Windows Defender says "Potentially unwanted app found"

Windows 11 Pro. All up to date as of this morning.

Windows Defender is complaining about this:


I've tried to put it in Quarantine and I've tried to Remove it. Doesn't go away. I've looked at a couple dozen things on the internet that all say they KNOW how to get rid of AskToolbar, but they all say go to the Programs and Features in Control Panel and uninstall it.

There's NOTHING in Programs and Features. I had Agent Ransack do a search for "asktoolbar" and there's nothing on the drive. I had it search the WHOLE system for SBSE___.Q7Z and there's nothing ANYWHERE. Malwarebytes doesn't care about it. Ccleaner doesn't find it or get rid of it.

The FOLDER on the "R" drive where the SBSE file is supposed to be doesn't even exist.

HOW do I uninstall it or quarantine it or remove it or whatever I have to do to make Windows Defender stop whining about it?

I've found most times that rather than try to get rid of an identified program it's necessary to get rid of the file it is in. The extension of the file identified, Q7Z, suggests it's a compressed file.

Current version of Win11:

Version 21H2 has already reached End of Life:

If you can't find the Q7Z file on your drive, there may be a registry entry pointing to a non-existent file. Search your registry for AskToolBar.
If it finds an entry, delete it but continue searching the registry until the end because there may be more than one entry relating to AskToolBar.

Not likely since it's pointing to a file, but, for grins and giggles, check all your browser extensions as well.

AdwCleaner might help, too. AdwCleaner 2023 - Free Adware Cleaner & Removal Tool | Malwarebytes

I just had a bunch of updates Windows wanted to install this morning. I THOUGHT it was odd that it wanted to put 21H2 on again, but that's what it installed. I have no idea where 23h2 is or why windows update isn't installing it. 23H2 has only been out for a little while as far as I know, so maybe my Windows Update isn't picking it up yet.

I looked at doing it manually, but it wants 22H2 installed first, THEN 23H2... And as usual with Windows, ANY time you touch anything in there, THREE things can happen, and two of them are bad!

Maybe I'll see if Windows figures things out in a week or 2, and if it doesn't I'll try to brute force the thing.

Anyhow, nothing for asktoolbar in the registry.

Nothing found by the current version of adwcleaner.

When I ran Agent Ransack, one of the searches was for ANYTHING with Q7Z. Nothing anywhere.

This thing is still sitting here, like a t*rd in a punch bowl.

Check your browser extensions. The Ask Toolbar "program" usually installs as an extension to your browser and comes bundled with many not so reputable programs. Or even reputable programs where the author has decided that he/she can make a little bit of money distributing that questionable piece of software along with his/her app. Lots of developers bundle garbage with their apps, and there is usually a screen asking if you want to install the Ask Toolbar, but it's an opt-out scenario. If you miss the screen or don't unclick the box, it installs this garbage.

I had missed the box unclick when I was installing some app or other last year. The Ask Toolbar attached itself to my browser (Firefox). It was pretty easy to get rid of. You just uninstall the browser extension and then go into your extensions/plugins folder and delete everything that says "Ask".

It worked for me. I hope it works for you.

GracieAllen said:

I looked at doing it manually, but it wants 22H2 installed first, THEN 23H2... And as usual with Windows, ANY time you touch anything in there, THREE things can happen, and two of them are bad!

Click to expand...

As for that, I recall seeing somewhere that getting 22H2 is necessary for getting 23H2.

Just checked all the browsers. No unrecognized extensions in any of them. Definitely nothing for AskToolbar.

As for 23h2...... As always, it's going to be bizarre and messy if Windows Update doesn't find it.

I looked at putting 22h2 on, and instead they have a BAT file to run to RESET Windows update in the hope that it will decide 22H2 needs to be installed. Ran it, it didn't fail, so I presume it worked.

Checked for updates and it churned for an inordinately long time, then told me everything was current.

In theory, I can download 22H2 and install it, so I may give that a try.

1) get revo uninstaller portable and see if that toolbar shows up in there. If not you can install it and have revo uninstall it and delete all leftovers.

2) if you’re going to download and install a new build, just get the 23h2 iso and it’ll gather all required updates during upgrade, so you don’t have to waste time updating twice.

OK, it's now on 23H2, and as expected, it was the standard royal pain in the *SS....... Downloading the ISO wasn't a problem, but, after going through all the preliminary stuff, the popup would just DISAPPEAR. No error, no notice, no install, just gone......... So after wasting a couple hours trying that (it's not very quick checking for updates or whatever it's doing when nothing is going on and the software doesn't provide any information), then spending a couple MORE hours looking for somebody who could tell me WHY it didn't install, I finally found a topic that explained all the gyrations needed to get this thing from 21H2 to 23H2. Overall, it was pretty much the standard Windows 20 minute job that took half a day and 5 or 6 failures.

I THINK I may know where the AskToolbar thing CAME from. The domestic associate has a laptop. Every night a backup runs and copies information across the network to a hard drive on MY desktop system. And at 1 a.m. MY system does a backup to a hard drive.

The "potential problem" SAYS it's on MY hard drive. I suspect it came from HER system, which I'll have to go fix. But, that DOESN'T tell me why Windows Defender is having a hissy fit about something that doesn't appear to exist...

I installed Revo portable... What am I supposed to be seeing? 'Cause if it's "AskToolbar", Revo doesn't see it either. Is Revo supposed to be able to find the Q7Z file and get rid of it?

Ahh so this is on a network with other PCs? Run revo on hers and see what shows.

You can run Hunter mode on revo to choose the target to uninstall (has a crosshair instead of a mouse pointer, but if the file doesn’t exist you can’t target it).

GracieAllen said:

Is Revo supposed to be able to find the Q7Z file and get rid of it?

Click to expand...

Well you could try a search for... *.Q7Z

The * is a wild card. That search term will find any file on your computer with a .Q7Z file extension.

This is, like so many things, if you word it right.
From a command prompt:

C:\Windows\System32> dir /a/s "C:\*.Q7Z"

I just ran that command and it worked just fine, however I do not have that file on my C: drive.

Merry Christmas mates!
TM
PS: Search has very seldom ever worked for me, so I like to use DOS at an elevated command prompt when doing searches, or when deleting certain files, or group of files.

TechnoMage2021 said:

This is, like so many things, if you word it right.
From a command prompt:

C:\Windows\System32> dir /a/s "C:\*.Q7Z"

I just ran that command and it worked just fine, however I do not have that file on my C: drive.

Merry Christmas mates!
TM
PS: Search has very seldom ever worked for me, so I like to use DOS at an elevated command prompt when doing searches, or when deleting certain files, or group of files.

Click to expand...

good point! Microsoft search is meh. i use wox + everything. fast access and deep searches

I am an ardent fan of Everything by voidtools. It is an incredible search engine that I have used for years. I wouldn't be without it. It is freeware.

voidtools

Have a great day.

Regards,
Phil

I hate to break up the fun of this side trip into the land of "here's the best search tool" , but way back before I even posted the question, I ran searches through the whole system, including the current backup disk for the file. It didn't get found. BUT, just in case the DOS search IS better than Windows (which I agree it sometimes is), I checked both the "C" and "R" partitions (R being where Windows Defender SAYS it is):

C:\Windows\System32>dir /a/s "R:\*.Q7Z"
Volume in drive R is Pats Backup
Volume Serial Number is C1AF-E680
File Not Found

C:\Windows\System32>dir /a/s "c:\*.Q7Z"
Volume in drive C is System
Volume Serial Number is 58C1-2379
File Not Found

@GracieAllen ,

I am sorry to have offended you by suggesting an outstanding search tool. You were complaining that you could not find the file that Windows Defender was complaining about.

This could also be a false positive by Windows Security, but I would bet against that. The warning does not tell you that it found that the Ask Toolbar was installed on your computer, only that it found its installer and stopped the installation. It is telling you the installer's path and the file name it is in, which is a compressed file containing one or more files.

If you don't want to try Everything, that is your choice. I am out of here.

Have a great day.

Regards,
Phil

I'm not offended - I was laughing!

My question now is - if NOTHING has found a file or Asktoolbar anywhere on this system, WHY is Windows Defender continuing to whine? And more importantly, HOW do I make it STOP whining? 'Cause if nothing can find a file, and it's not doing anything,

I got the Microsoft Safety Scanner (MSERT) and ran that overnight on the entire system. Prior to going to bed it had been through around 750,000 files (about 25% of the system) and said 40 were "infected". This morning when it was done it only reported 1 problem file, and said it had been removed. It WASN'T the file reported by Windows Defender, which WD is still complaining about.

I'm thinking at this point that it's not a real thing and Windows Defender is going too complain about it permanently.

Try this. You would have to reset any exclusions afterwards. Reset Windows Security app in Windows 11 Tutorial

If it still squawks, you can always exclude the entire R:\Images folder.
Settings>Privacy & Security>Windows Security>Open Windows security>Virus & Threat Protection>Virus & Threat Protection Settings>Manage Settings>scroll down to Exclusions>add exclusion>folder

It’s complaining because there is a trace of it somewhere.

1) show hidden files, to include system protected and browse for it again.

2) if you use a better av, such as Webroot, it will quarantine it and you can choose right there to delete it or allow it. (Yes, I’m sure many others will have input about many other av)