1

Background

I'm on Windows 10 (Version 10.0.18363 Build 18363). I downloaded but did not install Metasploit (I'm a CSA). I forgot to add an exemption, and Windows Defender naturally unpacked and picked up on the hundreds of exploits in the msi package.

I decided, for the time being, to just delete the installer package from an Administrative Powershell console with -Force. The installer had already been quarantined, it seemed.

Now, even after another full scan, the no-longer-existant threats still appear as Pending Actions in Defender:

Virus and Thread Protection

I opened every single threat, chose Remove hit Start Actions (below):

Start Actions

The list instantly disappears, no action seems to be taken (e.g., the Antimalware Service Executable doesn't spike in CPU) but I still have an unclear warning:

There may be threats on this device : 0 threats found

There may be threats on this device - 0 threats found

Going back to Home and invoking See Threat Details under Virus and Threat Protection, the list is repopulated.

Clicking Start Actions on this tile has the same effect as above: the list is temporarily cleared, but cycling back shows them all again.

Virus and Threat Protection home tile

Problem

The threats no longer exist on my device and I just want to clear this list.

How am I supposed to do that?

msanford
  • 761

1 Answers1

0

For some reason, with no further action than what I described, waiting 2 days cleared the pending items and the tile has returned to a green checkmark, though they all still appear as "Remediation may be Incomplete" in the Protection History.

enter image description here

If anyone has a better explanation than "just wait" please do add it.

msanford
  • 761