Solved Windows Security Scan - unknown threat detected

mrmatt · Aug 10, 2026

Just ran a full scan with Windows Security. It reported one threat found.

However, I've tried looking in Protection History. I've no idea what it thought it found, there's nothing showing.

Any ideas please ?

glasskuter · Aug 10, 2026

Restart and see if it appears in protection history.
Check event viewer- Applications and Services Logs >Microsoft > Windows > Windows Defender>→ Operational
Run another manual scan.

It may well have benn nothing of note.It could have been a harmless transient detection, false positive, or an auto-remediated item that never made it into Protection History

mrmatt · Aug 10, 2026

I wasn't even given any options as to what to do with it.

mrmatt · Aug 10, 2026

So..........

I've just restarted the PC, did another Full Scan.

Windows Defender reported that it 'took action against a threat'. But again no info. Why not ? I couldn't even see anything listed in Protection History again. So I followed your instructions.

Here is the log:

Code:

Log Name:      Microsoft-Windows-Windows Defender/Operational
Source:        Microsoft-Windows-Windows Defender
Date:          10/08/2026 17:14:38
Event ID:      1160
Task Category: None
Level:         Warning
Keywords:    
User:          SYSTEM
Computer:      DESKTOP-1BCOBNU
Description:
Microsoft Defender Antivirus has detected potentially unwanted application(PUA).
 For more information please see the following:
[URL unfurl="true"]https://go.microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/Rostpay&threatid=311954&enterprise=0[/URL]
     Name: PUABundler:Win32/Rostpay
     ID: 311954
     Severity: Low
     Category: Potentially Unwanted Software
     Path: file:_C:\Users\Wendy\Documents\Matt's Docs\driver-hub-install__28.exe
     Detection Origin: Local machine
     Detection Type: Concrete
     Detection Source: User
     User: DESKTOP-1BCOBNU\Wendy
     Process Name: Unknown
     Security intelligence Version: AV: 1.457.96.0, AS: 1.457.96.0, NIS: 1.457.96.0
     Engine Version: AM: 1.1.26070.7, NIS: 1.1.26070.7
Event Xml:
<Event xmlns="[URL]http://schemas.microsoft.com/win/2004/08/events/event[/URL]">
  <System>
    <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" />
    <EventID>1160</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2026-08-10T16:14:38.7938419Z" />
    <EventRecordID>14323</EventRecordID>
    <Correlation ActivityID="{c4d6cfc3-5c7e-4e6b-b03e-3d5ff1428b8b}" />
    <Execution ProcessID="5348" ThreadID="15516" />
    <Channel>Microsoft-Windows-Windows Defender/Operational</Channel>
    <Computer>DESKTOP-1BCOBNU</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Product Name">Microsoft Defender Antivirus</Data>
    <Data Name="Product Version">4.18.26070.9</Data>
    <Data Name="Detection ID">{69219CEF-182B-48CE-9F6C-040827FEAB8A}</Data>
    <Data Name="Detection Time">2026-08-10T16:14:38.739Z</Data>
    <Data Name="Unused">
    </Data>
    <Data Name="Unused2">
    </Data>
    <Data Name="Threat ID">311954</Data>
    <Data Name="Threat Name">PUABundler:Win32/Rostpay</Data>
    <Data Name="Severity ID">1</Data>
    <Data Name="Severity Name">Low</Data>
    <Data Name="Category ID">27</Data>
    <Data Name="Category Name">Potentially Unwanted Software</Data>
    <Data Name="FWLink">[URL='https://go.microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/Rostpay&threatid=311954&enterprise=0']Cyberthreats, viruses, and malware - Microsoft Security Intelligence[/URL]</Data>
    <Data Name="Status Code">1</Data>
    <Data Name="Status Description">
    </Data>
    <Data Name="State">1</Data>
    <Data Name="Source ID">1</Data>
    <Data Name="Source Name">User</Data>
    <Data Name="Process Name">Unknown</Data>
    <Data Name="Detection User">DESKTOP-1BCOBNU\Wendy</Data>
    <Data Name="Unused3">
    </Data>
    <Data Name="Path">file:_C:\Users\Wendy\Documents\Matt's Docs\driver-hub-install__28.exe</Data>
    <Data Name="Origin ID">1</Data>
    <Data Name="Origin Name">Local machine</Data>
    <Data Name="Execution ID">0</Data>
    <Data Name="Execution Name">Unknown</Data>
    <Data Name="Type ID">0</Data>
    <Data Name="Type Name">Concrete</Data>
    <Data Name="Pre Execution Status">0</Data>
    <Data Name="Action ID">9</Data>
    <Data Name="Action Name">Not Applicable</Data>
    <Data Name="Unused4">
    </Data>
    <Data Name="Error Code">0x00000000</Data>
    <Data Name="Error Description">The operation completed successfully. </Data>
    <Data Name="Unused5">
    </Data>
    <Data Name="Post Clean Status">0</Data>
    <Data Name="Additional Actions ID">0</Data>
    <Data Name="Additional Actions String">No additional actions required</Data>
    <Data Name="Remediation User">
    </Data>
    <Data Name="Unused6">
    </Data>
    <Data Name="Security intelligence Version">AV: 1.457.96.0, AS: 1.457.96.0, NIS: 1.457.96.0</Data>
    <Data Name="Engine Version">AM: 1.1.26070.7, NIS: 1.1.26070.7</Data>
  </EventData>
</Event>

