Windows Defender reports malware, but cannot remove it.

Question

Windows Defender reports malware, but cannot remove it. Event Viewer shows attempts, Defender "start actions" does not remove malware and a scan reveals the same threats. Event Viewer says Defender had a critical issue, throws 0x80508032.

Have run FRST and have the two resulting log files, need help in figuring out what to do next.

Answer 1

Glad to help!

Answer 2

That would seem to be the case- will run the Safety Scanner tool. Thanks- will reply with results.

Answer 3

That folder should be able to be deleted in Safe Mode.

The best option now may be to download the Microsoft Safety Scanner and run a full scan with that, in case the malware is affecting Defender's functionality.

https://learn.microsoft.com/en-us/microsoft-365...

Answer 4

Thanks, Dave, for the quick response. Followed your instructions, cleaned out the \quarantine folder no problem. However, there is a file in the *\scans\Service\ folder (Detections.log) that cannot be deleted as it is "...open in another program." I am in Safe Mode. Any idea what may have this file open? Is in the antimalware service?

Answer 5

Hi, I am Dave, I will help you with this.

1

Start Windows in Safe Mode.

Open File Explorer, then on the View menu at the top, temporarily turn on 'Hidden Items'.

Navigate to this folder: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service

Delete the contents of that Service folder.

Navigate to this folder:

C:\ProgramData\Microsoft\Windows Defender\Quarantine

Delete the contents of that Quarantine folder.

Close File Explorer.

2

Restart Windows in normal mode.

Open Defender and select the option to perform an offline scan, your PC will restart to perform that scan.

Then check if that malware list is clear.