Windows 10: Windows Security Allowed Threats Issue

Windows security has a threat set in the allowed list, yet every day it tells me, that it found the same threat.This is reoccurring issue.Edition: Windows 10 ProVersion: 22H2Installed on: 20-‎Apr-‎22OS build: 19045.3930Experience: Windows Feature Experience Pack 1000.19053.1000.0Security intelligence version: 1.403.3578.0

:)

 

Windows defender false positive - forced to allow threat

Windows defender has started to identify C:\Windows\System32\mshta.exe as a threat [normally reported as a Trojan Powessere.G]. I use mshta.exe to run an hta custom MsgBox - I have been hoping to keep using my current CustomMsgBox tool [batch file calling a vbs-hta file] until later this year when I hope to have had enough time to replace it with a PowerShell alternative.

Windows defender's notification lets me "allow the threat" but that seems to me to be a bigger security hole than is necessary - it will now ignore a potentially real intrusion when all I want to run is a genuine Windows component. My immediate problem is fixed but I would prefer to fix the false positive using the exclusions list.

I cleared the 'Allowed threats history' so I could use the exclusions list instead. I added C:\Windows\System32\mshta.exe to the file exclusions list and I checked that it had taken properly by checking the exclusions list both in the UI & in the Registry. But the exclusion made no difference, it continued to detect and block the exe.

I have repeated the attempt several times [by clearing the allowed threats list & exclusions list beforehand] and the results are the same every time
- allowing the threat works,
- using the exclusions list has no effect.

I studied the relevant tutorial but have not spotted an error in what I have been doing - Add or Remove Windows Defender Exclusions

Does anybody with experience of using the exclusions list to counter false positives have any suggestions for me?

Denis

 

Maybe I accidentally allowed a threat

Hi Filip,

If you think you accidentally allowed a threat, open Windows Security → Virus and Threat protection → “Allowed Threats.”

If any items are listed on that page, select each threat and click “Don’t allow”.

Also, check the Exclusions. Open Virus and Threat protection → Manage Settings → Add or remove Exclusions. If there are suspicious entries there, remove them.

 

Windows Defender/Security - no option to "Allow" potential threats?

If you want to control what does defender do to threats you can do it trough GPO in the following location: Computer configuration\Administrative templates\Windows components\Microsoft defender antivirus\Threats Here configure option: Specify threats upon which default action should not be taken when detected Threats are categorized by level, you assign default action per threat level.

EDIT: Btw. to open GPO (Local Group Policy) follow these steps: 1. click on start button 2. type: gpedit.msc 3. right click on gpedit.msc and run as Administrator