Solved False Windows Defender download blocks?

I'm on 24H2 26100.3902. (I'm not an insider - updated with an ISO from UUPDump.net.)

I appear to be getting spurious download blocks. An example:


The download of version 824 is OK.

It's not the only block I've seen.

The AV detection occurs in both Edge and Chrome browsers.

Is this a feature, a bug, or sudden widespread infections on previously safe sites?

Both browsers use a reputation service to check downloaded binaries for malicious flagged content. For example Google owns Virus Total. These services are not flawless so it's possible it's one of the following

• a truly malicious file
• a false positive
• a dual-use binary (meaning it can be used for good or commonly used by threat actors)
• other

Just for fun, I disabled the Windows security protections and downloaded the file. I re-enabled the protections immediately after.

Defender deleted the file almost immediately. I didn't get time to do a Malwarebytes scan on it.

bobkn said:

Defender deleted the file almost immediately. I

Click to expand...

Does "Protection history" say what it detected?

I downloaded the portable beta version from SourceForge, checked it with VirusTotal, which was flagged, most likely heuristically, by a vendor, but the rest was green, including "Microsoft." Window defender didn't delete what I downloaded.