Windows 10: Windows Defender Stuck while removing "Threat"

It discovered a thread which isn't a real threat. Now it is stuck for an hour trying to removing it, while it is not progressing at all and at the same time it wastes 25% of my CPU constantly.


I can't terminate the process either, not even as administrator. The only thing I can do is reboot the system and deactivate Windows Defender through Group Policy before it starts removing the "threat" once again (does it constantly). At the same time, the file isn't there anyway because I removed it myself (in case Windows Defender would stop but it didn't). Note: I always do: uncheck "Live Monitoring of the system" or whatever it is called prior to disabling it. So it was really disabled. I did Disk Cleanup still nothing, it always finds this threat again. I tried pressing "remove" the threat, "quarantine" the threat and "Allow" the threat. It always clogs up no matter what!


So, I deactivated Windows Defender from Group Policy, rebooted and restarted Windows Defender. Guess what? After a minute or so, it starts removing this threat again! How can I stop this? How is it finding this information?


Thanks in advance.

:)

 

Windows Defender Stuck on Removing Severe Threat

Sure, you can put Windows Defender Offline on a jump drive.

But the emphasis of my post is that you no longer have to do that ...
you can launch Defender Offline from Settings > Update and Security > Defender > Defender Offline
as described here: Defender Offline

simrick (safe mode Adwcleaner with a question about the reg entires) and Borg (tdssKiller, Rkill, possible manual reg entries removal) have offered other suggestions - it helps troubleshooting if you always follow the order of the suggestions and report the results.

When you've completed all on-demand scans and other remediation steps, run the following (both commands take a while to complete).

If there are any integrity issues reported in the results on the screen,

Launch Command Prompt (Admin)

Dism /Online /Cleanup-Image /RestoreHealth

SFC /ScanNow

 

Defender wont remove the threats

I ran Windows Defender full scan which took over 15 hours to completed. It indicates that there are 20 threats which I want to remove. However Windows Defender gets stuck and does not remove any of them. It has been running for over 20 hours and nothing.
What can I do to remove these threats.

Thanks

 

Windows defender false positive - forced to allow threat


Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis