Solved HELP!! 911--Windows Defender False Positive? Free Diagnostic Software Detected as Infected

bikemanI7 said:

Well Then LockHunter Stops Responding when i hit Delete it with Tamper Protection off and Controlled Folder Access was already off

((this is in my Extra OneDrive Download folder copy on My 4TB Storage drive))

OneDrive copy successfully deleted earlier

Click to expand...

If nothing else works... you can use Autoruns to "stop" Defender from running.
Then delete the zip file then use Autoruns to start Defender again.

Set the "Options" like this...




UN-check the two items in the biggest RED box, and reboot.
Delete the zip file. Re-check those two boxes again and reboot again.

What does Protection history show when you expand it?

I've not used OneDrive in many years and wondered if it has something to do with it. Has it already synced and is already in the cloud backup? Worth logging in to your OneDrive account online to see if it's there and delete it there. Just guesswork though.

Gone in OneDrive just checked Online there

Might end up having to use AutoRuns Option, and hopefully it deletes then, and system is all good lol

When i have issues, i really have issues sadly

Attachment is what Defender says in Protection History, been like this since 1:30PM Lol

Tried Remove (no luck)
Tried Quaratine seemed to do nothing

((don't wanna hit Allow on Device, but thought about it if would clear Defender lock on the said Zipped Files))

**Then i gotta check all the externals to make sure dummy me didn't save another copy**

**Extra Download Copy Folder was on local drive as i just finished a system recovery with Macrium reflect not long ago to fix Bluetooth issue**

bikemanI7 said:

Gone in OneDrive just checked Online there

Might end up having to use AutoRuns Option, and hopefully it deletes then, and system is all good lol

When i have issues, i really have issues sadly

Attachment is what Defender says in Protection History, been like this since 1:30PM Lol

Tried Remove (no luck)
Tried Quaratine seemed to do nothing

((don't wanna hit Allow on Device, but thought about it if would clear Defender lock on the said Zipped Files))

**Then i gotta check all the externals to make sure dummy me didn't save another copy**

**Extra Download Copy Folder was on local drive as i just finished a system recovery with Macrium reflect not long ago to fix Bluetooth issue**

Click to expand...

Wait... did you try deleting it from your 'downloads' folder ?

Yes i did, that is the folder that won't remove lol---once that is gone, things should be fine i hope

Boot from windows installation media, troubleshoot > Cmd and then delete it via command. Then boot back to os

@dacrone
Will give that a shot in just a few minutes then, only thing i haven't tried yet

Tried safe Mode-didn't work
Tried from System Local Admin Account--No dice
Tried with LockHunter 3 times

Definitely not downloading anything i don't need anymore, definitely lesson learned for sure this time lol, plus just got Secondlife Game working perfect again and of course this happens

Extreme measure if all else fails i'll replace the entire 4TB storage drive lol, except not close to my birthday yet lol, so no card with funds available to purchase yet. Honestly the 4tB drive was originally suppose to be Backup drive, and would've kept my 1TB WD Black Internal inside desktop lol. ((I tend to download alot of junk with the available space to store it on with this 4TB lol))

When running Cmd from boot media, the os is dormant. The ways you tried were from inside the os

Ok will give that a shot asap here then

Update: File Finally Gone! used Cmd Force Delete file command

I assume Defenders Protection history will clear itself at some point correct?

If not I’m sure there’s a way with the registry somehow somewhere

bikemanI7 said:

Update: File Finally Gone! used Cmd Force Delete file command

I assume Defenders Protection history will clear itself at some point correct?

Click to expand...

Run a Manual Scan in Defender ?

Doing that now conducting Manual Full Scan, and should be all clear after that hopefully.

Been quite an afternoon flew lol, and still have to check the external drives to make sure no other copys of that zipped folder, but may do that tomorrow

Thank you everyone for the help and suggestions in the matter, Protection History list still shows a huge list, but a New Scan showed No New Threats ((so guess maybe tomorrow Protection History will autoly clear hopefully--Guess i'll find out in coming days lol.

Deleted File Immediately off Gaming Laptop that im using now while i finish a few more scans on PC 1 just to be sure its really clean lol, though i didn't extract the above mentioned zip file at all, so really shouldn't be really infected i don't think, but just in case conducting Malwarebytes Full scan just to be safe

No downloading anything i don't need anymore

**Defender History now cleared with Help of Safe Mode and Accessing Scans, Service Folder then History--deleting all in there cleared the entire list, as some of the items in the history folder showed Redemption incomplete, googled that error, and solved it myself lol. Conducting 1 more full scan, and then gonna do a Malwarebytes scan!! then gonna relax after that lol.

Tomorrow i'll check the externals lol

Lessons Learned Today
1. Don't Download anything and everything just cause have the space
2. Don't store just anything on Onedrive file storage area
3. Only use good utilities, and not some off the wall utilities
4. Make sure System Image backups are up to date--updating that tomorrow, might delete old one with that file inside it lol as well
5. Very very Appreciative of all the Great Online Support!!

bikemanI7 said:

4. Make sure System Image backups are up to date--updating that tomorrow, might delete old one with that file inside it lol as well

Click to expand...

Are you absolutely sure that program hasn’t done anything suspect. If you backup your system now, you take whatever it may of done with you. Do you have an image pre downloading and running the file? Or is that what you mean when you say

might delete old one with that file inside it lol as well

Click to expand...

Well i never extracted that Zip file at all, it was just sitting in OneDrive downloads folder, and also In Backup Copy of OneDrive Downloads on my 4TB Storage drive

Sadly i don't have an image pre downloading the file, wish i did, but drive only has so much space to backup 3 Systems, so it tends to not have Images too far back.

Backup drive is WD My Book 8TB

Systems backed up are
Main Desktop with M.2 Drive
Game SSD and 4TB storage drive

PC 2, Gaming Laptop
M.2 128GB Boot drive, and 1TB storage drive

PC 3, 1TB Sata SSD Boot drive

Are typically backed up monthly onto that drive

I'll do another scan with Malwarebytes (Full scan) soon as can here and make sure clean, and nothing wrong before i do another System Image.

Defender full scan and offline scan now show clean

Started Defender Scan at 12:30 for my weekly full scan, and it then detected that file as infected for the first time, file was on here since 12/4/2023

i'm sure the last backup image has the file in that backup

**If i do find anything wrong, then probably will do a complete clean install i suppose, not that really want to, but if its for the best if find anymore infected files, i swear i never extracted that 21GB Toolkit at all**

Ghot said:

@bikeman17



Unzipped it's 26GB... 5x bigger than Windows 11.
Inside the zip file... there's 502 password protected files.
64 files Bitdefender can't scan, and labeled threats.

It may be safe and someone is just serious about keeping their secrets safe.
To me though... it looks like a LOT of cracked software.


I could delete it completely.


For example... it had every backup software I've ever heard of. It had just about every software I've ever heard of that would help someone work on a computer.

Click to expand...

Yes this sounds like some seriously BAD software

Is it best I just do a clean install anyways tomorrow? And just restore Music from external and Documents folder with game profiles.

Or if I run Malwarebytes scan soon and it's clean..then I should be good right?

BrianInEngland said:

Yes this sounds like some seriously BAD software

Click to expand...

I don't "know" whether it's good or bad.
But because I can't tell for sure... I would give it a pass.

As I said, Bitdefender found 502 passworded files, and it quarantined 64 items.
And... it seems that on your computer, Windows Defender didn't like it either.
WD didn't like it so much, it wouldn't let it go to be deleted.

For me... that's just more trouble than it's worth.



I've probably said it 1000 times.
The secret to NOT having software problems is... backup software.

Like tonight. I personally, didn't like that Medicat software. But I had a look at it and then deleted it.
But "because" it had 502 passworded files and 64 quarantined items... even after I deleted it...
I restored from a backup, too. Just to be on the safe side.

THAT is why I don't have software problems. If I don't "know" for sure... I restore from a "full" backup.



On purpose, I only have about 35GB on my C:\ drive. That way, my "full" backups and restores only take about 2 minutes each. And because of that... I can use my backups as a tool, like I did tonight.

I don't play around with backup software... I'm very serious about it... These are all "full" backups...





There's really only two ways to keep your software running well and un-infected.
Backups or clean installs.