19

I'm working in Visual Studio 2019 on Windows 10 and from time to time I've been getting this notification:

Security scan required

I don't use any 3rd-party antivirus or antimalware programs, so I gather it's coming from Windows Defender. The trouble is..

  • It doesn't tell me what item.
  • There's no apparent way to take any action, whether I approve this or not.
  • I've already tried excluding my code folder from Windows Defender, but that's made no difference so far.

How can I find out what item it's so concerned about? And what am I supposed to do with this notification?

  • What does the eventlog say? – LPChip Aug 08 '19 at 08:36
  • @LPChip I can't find anything in Windows Logs. I looked through many of the Applications and Services Logs and couldn't find anything there either. I also tried creating a custom view to see errors and warnings for all logs over a very limited time range (just a couple of minutes based on the time of the notification), but Event Viewer apparently couldn't handle it. –  Aug 08 '19 at 08:52
  • I managed to create a custom view for just Windows logs, and there was nothing relevant. –  Aug 08 '19 at 09:01
  • I bet you need to look in: Event Viewer > Applications and Services logs > Microsoft > Windows Defender > Operational – LPChip Aug 08 '19 at 09:54
  • 1
    @LPChip Actually it's Microsoft > Windows > Windows Defender, but thanks for the tip! Right there at the exact time of the warning I found: `Windows Defender Antivirus has uploaded a file for further analysis. Filename: C:\Users\[me]\AppData\Local\NCrunch\22372\11\QueueReruns\obj\Debug\netcoreapp3.0\[nameofmyapp].dll Sha256:` So it was the NCrunch build of the program I was working on. ...So now what do I do with the notification? –  Aug 08 '19 at 10:27
  • (I guess an obvious first step is to ignore that NCrunch folder in Defender.) –  Aug 08 '19 at 10:28
  • @LPChip Write your comments up into an answer and I'll accept it. I have reasonable suspicions that ignoring the NCrunch folder will solve the problem. Your tips helped me find it. –  Aug 08 '19 at 10:41
  • This item == the item currently being scanned. Misleading, but “normal”. Also had it with Go programming. – Daniel B Aug 08 '19 at 11:40
  • Ah, I missed the windows tread. I first went looking for if it was there, and once found it I quickly traced back the path, but missed one node... Glad you got to the end of it though... Wrote you an answer. :) – LPChip Aug 08 '19 at 11:40
  • @Kyralessa - If you are the only user on the machine, in other words it's a personal machine, do nothing with the informatin. If it's a company machine, contact your IT Administrator, to adjust the Windows Defender configuration. – Ramhound Aug 08 '19 at 12:04
  • Unfortunately, in my case, it is locking me from running the app because it is locking the MDF database. :-( Setting Windows Defender to exclude my source folders. – AdvApp Jan 30 '20 at 21:41
  • I have the same issue with the output (EXE) of my VS 2019 project. I get the notification sometimes and only when debugging the program. It is finding it in the ShadowCache and Windows Defender doesn't like it. From the Event log: Windows Defender Antivirus has uploaded a file for further analysis. Filename: C:\Users\[USER_NAME]\AppData\Local\Microsoft\VisualStudio\16.0_c91b605c\Designer\ShadowCache\[FUNNY_NAME]\[FUNNY_NAME]\[FILENAME].exe Sha256: b03abf7d2ed5a0a93e09cedb06f8d8c3930ab432a27a7548e32a74bc6663f765 – AdvApp Feb 13 '20 at 23:40

3 Answers3

17

I'd look in the eventlog to find out what the problem is.

The path would be: Event Viewer > Applications and Services logs > Microsoft > Windows > Windows Defender > Operational

LPChip
  • 59,229
  • 10
  • 98
  • 140
1

Following on from LPChip's helpful answer, I wanted to open this folder at will from a shortcut.

It turns out Event Viewer does have a command line syntax:

eventvwr /l:[log file path]

or

eventvwr /c:[channel name]

Right-clicking and accessing the Properties of a node in Event Viewer offers the Full Name (pass to /c:) and Log path (pass to /l:), which can be passed to the command line to open Event viewer on this node so I end up with this command for my shortcut:

C:\Windows\System32\eventvwr.exe /c:"Microsoft-Windows-Windows Defender/Operational"
Gaspard Leon
  • 21
  • 2
0

Are you sure it´s VS related? If not, and you´re using Office365, this could be the Office365 ATP. If this is the case, the information on this link will give you initial information on setting it up.

Jannis Alexakis
  • 251
  • 1
  • 3
  • I have the same issue and it is ONLY happening when I run VS2019 on my project. Been working on this for weeks and today it starts complaining everytime I attempt to build with database and Defender locks the database file so I can't access it. – AdvApp Jan 30 '20 at 21:40