Questions tagged [windows-defender]
In Windows 8 and later versions of Windows, Windows Defender is a built in antivirus software product that replaces Microsoft Security Essentials. Before Windows 8, Windows Defender featured antispyware capabilities and was not offering antivirus protection.
369
questions
0
votes
1
answer
119
views
Does Windows Defender automatically quarantine threats?
I am using Windows 10 Version 22H2 (OS Build 19045.3930).
I recently ran Windows Defender and it found threats due to a Kali Linux .iso I had on my computer. On the Virus & threat protection page ...
0
votes
0
answers
172
views
Disable Or enable Tamper Protection using start windowsdefender: scheme
I recently read you can enable real time protection by using:
start windowsdefender://enablertp/
I want to enable/disable Tamper Protection from a batch script using the same concept.
I've tried ...
-1
votes
2
answers
156
views
How can I configure Windows Defender so that it doesn't delete a file it thinks is a virus/threat, even when I move the file around?
I have a file that Windows Defender thinks is a virus/threat: Windows Defender quarantined it. I see one can add exclusions:
If I select "File", Windows Defender will exclude that file ...
3
votes
2
answers
224
views
How to automate the collection of Defender performance data?
Our IT department requested to collect ETW data from Defender during MSBuild-driven builds. We have intermittent build failures that are evidently caused by Defender (well, its user mode service) ...
0
votes
1
answer
181
views
Supplemental WDAC policy Doesn't Override Block Rule from Base WDAC Policy (Microsoft Recommended Block Rules)
I'm working on creating a Windows Defender Application Control (WDAC) supplemental policy which supplements a base policy. The base policy is merged with the Microsoft Recommended Block Rules. This ...
0
votes
0
answers
234
views
I wasn't able to update Windows Defender in 2 years
In Windows 10, now 11, I have an update queued for Windows Defender.
Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.399.1620.0) - Current Channel (Broad)
This, ...
3
votes
1
answer
86
views
Is there an opposite of an exclusion for Windows Defender?
If I had a file that I know is safe, but Windows Defender thinks it's unsafe, I could add an exclusion. My question is, can I do the opposite?
I have a file that Defender thinks is safe, but I want it ...
0
votes
0
answers
480
views
Use WDAC to block an EXE except when called by specific program? Possible?
Context: When Windows Defender Application Control blocks a program, in the Event Viewer log it also shows which application/process tried to open the blocked exe. For example it says this, followed ...
1
vote
2
answers
427
views
How to increase file size to go unnoticed in windows defender?
The maximum file size that windows defender can scan is 2G, so I ran this command on a Linux machine to increase the file's size. Then I copied it over to my windows machine.
dd if=/dev/zero bs=1G ...
1
vote
0
answers
446
views
Windows Defender constantly fills and empties all available memory
For some reason my Windows Defender takes up unusual amounts of memory. When starting it constantly eats 5.6 GB sometimes cleaning up but soon taking it up again. When I start Webstorm for some reason ...
0
votes
1
answer
387
views
MsMpEng makes computer unusable
Every day for the first 8 hours or so, my computer is unusable due to MsMpEng.exe taking 100% CPU while scanning my file systems for viruses (I think). I've already excluded a whole bunch of folders. ...
-2
votes
1
answer
156
views
windows 11 family antimalware service executable cannot been kill
Before you judge me saying there is already answer, I want to tell you that didn't work on windows 11. I has tried a lot of ways to kill it but it's still using more than 30% cpu of 12 core which is a ...
0
votes
2
answers
323
views
New Windows install, Tamper Protection disabled
So I have bought a used computer which in general works as intended. But when I did a fresh install of Windows 10 22H2 from USB, and before making any changes or downloading any AV, I noticed that ...
-1
votes
1
answer
2k
views
Windows Defender cannot seem to remove an identified trojan from the threat list
About a week ago, I got an alert from Windows Defender stating that I had a trojan in my user folder, after investigating it for a bit, I realized it was a false positive, but nontheless I decided to ...
3
votes
2
answers
3k
views
Is this a Trojan? Random Windows 10 Microsoft Defender Antivirus sample submission message. What is this?
I have received a weird message from Windows (see picture). I would like to know what this exactly means.
I have only used the Edge browser (if it even has to do with it) maybe twice. Also sometimes ...
0
votes
0
answers
155
views
How to add Windows Defender exclusion from Linux?
I am currently working on many computers where I must add exclusions from a Linux USB (Preferably by a script I am making) to the windows PC.
I tried using chntpw but it does not show the registy keys ...
0
votes
1
answer
2k
views
Windows Defender never completes offline scans - could this be malware and how do I restore normal function?
I have not been able to view scan reports after running offline scans since I started actively running them (about 6 months ago). I always assumed no news was good news and left it at that. Today I ...
0
votes
0
answers
42
views
How do I stop windows security breaking new video games?
I have Windows Defender security on
One of the features is "protected folder access."
This feature basically stops programs from accessing folders they are not allowed to access.
This ...
0
votes
0
answers
96
views
Check Windows Defender "active task" on Windows Server Core
Context:
I've got a Docker-host for internal build CI/CD pipelines which is using way more CPU than it seems it should, and most of that is going to Windows Defender.
Problem:
I'd like to know what ...
1
vote
1
answer
4k
views
Powershell - how to add exclusions for defender
I need to set folder exclusion for defender using powershell. The problem is that folder has dot in its name ../.m2/.. (folder for IDE IntelliJ IDEA). If I am trying to create this exclusion with this ...
0
votes
1
answer
1k
views
Unable to set new owner on Windows Defender. Access is denied
I was trying to disable Windows Defender realtime scanning due to the inordinate amount of resources it uses. Yes, I am aware of the consequences.
I have tired disabling the service in GPEDIT but can'...
1
vote
1
answer
511
views
Unable to remove "Scan with Windows Defender" from Windows Explorer context menu
To remove Scan with Windows Defender from Windows Explorer's context menu, I obtained remove Scan with Windows Defender.reg from here
Windows Registry Editor Version 5.00
[-HKEY_CLASSES_ROOT\*\...
0
votes
0
answers
219
views
File context menu contains Windows Defender, not Microsoft Defender
When I right-click on a file in the Windows Explorer to perform an on-demand scan of a single file, the context menu (shown below) presents me with Windows Defender, not Microsoft Defender. My ...
0
votes
0
answers
448
views
Weird message in event log: "Microsoft Defender Antivirus ϋśèď сľöüδ ргοτэсŧιőň тο ġěţ ąðδίŧΐŏńάľ ѕеςųгĩŧý ΐиŧéľŀìģεπčз"
A relative of mine complained of a slow computer. At my suggestion, they rescanned the hard drive. It found issues, but the on-screen information was quite useless so I checked the Event Log. Several ...
0
votes
0
answers
55
views
Windows Defender deletes files of my Ubuntu Server
I have two ubuntu servers i use as storage servers set up with samba files share. I connect to them through my main machine running windows 10 and some files on the server get flagged and instantly ...
2
votes
2
answers
563
views
Will Windows Defender full scan adversely affect a failing hard disc?
A monthly anti-malware full scan was run on this pc using Windows Defender (-aka- Windows Security) as routine, but not this month.
Will running a full scan from Windows Defender adversely affect the ...
39
votes
4
answers
16k
views
Why has Windows Defender started removing shortcuts on 13 January 2023?
All of a sudden, Windows Defender has removed loads of shortcuts (.lnk files) from our Windows 10 and 11 computers. Dozens of computers affected.
Shortcuts have disappeared from both the desktop ...
2
votes
0
answers
51
views
Is there a boolean "NOT" operator in Windows Firewall Rules? [closed]
Quick question for setting up Windows Defender Firewall rules:
Is there a boolean NOT operator that can be used with IP addresses?
What I would like to do is create an outbound firewall rule to ...
7
votes
2
answers
6k
views
Defender deleted a file and protection history is empty. How to restore it?
Defender in Windows 11 deleted a file and protection history is empty. How to restore it? And how to make it quarantine the file instead of deleting?
0
votes
0
answers
532
views
Windows defender flags .vmdk files from VMWare as virus. False positive?
Since like half a year windows defender flags the .vmdk file from vm ware machines as virus.
It will say that it is infected with a form of "BlacoleRef". Strangly is that this doesn't happen ...
0
votes
0
answers
678
views
Windows Defender - How can I temporarily disable calls to MpCmdRun -GetDeviceTicket using registry editor
I have noticed that calls to MgCmdRun.exe GetDeviceTicket -AccessKey <SOME_KEY> were causing glitches in a rendering application I am working on.
I was wondering if there was a way I could ...
2
votes
1
answer
3k
views
How do I "mark" a file as safe against Windows Defender and/or Smart Screen?
I have an .ahk script that I wrote myself that was quarantined on a separate work station. I wasn't prompted (that I myself saw), and only realized it occured when I saw an error message on startup (...
1
vote
1
answer
329
views
How can I configure Windows Defender so that it doesn't prevent moving files it suspects to be a virus?
Windows Defender prevents moving files it suspects to be a virus:
Operation did not complete successfully because the file contains a virus.
How can I configure Windows Defender so that it doesn't ...
2
votes
2
answers
2k
views
When I run Windows Sandbox, is Defender running?
I occasionally need a bit of shareware / free software. I'm always a bit paranoid about downloading those types of things, and usually check them out in Windows Sandbox (on Win 11 Pro). I don't see ...
1
vote
0
answers
386
views
Windows Defender Firewal Incoming Rules issue with definition of Protocol + Port only
i faced today an issue, which makes to me no sense and i would like to ask if you know this issue or if something is going wrong on my setup.
I have a Windows Server 2019 and installed an IIS Role on ...
0
votes
1
answer
272
views
Defender Application Guard requires CPU virtualization extensions?
I'm looking at the Defender Secure Score setting "Turn on Microsoft Defender Application Guard managed mode". I found an MS article to understand the requirements.
Upon reading the article, ...
0
votes
1
answer
1k
views
Defender repeats quarantine operation endlessly in OneDrive temp folder
I get these notifications endlessly, every few minutes, basically forever and I don't know what to do about them. The name changes a little, but the notifications just keep coming forever. Is this ...
1
vote
0
answers
2k
views
Windows 21H2 Defender Firewall Service not starting when Non-US language (set by registry key)
I have a problem with Windows Defender under Windows 10 Enterprise (21H2) with Cumulative Patch from 08 and / or 09 2022.
I created an offline Setup with Microsoft Deployment Workbench to install that ...
0
votes
1
answer
433
views
How to verify Windows Defender is running in Sandbox mode?
I ran this command as admin in Powershell:
setx /M MP_FORCE_USE_SANDBOX 1
restarted my system, then used process explorer and all I see is this:
there is no sign of "MsMpEngCP.exe" that ...
1
vote
1
answer
901
views
What's the right way to deploy my signed WDAC policy to my test VM?
I'm using Hyper-V VM, Windows 11 22H2, to test signed WDAC policy, specifically the fact that even administrators can't disable/remove it, so I decided to try it out.
I've already successfully ...
2
votes
2
answers
1k
views
Why my WDAC policy created using Event Viewer logs based on FilePath rule isn't working?
I'm trying to understand why my WDAC policy is not letting the programs I allow-listed using Event Viewer logs, to run.
This is how I made my WDAC Policy allow list based on Event Viewer audit logs:
...
0
votes
1
answer
733
views
How to enable/disable windows defender on schedule
I want to enable/disable Windows Defender via Task Scheduler. The reason I want this is because I'm running an automatic backup via Backup and Restore (Windows 7) option and it keeps failing because ...
0
votes
0
answers
92
views
Windows Defender Firewall, why these defaults?
For some time now these are the default settings WD propoes to me each time a process tries to connect to network for the first time.
The picture is in italian but it substantially asks for forbidding ...
0
votes
0
answers
308
views
I can't disable tamper protection because windows defender is missing
so to explain my problem : I have a version of windows with windows defender completely removed, if I try to access it through windows settings it just says "you need a new app to open the ...
0
votes
1
answer
1k
views
How to adjust MsMpEng.exe (Windows Defender) scanning schedule when Task Scheduler has no effect?
Every day around 11 PM my CPU use goes to 100% and I hear fans spinning up. Task Manager shows it's C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\MsMpEng.exe. Resource Monitor shows ...
0
votes
1
answer
2k
views
I can't get Windows Defender Application Control policy working in Windows 11
On Windows 11, I made a WDAC policy with WDAC Wizard and added it to Group Policy, restarted the PC and still the policy isn't being enforced.
Here is the test policy I made:
<?xml version="1....
1
vote
0
answers
1k
views
How to prevent Sophos HitmanPro, Sophos Endpoint Defence, and Windows Defender High CPU with Visual Studio Code GIT operations
For a little over a week now I have been having high CPU usage issues by Sophos HitmanPro.Alert, Sophos Endpoint Defence and Windows Defender Advanced Threat Protection Service when performing GIT ...
0
votes
1
answer
3k
views
Windows Defender Firewall Blocking Ping
My workstations use Windows Defender Firewall managed by local group policy. Every time I try to ping from this one workstation I receive "General Failure". When I turn the firewall off I ...
0
votes
1
answer
1k
views
Clearing the Protection history (not the same as Detection history)
There is a Windows Defender feature that - separate from the malware detection history - notes restrictions for programs not already known to be intentionally dangerous, like Protected Folder Access (...
0
votes
0
answers
23
views
I can't turn on Windows 10 protection
In June I installed an optimizer called Smart Game booster, when I finished installing it I used it, but later I realized that Windows Defender was disabled.
It is the first time that the Antivirus is ...