Microsoft Defender showing with special looking characters

Hello @de Fisser, Winifred ,

That indeed looks abnormal,

I would assume that your question is about Windows Defender, and that this behavior can happen because of a malicious scheduled task, startup entry, browser extension, compromised application, or another infected device or network location reintroducing a malware.

Check these ressources out:

• https://support.microsoft.com/en-us/defender/troubleshoot-problems-with-detecting-and-removing-malware
• https://support.microsoft.com/en-us/defender/getting-started-with-anti-malware-in-microsoft-defender

Otherwise, lookup relevant help articles by doing a search here: https://www.microsoft.com/en-us/windows/help-and-support

Regards,

Said

Is there any further information as to how this can happen? I have the same issue:

Our IT ran several scans, also checking if the service that is being run by this task is the legitimate ATP service. Nothing suspicious found. They came to the conclusion that this has to be a display bug in the name of this sensor version, but it feels strange, still.

I have the exact same issue.

Our IT ran several scans, also checking if the service that is being run by this task is the legitimate ATP service. Nothing suspicious found. They came to the conclusion that this has to be a display bug in the name of this sensor version, but it feels strange, still.

Has anyone found a different explanation for this?

I made a copy of the MsSense.exe to C:\Temp.

$orig = 'C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8839.26080.2008-0\MsSense.exe'

$copy = 'C:\Temp\MsSense_10.8839.26080.2008-0.exe'

Get-FileHash -LiteralPath $orig, $copy -Algorithm SHA256

Algorithm Hash Path

SHA256 01E76B91D291141B19238A0061CE7C97AD3AB03224CF473047D9955340E5BEAB C:\ProgramData\Microsoft\Wind...

SHA256 01E76B91D291141B19238A0061CE7C97AD3AB03224CF473047D9955340E5BEAB C:\Temp\MsSense_10.8839.26080...

(Get-Item -LiteralPath $orig).VersionInfo.FileDescription

Мΐčѓőѕóƒť Đ℮ƒėиđёг Đеŧе¢тίοň äηδ Яėşрõņŝ℮ Şĕŗνï¢ε

(Get-Item -LiteralPath $copy).VersionInfo.FileDescription

Microsoft Defender Detection and Response Service

How is this possible???

Heyo,

Just had this issue and had a full meeting about it with my Cyber Sec team at work.

Essentially what happened is that the Dev team pushed an update where they didn't deactivate the feature that highlights the application they are updating (it does this by making wacky text called qps-ploca).