A false positive detected by Windows Defender

Question

I need help on my computer's built-in Microsoft Antivirus system. Although I have already deleted the files that caused the false positive to be detected, my pc still gave me this notification NON-STOP.

This is not a virus. This is actually a false positive detected by Windows Security after I have installed an engineering software known as Festo Positioning Drives Tool. After I have eliminated one, it keeps popping up the same file location over and over again:

It causes my Autodesk Software to be unable to run, hence giving it the 0xc0000005 error. I need help. I have tried alot of solutions regarding about False Positives, but its no use. Anyone has any idea how to solve this?

Answer 1

Hi tanshawn,

You appear to have a problem that is impossible to resolve. However, consider this as

a remote possibility, if you will. AutoDesk may have contained the virus.

This Trojan itself was not a false positive. Defender claims to have "cleaned" it on 6/6.

True, MalwareBytes blocked its domain, at a later time. Something that Defender may

just have ignored to do.

You may, however, be experiencing false positives now, that Defender is responsible for.

Defender has the tendency to "detect" items that are still in its History, and treats them

as current threats.

You can determine if this is happening in your case, by downloading a copy of the

Microsoft Safety Scanner. And use it to run a full scan. If the Scanner does not detect

the Trojan, but Defender continues to do so, it is now very likely to be a false positive.

Both Defender and the Scanner use the same definitions. What one finds so should

the other. https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

You can eliminate the false alerts by deleting the "Detection History" folder. Completely

safe. Windows rebuilds the folder when it needs it. To delete the Detection History folder;

Ensure that File Explorer is set to show "Hidden Items". Find the option under "View" tab.

Navigate through *C:\ProgramData\Microsoft\Windows Defender\Scans\History*

Service. In the Service folder, delete Detection History.

Restart and Defender should not report this Trojan again.

If it does not, you should remove the "Allowed Threats" and the "Exclusions" that you

have set for it. If it comes along again, it would be prudent to be able to detect it.

Be aware, if you do encounter the Virus at a later date, you may have to repeat this

procedure again. So far as I know, Microsoft has not corrected this anomaly yet.

Glen

Answer 2

The problem is that you cannot add the false positive in Defender, which means that Defender needs repairing. I am trying to give you the steps to repair Defender and you will not cooperate. Will you please work through steps I gave you to repair Defender so it will start working well enough that you can add the exclusion. If you cannot add the exclusion then it will continue to cause the error.

You can also ask for help with this more advanced problem at our sister forums for IT Professionals, Q&A forums, as Community is strictly an end-consumer forum. Go here: https://docs.microsoft.com/en-us/answers/index....

There are also good IT Pro forums here:

https://www.techrepublic.com/forums/

https://www.spiceworks.com/

Answer 3

We need to go over your System more thoroughly since the most basic Defender setting that works for thousands of others here is not working for you.

We do not attempt to repair Defender without first using the most powerful scanner to check for infection, because it could turn out this was caused by malware.

So Download, install and run a full scan with the most powerful on-demand free scanner Malwarebytes:

https://www.malwarebytes.com/mwb-download/.

In the Malwarebytes Settings > Security tab set it to include scanning for Rootkits.

If necessary run it in Safe Mode with Networking, or Safe Mode accessed by one of these methods: https://www.digitalcitizen.life/4-ways-boot-saf...

Clean up anything found, restart PC and then run again until it comes up clean.

Then download, install and run a full scan with AdwCleaner:

http://www.bleepingcomputer.com/download/adwcle... Remove whatever it finds.

Check for any remainders in Settings > Apps > Apps & Features, and also in each of your browser's Extensions, Home Page settings, Search service or Add-On's as shown here: https://www.computerhope.com/issues/ch001411.htm

Then check for damaged System files by running System File Checker from Step 10 in this checklist:

http://answers.microsoft.com/en-us/windows/wiki....

If completing all of Step 10 in above Checklist doesn't fix it then run a Repair Install which reinstalls WIndows while keeping your files, programs and most settings in place, by installing the Media Creation Tool from this link: http://windows.microsoft.com/en-us/windows-10/m..., open the tool and choose Upgrade This PC Now. This will solve most problems and also bring it up to the latest version which you need anyway and by the most stable method.

Then run a scan with Defender and if it still finds the false positive try to list it as an exclusion.

If you want to keep Malwarebytes as an on-demand scanner then you can turn off its Real Time trial version in it's Settings > Account Details tab.

I hope this helps. Feel free to ask back any questions and let me know how it goes. I will keep working with you until it's resolved.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.

Answer 4

I tried exclusions to my files, but none worked. I also tried disabling anti virus system, but also didn't work. Also, currently I am suppressing the virus, since now there is no way to remove the false positive. I read your tutorials, and even tried installing a third-party antivirus, but that didnt help either, since it detects the same false positive. What should I do?

Answer 5

Hi Tanshawn. I'm Greg, an Independent Advisor.

See how to resolve false positives (exclusions) with Defender:

https://www.tenforums.com/tutorials/5924-add-re...

https://www.thewindowsclub.com/manage-quarantin...

https://docs.microsoft.com/en-us/windows/securi...

Defender gives best Windows performance, is built in, has least issues and is from Microsoft who knows how to protect their OS best. But if you think you are infected I would bring in the much better on-demand scanners Malwarebyes from https://www.malwarebytes.com/mwb-download/ , and AdwCleaner from http://www.bleepingcomputer.com/download/adwcle....

Enable root kit scanning in MB Scan settings, disable real time in it's Account Settings to use it only as a scanner when needed.

Feel free to ask any questions. Based on the results you post back I may have other suggestions if necessary.

______________________________________________

Standard Disclaimer: There are links to non-Microsoft websites. The pages appear to be providing accurate, safe information. Watch out for ads on the sites that may advertise products frequently classified as a PUP (Potentially Unwanted Products). Thoroughly research any product advertised on the sites before you decide to download and install it.