Rimettere in quarantena un malware che è stata "consentita" dopo essere stata segnalata come minaccia

Addedum:

If the item is not listed in the "Allowed Threats", please do the following:

Open PowerShell (admin) and run the following command:

Get-MpPreference

Post a screenshot of the output window.

I checked the "Allowed threats" section as you suggested, but the list is completely empty. This is the core of my problem: I can't revoke the permission because the item doesn't appear there.

I have already tried a Full Scan, a Custom Scan on the specific folder, and even a Microsoft Defender Offline scan, but none of them detected the threat again. However, I keep getting the message saying that the scan skipped an item due to network scan settings.

The only place where I can still see the threat is in the Protection History. It shows as "Threat restored", and I can see the details of the file like the name Trojan:Win32/Kepav!!rfn, but I can't take any action or remove it from there anymore. The options to intervene are just gone.

Here is the Get-MpPreference info:

AllowDatagramProcessingOnWinServer : False

AllowNetworkProtectionDownLevel : False

AllowNetworkProtectionOnWinServer : False

AllowSwitchToAsyncInspection : True

ApplyDisableNetworkScanningToIOAV : False

AttackSurfaceReductionOnlyExclusions :

AttackSurfaceReductionRules_Actions :

AttackSurfaceReductionRules_Ids :

AttackSurfaceReductionRules_RuleSpecificExclusions :

AttackSurfaceReductionRules_RuleSpecificExclusions_Id :

BruteForceProtectionAggressiveness : 0

BruteForceProtectionConfiguredState : 0

BruteForceProtectionExclusions :

BruteForceProtectionLocalNetworkBlocking : False

BruteForceProtectionMaxBlockTime : 0

BruteForceProtectionSkipLearningPeriod : False

CheckForSignaturesBeforeRunningScan : False

CloudBlockLevel : 0

CloudExtendedTimeout : 0

ControlledFolderAccessAllowedApplications :

ControlledFolderAccessDefaultProtectedFolders : {N/A: Controlled Folder Access is disabled}

ControlledFolderAccessProtectedFolders :

DefinitionUpdatesChannel : 0

DisableArchiveScanning : False

DisableAutoExclusions : False

DisableBehaviorMonitoring : False

DisableBlockAtFirstSeen : False

DisableCacheMaintenance : False

DisableCatchupFullScan : True

DisableCatchupQuickScan : True

DisableCoreServiceECSIntegration : False

DisableCoreServiceTelemetry : False

DisableCpuThrottleOnIdleScans : True

DisableDatagramProcessing : False

DisableDnsOverTcpParsing : False

DisableDnsParsing : False

DisableEmailScanning : True

DisableFtpParsing : False

DisableGradualRelease : False

DisableHttpParsing : False

DisableInboundConnectionFiltering : False

DisableIOAVProtection : False

DisableNetworkProtectionPerfTelemetry : False

DisablePrivacyMode : False

DisableQuicParsing : True

DisableRdpParsing : False

DisableRealtimeMonitoring : False

DisableRemovableDriveScanning : True

DisableRestorePoint : True

DisableScanningMappedNetworkDrivesForFullScan : True

DisableScanningNetworkFiles : False

DisableScriptScanning : False

DisableSmtpParsing : False

DisableSshParsing : False

DisableTamperProtection : False

DisableTlsParsing : False

EnableControlledFolderAccess : 0

EnableConvertWarnToBlock : False

EnableDnsSinkhole : True

EnableFileHashComputation : False

EnableFullScanOnBatteryPower : False

EnableLowCpuPriority : False

EnableNetworkProtection : 0

EnableUdpReceiveOffload : False

EnableUdpSegmentationOffload : False

EngineUpdatesChannel : 0

ExclusionExtension :

ExclusionIpAddress :

ExclusionPath :

ExclusionProcess :

ForceUseProxyOnly : False

HideExclusionsFromLocalUsers : True

HighThreatDefaultAction : 0

IntelTDTEnabled : False

LowThreatDefaultAction : 0

MAPSReporting : 2

MeteredConnectionUpdates : False

ModerateThreatDefaultAction : 0

NetworkProtectionReputationMode : 0

OobeEnableRtpAndSigUpdate : False

PerformanceModeStatus : 1

PlatformUpdatesChannel : 0

ProxyBypass :

ProxyPacUrl :

ProxyServer :

PUAProtection : 1

QuarantinePurgeItemsAfterDelay : 90

QuickScanIncludeExclusions : 0

RandomizeScheduleTaskTimes : True

RealTimeScanDirection : 0

RemediationScheduleDay : 0

RemediationScheduleTime : 02:00:00

RemoteEncryptionProtectionAggressiveness : 0

RemoteEncryptionProtectionConfiguredState : 0

RemoteEncryptionProtectionExclusions :

RemoteEncryptionProtectionMaxBlockTime : 0

RemoveScanningThreadPoolCap : False

ReportDynamicSignatureDroppedEvent : False

ReportingAdditionalActionTimeOut : 10080

ReportingCriticalFailureTimeOut : 10080

ReportingNonCriticalTimeOut : 1440

ScanAvgCPULoadFactor : 50

ScanOnlyIfIdleEnabled : True

ScanParameters : 1

ScanPurgeItemsAfterDelay : 30

ScanScheduleDay : 0

ScanScheduleOffset : 120

ScanScheduleQuickScanTime : 00:00:00

ScanScheduleTime : 02:00:00

SchedulerRandomizationTime : 4

ServiceHealthReportInterval : 60

SevereThreatDefaultAction : 0

SharedSignaturesPath :

SharedSignaturesPathUpdateAtScheduledTimeOnly : False

SignatureAuGracePeriod : 0

SignatureBlobFileSharesSources :

SignatureBlobUpdateInterval : 60

SignatureDefinitionUpdateFileSharesSources :

SignatureDisableUpdateOnStartupWithoutEngine : False

SignatureFallbackOrder : MicrosoftUpdateServer|MMPC

SignatureFirstAuGracePeriod : 120

SignatureScheduleDay : 8

SignatureScheduleTime : 01:45:00

SignatureUpdateCatchupInterval : 1

SignatureUpdateInterval : 0

SubmitSamplesConsent : 1

ThreatIDDefaultAction_Actions :

ThreatIDDefaultAction_Ids :

ThrottleForScheduledScanOnly : True

TrustLabelProtectionStatus : 0

UILockdown : False

UnknownThreatDefaultAction : 0

Thanks. I checked each and every setting, and everything looks fine. There are no exclusions and no allowed threats. Please clear the Defender scan history to see if that resolves the issue.

Download the ClearDefenderHistory.bat from the link below:

https://github.com/LesFerch/ClearDefenderHistory

Run the file. Restart Windows to clear the Defender scan history.

---

Standard Disclaimer: There is a link to a non-Microsoft website. The page appears to provide accurate, safe information. Batch file contains plain-text contents which can be read using Notepad.