Windows Defender incorrectly reports threat in Volume Shadow Copy

[jhg6308]

In order to troubleshoot a network issue I downloaded netcat ncat.exe. Windows Defender classifies this as a "hack tool" and attempts to quarantine it. It is not malware, it is a network debugging tool with legitimate uses. I was able to whitelist the executable so Windows Defender does not complain about the actual file. However, it now appears in several Volume Shadow copies, so when my nightly backup runs, Windows Defender complains that it found a threat. It's been doing this every day for months. I tried cleaning up shadow copies as suggested several places on the web, but every time a

Continue reading...