Windows Defender full scan identified Potentially Unwanted App Found - But it appears to be Windows Security - Is this real Windows App or Malware?

Question

Hi,

My name is Daniel. I was regularly performing a daily scan with Windows Defender on my system (Windows 11 Home Version 23H2). The OS build is 22631.4751.

I have not downloaded anything within the past 24 hours, and there were no threats detected in the previous 24 hours.

However, today (January 26, 2025 at 3:28 pm) I performed a Windows Defender Full Scan after updating it, and it lists 1 potentially unwanted app.

The strange thing is when I check, it would ask if I want the app to make changes to my device.

And it is:

Windows Security.

It states Verified Publisher: Microsoft Windows

CLSID: {6CED0DAA-4CDE-49C9-BA3A-AE163DC3D7AF}

Issued to: Microsoft Windows

Issued by: Microsoft Windows Production PCA 2011

Valid from 2023-11-16 to 2024-11-14

The Certification Path shows:

Microsoft Root Certificate Authority 2010

->Microsoft Windows Production PCA 2011

-->Microsoft Windows

Certificate Status:

This certificate is OK.

Is this a real Windows app?

Is Windows Security supposed to be the same as Windows Defender?

If it really is a real Windows app, then why is it listed under potentially unwanted apps?

And why is it asking me to make changes to my device / run it? I have not made any changes.

I also do not know how to eliminate this threat. It does not show any button to remove it.

How do I resolve this problem?

Thank you,

Daniel Wang

Answer 1

Dear Zev,

I think the problem may be resolved. Initially, I did not want to risk making the changes to my computer with the Windows Security yesterday.

So, I tried to temporarily install Malwarebytes to see if it would quarantine and remove the unwanted app. It did quarantine and remove it, but it turned out to be from an app I installed months ago called FileZilla. While Malwarebytes was installed, it said that there were no other threats.

Though when I uninstalled Malwarebytes, and turned Windows Defender back on to do a "Full Scan," there were multiple things that I had noticed.

1st, in the Full Scan, there were no threats / 0 threats found.

2nd, my Windows Defender App & Browser Control kept warning me (*Yellow triangle with exclamation mark sign) on the potentially unwanted app which should have been removed...

So, I tried going back to the Protection History and clicked on the sign which listed Potentially Unwanted App, and it would still mention, "Do you want to make changes to your computer?" with Windows Security.

I tried yes this time around, and instead it showed the attached image of a more detailed list of the app. It was the same app that Malwarebytes found.

Windows Defender gave me the option to try quarantine, remove, or allow it.

I tried to quarantine it, but it automatically updated to removed status as featured in the image.

Going by this information, would the problem be entirely resolved by now?

How can I delete the record of the unwanted app (now removed) within the Protection History?

Or will it go away on its own after a certain amount of time has passed?

Thank you for your help.

Sincerely,

Daniel Wang

Answer 2

Hi Daniel Wang,

Thanks for reporting this issue in Microsoft Community.

In your description, you ran a full scan with Windows Defender and found that it appears that “Windows Security” is listed as unneeded software.

I note that you have provided us with detailed hints, and I appreciate your efforts and attempts to resolve this issue, and I understand the confusion and frustration that the results of the current computer scan have caused you.

The first thing we need to answer you is that Windows Security is indeed a security application for Windows. On some systems (like the work machine I'm using), Windows Security also has the same functionality as Windows Defender to perform security scans for your computer.

Windows Security and Windows Defender are closely related components in modern versions of Windows; Windows Defender is the antivirus component, while Windows Security is the broader suite that includes Defender as well as other security features such as firewall and device security.

Is this computer currently owned by you personally? Is it subject to some policy management from your organization?

Or, are you using some third-party security software? Some policies or software may affect the detection mechanism of Windows Defender.

By checking your credentials, it also shows that Windows Security is legitimate.

You can try to update Windows Defender definitions.

Manually Update Defender Definitions

To ensure your Windows Defender has the latest security definitions, you can manually update them by visiting the Microsoft Security Intelligence and downloading the latest Security Intelligence updates. Follow the instructions on the website to install the newest definitions.

After this, you can try to perform a rescan.

Also, you can try setting “Windows Security” as an exception.

Anyway, if the current situation doesn't affect your usage particularly, you can ignore it for the time being.

Of course, if you are not sure about “Windows Security”, you can try to contact our online support staff.

Then ask our online support staff to help you check your scanned CLSID code.

1 Please click the following link

https://support.microsoft.com/en-us/contactus

Then sign in to your Microsoft account on the top right hand side.

Then click on the Windows icon below

 

2 Click on Get Home Support on the left hand side

 

3 Enter Technical support in the input box and then click on the Get Help button below

 

4 Click the Contact Support button at the bottom of the screen

 

5 Select Windows in Products & Services, then select Technical support in the category, then click the Confirm button below

 

6 Click on Chat with a support agent in your web browser inside

If you select a different category, you may be presented with a way to contact support agent by phone

 

If you see that Chat is currently unavailable, please try again at a time that meets the requirements.

7 Fill in your email address and click the confirm button below and a support agent will contact you with your information.

 

It's an honor to advise you, and I hope that my efforts will make things a little easier for you.

Thank you for your understanding and support.

Best regards,

Zev - MSFT | Microsoft Community Support Specialist