Windows 10: Windows defender; how to create a quarantine action exception

hi folks,

Windows defender keeps quarantining a file and I keep restoring it. This repeats every day or so. To stop this wasteful cycle, is there a way to create an exception?

cheers

Mark

:)

 

Can I configure windows defender to never quarantine files

I have a follow up question…

Without the registry setting we discussed…. So using the normal default behavior. DisableRoutinelyTakingAction = 0 or just delete the key


If I create a test EICAR that gets quarantined and then I restore it using the command line:

Code:

It gets restored as expected, but I have no exclusions set so when I reboot and rescan that folder I get a message stating ‘items skipped during scan’.





Does the MpCmdRun restore action create some type of exclusion list (white list) of its own that is not part of users exclusions in the defender GUI of which I have none? And if it does is this a temporary cache of exclusions or permanent?

I've rebooted multiple times and tried to re scan the path and/or the file and each time it gets skipped from the quarantine action.

 

Can I configure windows defender to never quarantine files

Hello,


I am using w10 1903 x64 - I was wondering if there is a way without setting up exclusions to configure Windows defender to never quarantine any file and only block access and just prompt the user how to proceed?

I am all for active scanning but not automatic quarantine actions.



Also just wanted to share this nugget of info – if you want to see the list of files that have been quarantined via cli run:



Code:

Thanks.

 

Malwarebytes Quarantine and Windows Defender

According to everything I've ever read, the only difference with the free version of Malwarebytes Anti-Malware is that the Real-time protection portions stop operating after the initial trial period, nothing else changes.

It appear that others have had the same confusion about the MBAM Quarantine interface that you are having, as this forum post from 2016 displays.

Virus quarantined only Option quarantined - Malwarebytes 3 - Malwarebytes Forums

If you scroll down to the Quarantine item heading on the left-hand pane of the following documentation page, you'll see the description that follows. Bolding is mine.

Malwarebytes for Windows Help Documentation

"Quarantined items are shown in a table format, with pertinent information presented to help you determine what action needs to be taken.
Each item listed has a checkbox in the leftmost column. Check the checkbox to restore or delete the item. Please note that the Restore and Delete buttons are greyed out until items are selected. If you wish to apply the same action to all quarantined
items, select the checkbox in the table header and click
Restore or Delete. Please be aware that quarantined items which are not deleted or restored will continue to be visible here until action is taken."

As for your assertion that two Windows Security (Defender?) items were displayed as blocked, with no other option to delete, I suspect you are just as confused about the operation of these items. If these are what you wish to resolve here, then describe
these notifications from Defender more completely, including any text displayed and exactly what they state so that maybe someone can help you better understand what Defender is trying to tell you.

Rob