Windows 10: Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Daniel Wang6 · Jan 26, 2025

Hi, My name is Daniel. I was regularly performing a daily scan with Windows Defender on my system Windows 11 Home Version 23H2. I have not downloaded anything within the past 24 hours, and there were no threats detected in the previous 24 hours.However, today January 26, 2025 at 3:28 pm I performed a Windows Defender Full Scan after updating it, and it lists 1 potentially unwanted app.The strange thing is when I check, it would ask if I want the app to make changes to my device.And it is: Windows Security.It states Verified Publisher: Microsoft WindowsCLSID: {6CED0DAA-4CDE-49C9-BA3A-AE163D

:)

FarisChakour · Jan 26, 2025

Potentially unwanted app still lingering?

I had a potentially unwanted app appear on Windows Defender and removed it. A little while later whilst I'm clearing up some tasks that were enabled on startup I noticed one called utweb.exe Utweb and after searching it up it appears to be affiliated with the unwanted app.

The option to open file location is greyed out but I've disabled. I've performed an offline scan with Windows Defender and scanned with Malwarebytes - both said my PC was in the all clear.

Is there anything else I should do?

Cliff S · Jan 26, 2025

Windows Defender Offline Scan in Windows 10

Also MpSwpHelp:

Using Windows Defender Offline
Malicious and other potentially unwanted software, including rootkits, attempt to install themselves on your computer when you connect to the Internet or install some programs from a CD, DVD, or other media. Once on your computer, this software might run immediately, or it might run at unexpected times.
Windows Defender Offline can help remove hard to find malicious and potentially unwanted programs using definitions to recognize threats. Definitions are files that provide an encyclopedia of potential software threats. Because new threats appear daily, it is important to always have the most up-to-date definitions installed in Windows Defender Offline. Armed with definition files, Windows Defender Offline can detect malicious and potentially unwanted software, and then alert you to the risks.

Windows 10
On Windows 10, Windows Defender Offline is completely automated. This means Windows Defender when it identifies advanced malware will recommend that Windows Defender Offline be run and on the next reboot Windows Defender Offline will automatically scan/remediate the malware and reboot into Windows 10. This removes the need for the user to interact with the Windows Defender Offline product manually, as such the below sections are no longer applicable to Windows 10.

Windows 8.1, Windows 8, Windows 7 and Windows Vista
The following sections apply only to the above mentioned OS.
Manually scan for malicious and other potentially unwanted software
Windows Defender Offline offers three ways to scan your computer: Full scan, Quick scan, and Custom scan.
· A Full scan will scan all the files on your computer. It is highly recommended that you perform this type of scan. However, a full scan can take a long time, depending on the size of your hard drive and number of files to scan.
· To do a full scan, click the Home tab, under Scan options select Full and then click Scan now.
· A Quick scan will check places on your computer’s hard disk that are most likely to be targets for malware, such as the system folder, startup folder, and the registry. You should run a quick scan anytime you suspect malware has infected your computer.
· To do a quick scan, click the Home tab, under Scan options select Quick and then click Scan now.
· Use Custom scan to choose just the folders or files you want to scan. This works well if you suspect a specific area of your computer is infected.
· To do a custom scan, click the Home tab, under Scan options select Custom and then click Scan now.
· On the Scan options page, select the drives and folders that you want to scan, and then click OK.
Respond to malware found on your computer
When Windows Defender Offline detects malicious or potentially unwanted software, you can review the item, choose Clean Computer, Remove, Quarantine, Clean, or Allow the item. Windows Defender Offline will offer a recommended action, but you can choose a different one if you prefer.
Note: If you choose Allow for an item, Windows Defender Offline will stop alerting you to risks that the software might pose to your privacy or your computer. Add software to the allowed list only if you trust the software and the software publisher.
To take recommended actions on malicious or potentially unwanted software
To review and apply actions to detected malicious or potentially unwanted software, follow these steps:
1. In Windows Defender Offline, click the Show details link under the Clean Computer button on the page that is displayed when a scan is completed. This opens a new dialog.
2. For each item listed, review the information that Windows Defender Offline displays about the item. You can choose to apply the recommended action, or select another action that Windows Defender Offline should take on the item.
3. Clicking on the Show details button provides more detailed information about each identified threat.
4. After you have reviewed each item and selected an action, click Apply Actions.
Using Clean Computer
When you have malicious or potentially unwanted software, one of your options is Clean Computer. The Clean Computer button appears on the Home tab of Windows Defender Offline.
When you choose Clean Computer, Windows Defender Offline opens a new dialog that lists the items that were identified and the progress in apply the default action on the item.
Windows Defender Offline first applies the default actions for detected software based on the definition file from Microsoft. If the default action fails, the next action recommended by Windows Defender Offline is automatically applied. In most cases, Clean Computer quarantines malware when the attempt to clean or remove the malware fails. Detected software items that do not have an action associated with them are removed.
If Windows Defender Offline fails to take the above mentioned actions on the item, the window turns red. If this happens, try rebooting and rescanning the machine. If Windows Defender Offline succeeds the window turns green. Clicking on Close will dismiss this dialog.
Updating Signatures on Windows Defender Offline
If you have Windows Defender Offline installed on a USB, inserting the USB drive on a computer with internet connection and re-running the wizard will update the signatures.

