Windows Security · The Windows Security App · Lesson 5 of 5

Challenge: The Same Threat Every Night

Find out why Defender keeps catching something in the family PC's Downloads.

Five alerts in one week

Your sister's family shares one PC in the living room. She calls you on Sunday. "Windows Security keeps popping up. It says it found something in Downloads. Every night, the same thing."

You open Protection history. There are five entries this week, all for Trojan:Win32/FakeAlert. Each one says Quarantined. Each one points to a different file in Downloads, with names like "MegaCraft_skins_free.exe" and "skins_pack2.exe".

Her son Leo, who is eleven, admits he has been trying to get free skins for his favorite game. A video told him to download them from a site. Each time a file doesn't work, he downloads another one.

Your sister asks, "If Defender caught it, why does it keep coming back? Is the computer broken?"

A setting that looks wrong

Next you open Virus & threat protection and Manage settings. Real-time protection is on. Then you scroll down and see that Tamper Protection is off.

Under Exclusions, there is one entry: the whole Downloads folder. Nobody in the family remembers adding it. Leo says one of the skin "installers" asked him to click Yes on a few boxes.

Which scan now

You remove the Downloads exclusion and turn Tamper Protection back on. A quick scan comes back clean.

Still, something changed Defender's settings while it was looking the other way. Some malware hides itself while Windows is running. You want the scan that has the best chance of finding something that hides. Your sister has saved her open documents, and the family can spare the PC for a little while.

Keeping it from happening again

The offline scan finds and removes one more file. Protection history now looks quiet.

Your sister wants to stop this from happening again. Leo uses the PC on her account, which is an administrator. That is how he was able to click Yes on those boxes. You remember that SmartScreen also warned about two of the files, and he clicked Run anyway.