0

Every day Windows Defender (Windows 10 build 1703) asks to review files to send to Microsoft

When I go into Defender it shows a "sample submission" window with a path "...\appdata\local\google\chrome\user data\default\preferences"

"Preferences" is actually a config file for Google Chrome, with no extension. It does not have a virus, it's not even a false positive

I cannot exclude it in Defender as the file does not have an extension, and whomever wrote the exclusion code in Windows Defender failed to realise files may not have extensions. Defender thinks all files without extensions are folders You can now exclude files without extensions (as files), but problem still exists when this file is excluded. I suspect exclusion process does not understand file without extensions?

How do I stop this from happening without turning off the Defender features?

This is happening on many Windows 10 machines with similar Chrome config settings, and this started happening with Windows 10 1703 build

  • Microsoft have updated Defender, and you can now exclude files with no extension. But Defender still want to send this file for review? – TFD Nov 10 '17 at 20:46
  • It feels really weird that Microsoft tries to get Chrome users preferences because maybe there is a security concern ... with a JSON file? No way, its a rude try to gather user's information and God knows how do they plan to use it. – Ignacio Soler Garcia Mar 1 '18 at 8:37
2

This is only an unfortunate display glitch of Windows Defender, but the file is still correctly excluded even though reported as folder.

I have tested using the EICAR false virus and can verify that :

  • The test file, named dummy-virus, is detected immediately by Windows Defender and cannot then be manipulated in any way, and will be deleted later on

  • Excluding the file removes that detection and the file can then be manipulated freely

  • The file is still reported as being a folder, but the exclusion on the file does work.


file blocked


file excluded

  • The folder in question is a very potential place for a virus to be download. Want to just exclude one file! – TFD Nov 7 '17 at 0:14
  • After testing, I have rewritten my answer. – harrymc Nov 7 '17 at 20:51
  • The file is not a virus, or even a false positive. Defender does not popup saying it thinks it is a virus. Defender just wants to send it to Microsoft to "review" it? I don't want them too! – TFD Nov 10 '17 at 10:23
  • This shouldn't happen with the exclusion rule, which works well even if it says folder. – harrymc Nov 10 '17 at 18:18
  • Question: You don't want Defender to ask the question, or you don't want to send Microsoft the file? – harrymc Nov 12 '17 at 8:19
1

It's possible that a malware is modifying the Startup/Homepage URL settings in the 'Preferences' file repeatedly and Windows Defender may have sensed it. Run a full system scan using Malwarebytes Premium (14-day trial available).

You may also try these things:

  1. Run the Chrome Cleanup Tool.
  2. Check to see if there is a program on your computer or an extension that's making unwanted changes (i.e. Conduit, Search Protect, etc.) disable any extensions you don't recognize.
  3. Reset Chrome Browser to the Default Settings

As to why you get the sample submission confirmation dialog, I'm quoting a poster at MSFT community forum:

If the file Microsoft is requesting is a data file of any sort, then there will be a prompt to confirm. The only files that Microsoft will send without confirmation are executable files, which for most consumer users are not personally created items.

  • There is no problem with Chrome. It happening on desktops as they upgraded to 1703. Problem is you can't exclude a file in Defender if it has no extension – TFD Oct 29 '17 at 0:50
  • You can exclude a single file. msegceporticoprodassets.blob.core.windows.net/inline-media/… – Win32Guy Oct 29 '17 at 5:50
  • Already mentioned that. You cannot exclude a single file without extension. Defender thinks its a folder – TFD Oct 29 '17 at 9:02
  • The Chrome cleanup tool make a big mess, you are basically starting from scratch. Don't run it! – TFD Nov 10 '17 at 10:20
0

Try to turn off Automatic sample submission to check result.

enter image description here

Also, make sure all policies under Computer Configure\Administrative Templates\Windows Components\Windows Defender Antivirus are Not Configured

  • Ahh, no. I don't want to loose protection. And when you turn it off, it bugs you to turn it back on again! – TFD Oct 20 '17 at 11:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.