Windows Defender technical question?

[Mark Kaine]

So i had to change two of my hard-drive(s) - not the OS drive... and first thing "windows defender found threats!"

 

--> checking it was "hack tool, blah, blah, blah sledgehammer"...

 

 

ok --> "restore" --> immediately run sledgehammer  --> everything good, windows updates  DISABLED as it should be.

 

no warnings since. so the question is why in the world doesn't defender see it as a threat now, i haven't put sledgehammer in an exclude list or anything,  literally all i did was "restore" the file...?

 

is it something that sledgehammer does, maybe? (my defender exclusion list is empty however) 

 

 

note, also defender said "severe" and PUM or PUP?  weird how its suddenly not an issue anymore, right?

[Kilrah]

35 minutes ago, Mark Kaine said:

all i did was "restore" the file...?

If you restore it's pretty obvious you don't want it to be detected and blocked again 2 seconds later so it excludes it too...

[Mark Kaine]

2 hours ago, Kilrah said:

If you restore it's pretty obvious you don't want it to be detected and blocked again 2 seconds later so it excludes it too...

i agree that's very logical and kinda what you'd expect,  but it's not in the list of excluded files... neither is Cheat Engine which also gets occasionally detected - so I'm just wondering how that works internally. 

 

ps: maybe PUP style "viruses" don't get into the excluded list, but there still has to be some kind of hidden list somewhere because as said if i do a *full* scan with defender for example it will see cheat engine at least (but probably not sledgehammer) and put it in quarantine.  

 

quick scan finds neither usually.  

 

btw malwarebytes does exactly the same thing, "sometimes" it'll find cheat engine,  but usually not and I've never excluded it either.  

[Kilrah]

It puts the scan results somewhere since they're still in the history, and likely uses that in addition to the exclusion list

 

https://answers.microsoft.com/en-us/windows/forum/all/how-to-remove-a-protection-history-report-from/c73c5969-68fe-454e-833f-b602af0b175d

[Mark Kaine]

Got it, that makes a lot of sense - it had to be stored "somewhere", thanks!