Windows 10: What should I do if when I try to remove a threat windows defender gives me an incomplete fix?

I downloaded a game that is a trojan, and when I realized I have never run it I used windows defender. I have one threat blocked, one quarantined, and one that is incomplete. Trojan:Script/Wacatac.B!ml. That's the attack I get. And I don't know how to make the removal complete. Thank you.

:)

 

Windows defender: recurring message: threat severe, remediation incomplete

Facts

Several weeks from windows Defender Virus and Threat Protection a message about a severe security breach.

• Message: Remediation incomplete.
  
• Detected: Trojan:Script/Phonzy.A!ml
  
• Details: This program is dangerous and executes commands from an attacker.
  
• Affected Items: file: \Device\HarddiskVolumeShadowCopy18\Windows\SysWOW64\CDN4055\data.dll
  

Example of message frequency:

• 8/4/23 2 times 20.42 8.23
  
• 8/3/23 3 times 20.04 13.48 1.33
  
• 8/2/23 3 times 22.06 19.07 6.35
  
• 8/1/23 1 time 18.16
  
• …
  

Remediation steps taken:

• Windows Defender: Full scan: Results: NO issues.
  
• Windows Defender: Off-line full scan: Results: NO issues.
  
• Kapersky Rescue CD: Results: NO issues.
  

Then

Microsoft Safety Scanner 1.393.2062.0

Full scan

Scan Results:

The scan completed successfully and no viruses, spyware, and other potentially unwanted software were detected.

If you continue to experience issues, please ask the community, or submit a support case.

 

WINDOWS DEFENDER IS NOT REMOVING THREATS

I'm having a problem with Windows Defender the threats found after I ran a full scan that last maybe around 10 hours cannot be removed by windows defender. I selected the remove option and it shows processing but after a while
the threats are still listed and active. I already ran a offline scan and a quick scan but neither fix the problem.

I already ran a secure boot and see if third-party apps are causing the problem but nothing works the threats are still listed and active. I checked the location of the file and manually deleted it even on my recycle bin but
the threats are still there and labeled as active. This very annoying. I think this is an error in the windows defender part because I installed Malwarebytes and ran a full scan which took a couple of hours and found nothing because like I've said I have deleted
the file location where the threats are.

 

Windows defender false positive - forced to allow threat

Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis