A Question about Windows Security, i.e. Windows Defender

I just checked 6 systems running on my network. 3 of the systems show the Windows Security (Defender) Icon on the taskbar in the notification area by the clock, 3 don’t. Of the 3 systems that show the icon, 2 are 10 Pro, 1 is 10 Home. Of the 3 systems that don’t show the icon, 2 are 10 Pro, 1 is 10 Home. Windows Security is not listed on any of the systems under TURN SYSTEM ICONS ON OR OFF. The 3 systems that don’t display the icon, also don’t even list it under SELECT WHICH ICONS APPEAR ON THE TASKBAR. Windows Security does appear to be functioning correctly on all six systems. It’s just the icon that is a problem.

I have also discovered that the three systems that display the icon properly, list Windows Security in the startup folder in Task manager thus: [Windows Security notification icon – Microsoft Corporation - Enabled – Medium - C:\Windows\System32\SecurityHealthSystray.exe] In the three that don’t, Startup does have this [Program - [BLANK] - Enabled - Not Measured - Registry - "C:\Program" Files\WindowsDefender\MSASCuil.exe] NOTE: The file path is not given in the Home version. Because of where the closing “ are, this location doesn’t exist.

Now that I have discovered all this, how do I fix it so that the Icon displays properly?

Try3 said:

Gary,

The faulty references to MSASCuil are very old.
What Defender / Security entries are listed in Task manager, Processes & Task manager, Services?
I,m working on this. With 6 systems it may be confusing.
What Windows Version are these computers? See chart in original post
What Windows Defender version do they have? Find Windows Defender Antivirus Version in Windows 10
All are versions 4.18.2001.7
Have you tried SFC & DISM? Run SFC Command in Windows 10 Do note the need to be online if you run the DISM command. SFC reported no errors.
Have you tried Repair installs? Repair Install Windows 10 with an In-place Upgrade No. I'm hoping there is a simple cure such as a registry edit. Can do it if no easier choice is available.

Denis

Thanks for the reply. I'm still looking online also. Since Defender seems to be running on all systems, this isn't a critical issue, more of an irritation.

Gary

Garyw said:

Thanks for the reply. I'm still looking online also. Since Defender seems to be running on all systems, this isn't a critical issue, more of an irritation.

Check in Task Manager on the Start-up tab that the notification icon has not been disabled.



If it's enabled, then the icon may just be in the 'show hidden icons' box (it is hidden by default in a clean install).



If so, then you can click-and-drag it from there.. .to the taskbar:

Garyw said:

I have also discovered that the three systems that display the icon properly, list Windows Security in the startup folder in Task manager thus: [Windows Security notification icon – Microsoft Corporation - Enabled – Medium - C:\Windows\System32\SecurityHealthSystray.exe] ... Now that I have discovered all this, how do I fix it so that the Icon displays properly?

The registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run should contain a REG_EXPAND_SZ named SecurityHealth that contains the path %windir%\system32\SecurityHealthSystray.exe


If it's not there, create it and give it the correct path, or change it if it exists but has the wrong path.

Try3 said:

I cannot find a link to any of those innocuous malware-like sample files that could be used to demonstrate that your Windows defender is actually working..

You can make the EICAR standard test file with notepad. You can copy the text string from here...

The file is a legitimate DOS program, and produces sensible results when run (it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").
(note from Bree, it's a 16-bit app, so can only run on x86 W10)

It is also short and simple - in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor.

Intended use 0 EICAR - European Expert Group for IT-Security

Try3 said:

- It's still those incorrect " that are bugging me.

I agree, it's potentially a sign that malware has tried to change Defender-related registry entries .


A more benign explanation may be that the three working systems started life as clean installs of 1809 or later, while the three that don't have the icon were upgraded from 1803 or earlier.

The MSASCuil.exe file referred to in Task Manager did exist in W10 up to 1803 and was removed/replaced in 1809 and later. It could just be a sign of a poor upgrade.These things do happen...

...Missing Startup Software "%ProgramFiles%\Windows Defender\MSACuiL.exe"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run All users"
...System is newly upgraded to 1809 some days ago

Missing Startup Software

@Try3 and @Bree -
Ran Windows Defender Offline and Malware Byes on all 3 systems. No issues reported. I also ran fsc and dism on the 2 non VHD systems, with no issues reported.

@Bree "Check in Task Manager on the Start-up tab that the notification icon has not been disabled." 1st post - did not show up in task manager start tab. I ran the "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" on the 3 systems. Windows Security demolished the file on all three systems. I had forgotten about this file, I had used it a few years ago.

I patched the registry on all three systems per: The registry key Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run should contain a REG_EXPAND_SZ named SecurityHealth that contains the path %windir%\system32\SecurityHealthSystray.exe.
After rebooting, the icon re-appeared on all three systems.

The icon now seems to behave correctly, so I'm marking this SOLVED. Many thanks for your help!