Defender freezes when applying actions

[Guest]

Hello,

My problem is that Windows Defender will freeze when applying actions to
ignore or remove "spyware". It detected RealVNC and UltraVNC, two remote
control programs that I knowingly installed on my computer as part of the
Ultimate Boot CD package. They actually weren't even installed, the files
were just extracted to a folder on the hard drive, no registry keys were ever
created.

I did a scan with Defender and it detected the files from the Ultimate Boot
CD that contained RealVNC and UltraVNC. It lists them in the scan results
page fine, but no matter what action I choose, remove, ignore, quarantine or
always allow it will say "Applying Actions" and show the bar going but it
will never finish. It will just sit there doing nothing except for showing
the graphic. Again, the two programs aren't even spyware and they aren't
even installed, it's just the files sitting there. I don't care if i remove
or keep these files, but this does make me worry about what will happen if
defender ever detects any real spyware. Anyone have any ideas?

BMR777

 

[Bill Sanderson]

This isn't a great performance, for sure.

I would recommend just deleting the files involved, or the folder, if those
apps are the only ones in it. I'd be interested to see whether you have
trouble. Sometimes files from a CD may be marked read-only, but Windows
Defender should be able to handle that, I'd think. When running the removal
process, are you an administrator?

It's also possible that the program is, in fact, still active and doing some
form of search that takes a LONG time. You can also try doing the removal
after booting the computer in Safe mode, but all that seems harder than just
deleting the files yourself.

 

[Guest]

Hello,

I am running as an Admin. My point is that they're not even threats. Why
would Defender not allow me to IGNORE something? It hangs even if I go to
ignore the "threats" which I ideally would like to keep on my PC, especially
as some are inside of an ISO CD image that I need to keep.

BMR777

 

[Bill Sanderson]

You can configure Defender not to scan inside archive files--that would
allow you to leave the ISP CD image out there, and also speed up scanning.

VNC variants are listed as threats because they are apparently capable of
being installed in such a way that the owner or user of the machine is
unaware that they are present and in use. This issue comes up
regularly--most folks view these as admin tools, but they do have a darker
side.

I'm wondering whether the hang relates to something aside from the VNC
detection?

Have you tried running the scan/clean in safe mode? Have you tried running
the cleaning operation at the end of the day--just let it run and see
whether it completes in the morning?

I haven't seen this posted recently, but during the beta there were
situations where registry permissions that didn't allow an admin access
caused hangs, I believe. The admin could take ownership and change the
permissions, but the scanning code apparently was not capable of that.

I'm not sure whether there is any logging operation we could turn on that
might shed more light on what is happening, I haven't looked at this stuff
in a long time, and can't do it right now--maybe late this evening.

 

[Guest]

Well, I let it do it's thing under Ignore and it FINALLY worked. It sat for
about a half hour and then it crashed explorer.exe but it finally went
through and now it doesn't show the alert on the main Windows Defender screen.

I also set it to ignore that directory so this doesn't happen in the future.

Thank you so much for your help.
BMR777

 

[Bill Sanderson]

Thanks--glad to know that persistence paid off. There was an issue during
the beta which involved, as i recall it, LONG processing times when the app
needed to search through long text files--I can't remember the context
precisely, but sometimes leaving it overnight was needed. This seems
perhaps similar, but I don't have a clear picture on what the issue was on
your system--would there be, perhaps a very large DVD ISO? I've got a
number of DVD sized ISO's on my system, but I hardly ever do full scans.

 

[Guest]

The ISO was about 650 MB for a CD, nothing as big as a DVD, but it does have
a lot of files on it as it it for a Bootable System Recovery / Diagnostic CD.

BMR777