I'm seeing large uploads taking place at night and am suspecting that it might be windows Defender submitting files. How can I confirm that?

  • May be WireShark will help. Or any network packet capture tool. – Biswapriyo Dec 16 '17 at 19:27
  • @Biswa thanks. That's a little inconvenient since whatever is happening is late at night. I was hoping for an event viewer log or submission history but don't see specific events about file submission. – Mike B Dec 16 '17 at 19:51
  • 1
    I'm going to guess that you can't. When dealing with virus samples, its standard practice to encrypt them, so that their code cannot be executed accidentally, and to defang parser attacks on the software reading them. – Frank Thomas Dec 16 '17 at 21:36
  • @FrankThomas Thanks. So far, I don't see ANY malicious activity on the system or traces of malware. I do use the system as a file server so I'm guessing that when I transfer largish files over, it triggers a background task later. We'll see how things go. – Mike B Dec 16 '17 at 21:45
  • I would not expect WD to upload any kind of non-executable file, so its unlikely to transfer your large files (though it will scan them locally on read/write). Files are submitted to their online analysis tools when they are previously unknown, or are otherwise abnormal, so MS can analyze them and determine whether a signature should be added or heuristics tweaked to deal with a new kind of threat. – Frank Thomas Dec 16 '17 at 23:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.