Windows Defender Threat Returns Repeatedly
By Timothy Tibbetts |
When Windows Defender discovers a threat, you can choose to Allow, Remove, or Quarantine any found threats. Sometimes, even after allowing a threat, Windows Defender continues to alert you, causing you to take action only to have the same threat return repeatedly.
This problem has repeated itself over the years as a bug. It most likely is caused by an app that Windows Defender has (incorrectly) identified as a Potentially Unwanted Program (PUP).
First, if you haven't already, manage the found threat by removing, allowing, or quarantining.
Next, we're going to delete the log file that stores the warning. We need to find the date and file name. For example, we're looking at a "threat" dated 9-23-20, and the file in question is HostsCKmulti_setup.exe.
Open File Explorer and navigate to:
C:ProgramDataMicrosoftWindows DefenderScansHistoryServiceDetectionHistory.
ProgramData is a hidden folder, so click on View > Hidden items.
The DetectionHistory is a list of all managed threats. Find the folder(s) with the date of the problem. In our case, we had two folders dated 9-23-20. You can delete the folder(s) with the same date as the problem, but if you're nervous about deleting folders, we can identify the folders using the steps below.
One folder was empty, so we deleted that. The other folder had a text file that you can open with Notepad.
As you can see, the name HostsCKmulti_setup.exe was in the text document, so we know we have the correct folder, and we also deleted that folder.
Reboot, and the error should be gone and no longer return.
If not, return to C:ProgramDataMicrosoftWindows DefenderScansHistoryService and delete Detections.log, History.Log, and Unknown.Log.
Similar:
How to Manage Windows Defender Antivirus Found Threats
How to Fix Windows Defender Remediation Incomplete
How to Tell the Difference Between a Virus and a False Positive
comments powered by Disqus
This problem has repeated itself over the years as a bug. It most likely is caused by an app that Windows Defender has (incorrectly) identified as a Potentially Unwanted Program (PUP).
First, if you haven't already, manage the found threat by removing, allowing, or quarantining.
Next, we're going to delete the log file that stores the warning. We need to find the date and file name. For example, we're looking at a "threat" dated 9-23-20, and the file in question is HostsCKmulti_setup.exe.
Open File Explorer and navigate to:
C:ProgramDataMicrosoftWindows DefenderScansHistoryServiceDetectionHistory.
ProgramData is a hidden folder, so click on View > Hidden items.
The DetectionHistory is a list of all managed threats. Find the folder(s) with the date of the problem. In our case, we had two folders dated 9-23-20. You can delete the folder(s) with the same date as the problem, but if you're nervous about deleting folders, we can identify the folders using the steps below.
One folder was empty, so we deleted that. The other folder had a text file that you can open with Notepad.
As you can see, the name HostsCKmulti_setup.exe was in the text document, so we know we have the correct folder, and we also deleted that folder.
Reboot, and the error should be gone and no longer return.
If not, return to C:ProgramDataMicrosoftWindows DefenderScansHistoryService and delete Detections.log, History.Log, and Unknown.Log.
Similar:
How to Manage Windows Defender Antivirus Found Threats
How to Fix Windows Defender Remediation Incomplete
How to Tell the Difference Between a Virus and a False Positive
comments powered by Disqus
