It turns out that Microsoft Defender mistakenly detects a text file with the text 'This content is no longer available' as a 'serious threat' and deletes it
Windows comes with Microsoft Defender, an antivirus software developed by Microsoft, which is said to provide powerful virus protection for general users without the need for a third-party security suite. However, a bug has been discovered in Microsoft Defender that causes it to treat certain text files as serious threats.
Microsoft Defender flags text file containing 'This content is no longer available.' as a severe threat | Tom's Hardware
https://www.tomshardware.com/software/antivirus/microsoft-defender-flags-text-file-containing-this-content-is-no-longer-available-as-a-severe-threat
Engineer yappy reported on X (formerly Twitter) that Microsoft Defender was malfunctioning due to a text file containing the message 'This content is no longer available.'
my gf just found out that a text file solely containing the string 'This content is no longer available.' trips up windows defender lol pic.twitter.com/8RyHW3nltV
— yappy 🍉 (@rari_teh) June 21, 2024
According to yappy, when Microsoft Defender detects a text file containing the text line 'This content is no longer available.' or 'This content is no longer available!', it flags the text file as a Trojan horse and deletes it from the system. This process is done quickly regardless of the file name, so on the surface it appears to be 'protected from potential 'serious threats'.'
Yappy initially speculated that the false positive was a collision in the cryptographic hash function SHA-256 .
oh my fucking god it's a sha256 collision lmfao pic.twitter.com/7CBVJt8pFH
— yappy 🍉 (@rari_teh) June 21, 2024
However, other X users pointed out that this was not a SHA-256 hash collision, but rather that a text file containing that line of text was uploaded to a malware database.
In a now deleted thread about this find by vxunderground, someone pointed out that it wasn't a SHA256 collision, but a case of someone uploading that exact text file to a malware database. The match is only a few bytes long and all checksums coincide.
— yappy 🍉 (@rari_teh) June 23, 2024
In fact, other security software did not detect it as a Trojan horse, and the false positives were a problem specific to Microsoft Defenders.
(and btw it is indeed only Microsoft) pic.twitter.com/gmWL7VRVn7
— yappy 🍉 (@rari_teh) June 22, 2024
'The bug isn't that serious. The text itself doesn't pose a threat to Windows 11, and changing the punctuation, adding a space at the end, or adding other text will eliminate the false positives,' said Tom's Hardware, an IT news site.
However, if you need to save a text file that contains the line 'This content is no longer available.' or 'This content is no longer available!', the file may be deleted unless you specify the save destination as an exception directory for Microsoft Defender scanning.
At the time of writing, the bug has not been fixed. Yappy responded to the official Windows X account on X, saying, 'fix yo shit.'
@windows fix yo shit
— yappy 🍉 (@rari_teh) June 21, 2024
◆ Forum is currently open
A forum related to this article has been set up on the official GIGAZINE Discord server . Anyone can post freely, so please feel free to comment! If you do not have a Discord account, please refer to the account creation procedure article to create an account!
• Discord | 'Have you ever had important files deleted due to a false positive by your antivirus software?' | GIGAZINE
https://discord.com/channels/1037961069903216680/1254726391585439816
Related Posts: