Windows 10: Windows Defender Identifies The SAME PUP As A Threat Repeatedly

Since the implementation of W10 V2004, Windows Defender has now been defaulted to identify

PUPS as a threat. As a result, many are now made aware of their presence. And they are "remediated",

on the spot, to prevent them from causing any mischief.

The problem occurs on the subsequent scans with Windows Defender. It identifies the same PUP again, and again.


It has been determined that this is caused by the presence of the PUP in Protection History.

It appears that the default remediation that Windows Defender applies to PUPs is toBlock them, then leave

them in Protection History .


Windows Defender is defaulted to scan its own "Scans/History". Resulting in the discovery of the PUP over and

over again. Even though, other scanners see no evidence of the PUP on the PC.


Until Microsoft sees fit to Quarantine the PUPs, you can prevent the repeated error indication, by "excluding"

Scan/History from the Windows Defender scan. I see no need for that, anyway!


You can accomplish this in the following manner. Navigate through Settings, to Virus & Threat ProtectionSettings.

Click "Manage settings".

Scroll down to "Exclusions". Select "Add or remove exclusions"

Select "Add an exclusion". Chose "Folder". Then navigate through Explorer as follows.

C:>Program Data>Microsoft>Windows Defender>Scans>History.

Click on History then click "Select Folder".


Windows Defender will no longer scan its own Scan/History. This should stop the repeat notifications.


Glen

:)

 

Windows defender false positive - forced to allow threat

Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis

 

Windows defender Identifying a threat

If your reading this I thank you for your time.

My question is how would you make Windows defender see a certain threat because i have a program on my computer that I would like to get rid of but it doesn't let me and I was thinking what if I made Windows defender see it as a threat and then it deletes
it.

Regards,

Michael

 

PUP Threats Detected By Malwarebytes

Check your list of installed programs and remove any toolbars. Run MBAM again, including rootkit detection, and do a full scan of all your hard drives, not just a Threat scan. Then, reset your Chrome browser.