At this point, Gene, no.

This appears to have been stopped in its tracks at the moment, so unless there's more "flare up" not too many people are likely to encounter it in the wild.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.

Considering the importance of this news, Brian, do you approve me placing it on the main list?

If you use Windows Defender or are using Windows 7 with Microsoft Security Essentials and are getting warnings about threats when you run Edge, Chrome, or any Chrome-based browser, don't worry about them.  Microsoft introduced a false positive this morning into its virus definitions.
https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-falsely-detects-win32-hivezy-in-google-chrome-electron-apps/

Gene

Hmmm heard about this, but I never got hit with this.

I was away for most of yesterday so maybe it had already been sorted.


On 5/09/2022 10:01 am, Gene wrote:

Considering the importance of this news, Brian, do you approve me placing it on the main list?

If you use Windows Defender or are using Windows 7 with Microsoft Security Essentials and are getting warnings about threats when you run Edge, Chrome, or any Chrome-based browser, don't worry about them.  Microsoft introduced a false positive this morning into its virus definitions.
https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-falsely-detects-win32-hivezy-in-google-chrome-electron-apps/

Gene

Another aside, but I think an important one:  this is also one of the huge benefits of OS (not just Windows, but in this case Windows) telemetry.

Microsoft does get telemetry reports about detections from Windows Security, and if there's a sudden massive uptick after a definition set is released, that is a clear indication that something's off.  There could be some uptick, but a sudden spate of positive detections on browsers would raise all sorts of red flags, and not about the browsers, particularly when one of them was Edge.

One of the great blessings of OS telemetry is that things that once would have been bad updates unleashed on the entire user base seldom get very far at all these days.  Even the ones that go pretty darned far generally don't ever come close to making it out to the entire Windows user base.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.

Considering the importance of this news, Brian, do you approve me placing it on the main list?

If you use Windows Defender or are using Windows 7 with Microsoft Security Essentials and are getting warnings about threats when you run Edge, Chrome, or any Chrome-based browser, don't worry about them. Microsoft introduced a false positive this morning into its virus definitions.
https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-falsely-detects-win32-hivezy-in-google-chrome-electron-apps/

Gene

You know brian, you actually bring up a super intresting point.

On a lot of the lists and software, etc I am always disabling the
background data sending services.

Not on everything, the new privacy guidelines in europe mean a lot of
companies actually explain what and why, however for ages now especially
with the china thing and the spying thing we have been told that most of
this getting data without concent is bad.

There are even hack tools to stop windows updating due to privacy concerns.

But yeah there are times where this data is actually good for a
responsable company.



On 5/09/2022 11:24 am, Brian Vogel wrote:

Another aside, but I think an important one: this is also one of the
huge benefits of OS (not just Windows, but in this case Windows)
telemetry.

Microsoft does get telemetry reports about detections from Windows
Security, and if there's a sudden massive uptick after a definition
set is released, that is a clear indication that something's off.
There could be some uptick, but a sudden spate of positive detections
on browsers would raise all sorts of red flags, and not about the
browsers, particularly when one of them was Edge.

One of the great blessings of OS telemetry is that things that once
would have been bad updates unleashed on the entire user base seldom
get very far at all these days. Even the ones that go pretty darned
far generally don't ever come close to making it out to the entire
Windows user base.
--

Brian -Windows 10, 64-Bit, Version 21H2, Build 19044

*/Nothing in all the world is more dangerous than sincere ignorance
and conscientious stupidity./*

~ Martin Luther King, Jr.

At this point, Gene, no.

This appears to have been stopped in its tracks at the moment, so unless there's more "flare up" not too many people are likely to encounter it in the wild.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.

On Tue, Sep 6, 2022 at 10:37 AM, Sarah k Alawami wrote:

As my system auto scans and I don’t ever check that but every few months Microsoft probably updated the database already.

-
The Windows Defender definition files are typically updated at least once per day, and often more often.  They were updated at least three or four times on the day this issue presented, and the issue was promptly extinguished.

I have not yet heard a single firsthand report of anyone being hit by this.  It's not that I doubt it happened, it did, but "the system worked" in preventing it from spreading like wildfire.  The problem was identified promptly and fixed promptly.  For most of the world, it was a complete non-issue since their definition update cycle was such that the corrupt definition file was never picked up for use.

Not everything becomes an immense conflagration.  This certainly didn't.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.

On Tue, Sep 6, 2022 at 01:07 PM, Gene wrote:

This is a first hand report. 

-
OK, that was not clear.

That being said, is it fixed now?

My point yesterday is that by the time the issue was even raised here the fix had been out for hours.  If you were not one of the unfortunate few who happened to have a definitions update cycle occur when the corrupted set was what was being fetched, you would never even have known this occurred.

One should only be putting warnings out about active issues.  And by the time this one was brought up here it was no longer active for anyone who had not previously been hit.  That means it's fixed, and does not warrant further warnings about.
 
I really don't think I was at all unclear on that concept from the outset.  At this point, all reports on this issue should be in the "historical" category.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.

On Tue, Sep 6, 2022 at 01:53 PM, Gene wrote:

Can Microsoft  release Windows Defender updates that are  installed more often than the program's usual daily update?

-
Actually, it's not uncommon for multiple definition updates to be released per day.  It all depends on what new detections occur "in the wild" and are confirmed, thus requiring a definition update to guard against them.

It is possible to reconfigure how often Windows Updates are checked for, but not through the standard user interface.  This is an admin thing.  See: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-protection-update-schedule-microsoft-defender-antivirus?view=o365-worldwide for additional details.

You can force a manual check just by opening Windows Security, Virus and Threat Protection, then activating the "Check for Updates" link in that pane.  Also, since this is handled via the regular Windows Update mechanism, you can simply open the Windows Update pane and manually trigger a check for updates.

Since the default intervals have worked, quite well, for years there is no logical reason to change them due to a one-off incident, in my opinion.  But it can be done if you want to dig in under the hood.

Windows Defender is not consistently in the top 10 products for antivirus/security suite testing labs, often the top 5 and beating out paid competitors, because it's not set up well.
--

Brian - Windows 10, 64-Bit, Version 21H2, Build 19044

Nothing in all the world is more dangerous than sincere ignorance and conscientious stupidity.

   ~ Martin Luther King, Jr.