1

My Windows 10 x64 pro is up to date, at build 1809. Every once a while, the defender program will notify me that it has found a threat. But it does not say what exactly is the threat, nor does it allow me to take any action. In addition, the threat history shows empty list.

Virus threat protection

Virus threat protection

Threat History

Threat History

Full threat history

Full threat history

  • Can you show the other statistics within Windows Defender there should be a button that will view the results of the scan – Ramhound May 1 '19 at 10:53
  • @Ramhound, added more screenshots. – David S. May 2 '19 at 12:10
  • If the file was not already deleted, "See full history", will show you the detection. – Ramhound May 2 '19 at 12:14
  • @Ramhound, the screenshot of the Full history is posted and the list is empty. What bothers me is that I really want to know what was the threat. – David S. May 4 '19 at 3:09
1

I managed to resolve a similar issue, even I am not sure if this is your case too. This is caused by installing a software called Ali wangwang which is developed by Alibaba. A lot of Chinese users have this issue but they don't have a solution. Even uninstalled this software, the problem persists.

I set up a virtual machine and compared the registries before and after installing Ali Wangwang. The software made a number of modifications to the registry, but I noticed that there are one hash code which also appeared in the logs of windows defender(MPLog). I removed the the key with that hash code and the problem is gone! Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\65439929B67973EB192D6FF243E6767ADF0834E4

This seems to be a certificate issued by Symantec, named Sysmantec Time Stamping Service Signer. I don't understand why this is causing the problem, and I am also not sure if I just "skipped" some scan which is supposed to be conducted? If someone knows about it, please share, thanks!

One thing for sure, there is no registry key like this on another PC or a new setup VM with Windows 10.

  • Interestingly, that hash key is also used in this code sample. – David S. Jul 13 '19 at 10:18
  • Yes, I also googled and found this hash on multiple pages. Don't know how are they being related. – a_pp Jul 14 '19 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.