I've there decided against using it, and deleted it. It's not really a virus, but Windows Security doesn't trust it.

Thank you very much for your reply. Very informative, very helpful. I didn't know that. At least hopefully I'll remember for in the future. I don't know why MS makes that info difficult to find though.

Try3 · Aug 10, 2026

@Bree,

I have never heard of an EventID 1160 as posted above. Have you?

I thought PUAs would be recorded as EventID 1117.
Defender EventIDs - MSLearn does not list 1160 but it clearly does exist.
There's nothing in the discussion at Block PUAs - MSLearn either.
[My event logs do not contain any 1160s.]

Any thoughts? Possibly specific EventID for a PUA detection during scanning that Defender has identified as a false detection even before the scan has completed???

Denis

Try3 · Aug 10, 2026

mrmatt said:
Windows Security doesn't trust

Potentially unwanted applications [PUAs] are not distrusted as such.

They are things that Defender thinks may have been copied to your computer without your explicit agreement - this does not seem to be as common as it used to be. Installing some common utility a decade ago used to require careful examination of every dialog to make sure your consent to some useless additional utility was not being assumed.

I'm glad you raised this topic. I had no idea that PUA detections were not shown in Protection history.

Denis

mrmatt · Aug 10, 2026

Try3 said:
Potentially unwanted applications [PUAs] are not distrusted as such.

They are things that Defender thinks may have been copied to your computer without your explicit agreement - this does not seem to be as common as it used to be. Installing some common utility a decade ago used to require careful examination of every dialog to make sure your consent to some useless additional utility was not being assumed.

I'm glad you raised this topic. I had no idea that PUA detections were not shown in Protection history.

Denis

It was my choice to download it in the first place. I consented to it. I saw it on MajorGeeks, and thought about trying it.

I've just ran another full scan after deleting it, and this time the scan reported no threats detected.

I'm still generally careful and vigilant though, although I slip up occasionally. I've learned the hard way over the years.

Thank you once again.

Bree · Aug 10, 2026

Try3 said:
@Bree,

I have never heard of an EventID 1160 as posted above. Have you?

I thought PUAs would be recorded as EventID 1117.
Defender EventIDs - MSLearn does not list 1160 but it clearly does exist.
There's nothing in the discussion at Block PUAs - MSLearn either.
[My event logs do not contain any 1160s.]

Any thoughts? Possibly specific EventID for a PUA detection during scanning that Defender has identified as a false detection even before the scan has completed???

Denis

My event log doesn't have any 1160s either, but it is the correct Event ID for PUAs

Microsoft said:
PUA events are recorded under event ID 1160.

Block potentially unwanted applications with Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Enable the potentially unwanted application (PUA) antivirus feature to block unwanted software such as adware.

learn.microsoft.com

Try3 · Aug 10, 2026

I guess I'll have to learn to read before posting again.

Denis

glasskuter · Aug 10, 2026

I asked co-pilot about event 1160 and its answer
"
"Event 1160 is triggered when Defender’s PUA protection is enabled and a program meets Microsoft’s criteria for unwanted behavior. This includes:
Bundled installers
Browser hijackers
Ad-injectors
“Optimizer” or “cleaner” tools with deceptive behavior
Software that modifies system settings without clear consent

One can configure how defender handles PUAs using group policy or powershell.
PUA protection OFF (value 0) - Defender will not protect against PUAs
PUA protection ON (value 1)- Detected items are blocked. They'll show in history along with other threats.
PUA protection in AuditMode (value 2)- detects potentially unwanted applications but takes no action. You can review information about the applications Microsoft Defender Antivirus would've taken action against by searching for events created by Microsoft Defender Antivirus in the Event Viewer.

I got these values here Block potentially unwanted applications with Microsoft Defender Antivirus - Microsoft Defender for Endpoint.

Solved Windows Security Scan - unknown threat detected

Member

My Computer My Computer

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

aka Mama Glass

My Computers My Computers

At a glance

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers