a file, file type, folder, or a process that Windows Defender Antivirus has detected as malicious, you can stop Windows Defender Antivirus from alerting you or blocking the program by adding the file to
the exclusion list. It seems that it was added automatically. We suggest that you follow these steps:

• Go to Settings and select Update & security.
• Click Windows Defender.
• Look for Exclusions and select Add an exclusion.
• Navigate to the file, folder, or process, and select Exclude this file.

If the steps provided did not work, we recommend that you boot your device to
Safe Mode and redo the process.

Let us know if you need further assistance.

 

Windows Defender - The list of exclusions does not appear

I have this issue. I'm running 20H2 and 4.18.2011.6. I think it is at least partially a registry permissions issue, which has been alluded to above.

I don't feel like writing out a complete list of details, but in brief: After disabling "Tamper Protection" in Windows Defender, I used the extremely handy NirSoft "Advanced Run" utility to run Regedit as TrustedInstaller. (Running it as System did not work.) Then I renamed "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions" by simply adding a few characters to the end of "Exclusions". I renamed it rather than deleting it for safety, and because I expected the effect of renaming to be the same--i.e. that Windows Defender won't see it.

I then went into Windows Defender and re-added my path and process exclusions. Now, the exclusions appear haphazardly. Sometimes, my process exclusions show but the path exclusion do not. Sometimes, the exact opposite happens. Sometimes, they all show properly. (Edit: This seems to no longer happen. Please see my updated note below)

After quickly comparing the registry key permissions, it looks like the entire "Exclusions" key (and all keys beneath it) has one thing that the old one did not: Read permissions for "Everyone". (Technically, "Everyone" was given the following permissions: Query Value, Enumerate Subkeys, Notify, Create Link, and Read Control.) The old key doesn't have "Everyone" listed at all.

All the exclusions still exist in the registry, and the "Everyone" permission is present on each key. So, I have no idea what the problem is.

In case anyone wonders, under MpEngine, I have:

MpCampGradualRelease = 1
MpCampRing = 3
MpEngineRing = 3
MpGradualEngineRelease = 1

Edit: The last few times I've looked at my exclusion list, they all appeared correctly. I'm not sure if I'm free of the issue or not, since the behavior earlier (where the entries appeared/disappeared haphazardly) was so bizarre. I did delete the "Exclusions" key that I had renamed earlier after carrying out the steps I outline above. Maybe Window Defender was confused by the entry that I had named "Exclusionsxxx", and deleting that key made everything work normally? That would be crazy.

 

BlueSound OS conflict with Windows Defender

Hi,



Thank you for writing to Microsoft Community Forums.



I understand that Windows Defender blocks BluOS app. It is very unusual that Windows Defender blocks the app. However, I would suggest you to try adding the app to the Exclusion list of Windows Defender and see if that helps.



To add the application to the Exclusion list, please refer the steps mentioned in the article

Add an exclusion to Windows Security.



Let us know how it goes.



Regards,

Nikhar Khare

Microsoft Community - Moderator