0

This question already has an answer here:

Ok, this is a bit of a twisty story.

Soon after I bought my new Win10 laptop I started having PC freezes (nothing on the screen moves, incl. mouse) that in 4-30min resolved by themselves. I went back to using my old laptop until I resolve this blocking problem. I thought the problem might be caused by a virus, so I ran a "Quick scan" in Windows Defender (it found nothing) and a "Computer scan" in the free "Kaspersky Security Scan" app (it too found nothing).

Later, however, when I happened to do something minor on the new laptop, I noticed I have a notification in the "speech bubble" icon in the bottom right of the screen. I clicked the icon and in the pane popped up there was an item that said something like "Windows Defender: Blahblah was successfully..." (the message was truncated and unclear. This was several days ago, hence why I fill what I forgot with "Blahblah"). I clicked the message, it disappeared and the main WinDefender window popped up with nothing on it to elaborate on situation (in any of its tabs).

I'm thinking a scheduled Defender virus check may have found and removed a virus, and that's what the message may have been about, but I have no way to check. If it has indeed removed a virus, then very likely the cause of the freezes has been fixed and I can resume using the PC without having to first go through heavy procedures like this one.

How do I check if WinDefender has cleaned up any viruses?

Note: I don't want to just switch back to using the new PC for a couple days to see if any freezes happen, because if any freeze does happen during my work, it would be very annoying.

marked as duplicate by DavidPostill, fixer1234, karel, Community Feb 20 '17 at 19:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • The freezes sound like an I/O problem unrelated to any possible malicious files on your PC. Without the exact text of the notification you saw it's difficult to tell you what it meant. – Ramhound Feb 18 '17 at 22:21
  • @Ramhound: Thanks. Why do you think it's an I/O problem rather than some process that maxes out CPU or RAM? – Stefan Monov Feb 18 '17 at 22:27
  • "that in 4-30min resolved by themselves" – Ramhound Feb 18 '17 at 22:34
  • @Ramhound: You think CPU/RAM problems wouldn't resolve by themselves? Or that they would resolve faster? Also, can't a virus cause heavy I/O with the same symptoms? – Stefan Monov Feb 18 '17 at 22:48
  • A virus would continue to use heavy I/O continuously. – Ramhound Feb 18 '17 at 23:32
0

I just found out the answer by chance:

Open WinDefender. Go to the history tab. Select "All detected items" and click "View details". In my case I saw no real viruses there.

I'm pretty sure this answers my question, but if I'm wrong, please do leave a comment :)

  • That's not the full story. See my answer How to find specifics of what Defender detected in real time protection? – DavidPostill Feb 19 '17 at 13:41
  • @DavidPostill: In my case your technique shows nothing more than mine does. Do you know in what cases I can expect it to show more than mine? – Stefan Monov Feb 20 '17 at 18:52
  • You get exactly the same info? – DavidPostill Feb 20 '17 at 20:44
  • @DavidPostill: I get info about the same 3 malware occurrences. It's split into a 1116 and a 1117 event for each occurrence. Also for the first malware occurrence, there are 5 identical 1116 events before the corresponding 1117 event, spaced a couple of seconds apart, each. I guess this all is more information than I see in Defender, but still it's only the same 3 occurrences, and I wonder if there will ever be more of a difference between the two methods. – Stefan Monov Feb 20 '17 at 21:09
  • 1
    I'm guessing this is it. Extra info (which may or may not be interesting/useful) is posted to the event logs. It may be that Windows Defender parses the event logs for it's history tab. Note there are other events that may be interesting like definitions updates and errors etc as well posted to the event log. – DavidPostill Feb 20 '17 at 21:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.