Otherwise, the recommended approach for updating signatures is to create a new copy of Windows Defender Offline.
Understanding alert levels
Alert levels help you choose how to respond to malicious and potentially unwanted software. While Windows Defender Offline will recommend that you remove malware, not all software that is detected is malicious or unwanted. The information in this table can help you decide what to do if Windows Defender Offline detects potentially unwanted software on your computer.
Alert level: Severe
What it means: Widespread or exceptionally malicious software, such as viruses or worms, which negatively affect your privacy and the security of your computer, and which can damage your computer.
What to do: Remove this software immediately.
Alert level: High
What it means: Software that might collect your personal information and negatively affect your privacy or damage your computer, for example, by collecting information or changing settings, typically without your knowledge or consent.
What to do: Remove this software immediately.
Alert level: Medium
What it means: Software that might affect your privacy or make changes to your computer that could negatively impact your computing experience, for example, by collecting personal information or changing settings.
What to do: Review the alert details to see why the software was detected. If you do not like how the software operates or if you do not recognize and trust the publisher, consider blocking or removing the software.
Alert level: Low
What it means: Potentially unwanted software that might collect information about you or your computer or change how your computer works, but is operating in agreement with licensing terms displayed when you installed the software.
What to do: This software is typically benign when it runs on your computer, unless it was installed without your knowledge. If you're not sure whether to allow it, review the alert details or check to see if you recognize and trust the publisher of the software.
Windows Defender Offline system requirements
Memory requirement:
The system to be scanned must have a minimum of 512 MB of memory.
Operating Systems that can be scanned for malware:
Windows XP SP3, Windows Vista, Windows 7 and Windows 8.
Windows Server 2k3 R2, Windows Server 2k3 SP 2, Windows Server 2k8, Windows Server 2k8 R2, Windows Server 8.
Click to expand...

Ramesh Srinivasan · Jan 26, 2025

Windows Defender can't delete a Potentially Unwanted App

Previous answers says to open Windows Defender Scans Folder but I cannot get access. It says it is SYSYEM only and will not give me full access? How do I get access to WD History as I keep getting the Potentially Unwanted App warning in Defender!!!
Click to expand...

If the notification repeatedly appears for remediated threats, clear the Defender threat history using the batch file in the following link:

GitHub - LesFerch/ClearDefenderHistory: Clear Windows Defender History Files

Windows 10: Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be... - Similar Threads - Defender full scan

Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be...

Windows Defender full scan identified Potentially Unwanted App Found - But looks like MS...

Windows Defender full scan identified Potentially Unwanted App Found - But looks like MS...

Potentially Unwanted App Found

Potentially Unwanted App Found

"Potentially unwanted app found"

Potentially unwanted app found

Potentially Unwanted App Found

Potentially unwanted app found