I noticed that several exclusions are listed in Windows Defender that I didn't add myself, such as paths for certutil.exe, cmd.exe, and other files in the Windows Temp directory. I attempted to remove them through Windows Security and PowerShell (using Remove-MpPreference) but was unsuccessful. The only way I could eliminate them was by deleting them from the registry. Yet, they reappear after I restart my computer. I'm using a personal PC, not one managed by my university, and I'm not very tech-savvy. The points are: my account has admin privileges, Tamper Protection is off, and a Microsoft Defender Offline scan didn't offer clear results. I'm worried this might indicate a virus or that my PC is being externally controlled. What other antivirus solutions should I consider, and what steps should I take next?
1 Answer
It sounds like there could be a group policy set for these exclusions, especially if your PC has been connected to a school account at some point. Try searching for 'work' in the Start menu to see if your device is managed—that could explain the mystery exclusions. If you're unsure, check this video for guidance on how to find that info.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures