SOLVED: -

I accused Microsoft falsely. A renamer virus commandeered my music computer, modified all system files, hide important files and renamed my ENTIRE VST programs.

Windows Defender went into defensive mode, and quarantined everything. Thinking that Windows lost it's mind, I thoughtlessly excluded infected files from being monitored. I became suspicious when USBs and external hard drives would not eject. Then, I noticed that files in USB and external hard drives had all been renamed.

The devastation was so extensive that it took 2 weeks to make the system operable. Basically, the only option was to clean, format and reinstall Windows. The difficult and painful process of reinstalling VSTs, and resetting everything was NEVER option. So, I tried to rescue my computer.

Even after cleaning the system, some operating System files resisted repair and restoration. And certain Apps would not work or reinstall because of corrupt Windows System files. Meanwhile, the problem was compounded by the fact that I was running Windows 11 on Windows 10 computer. And Windows Update cannot restore certain Windows 11 system files on Windows 10 computer.


I have managed to reinstall everything. I have also changed important login information. Marlwarebytes and Windows Safe Mode are truly underrated.






I woke up to an annoying sight. All my cracked Plugins were no longer activated. I checked Windows Defender, I saw a very long list of quarantined, blocked and removed threats. I have managed to restore and reinstall most of the VSTs, after disabling Widows Defender. However, Steinberg Plugins (Halion 7 and Hypersonic 2) are proving impossible to restore or reinstall. Also, I can no longer open WorPad documents. I am not sure what else to do to install Steinberg Steinberg Plugins. Meanwhile, Windows Defender is still running, even though I have disabled it with gpedit. Msc

 

Last edited: Apr 18, 2026 at 2:17 PM

Always add your VST3 folder, or whatever your main plugin folder is, to the exclusions list in Microsoft Defender. Disabling Defender isn’t the best way to prevent this, since Windows 11 updates can be very unpredictable. Even after major updates, this will help ensure your installed plugins don’t break.

 

3 words... Windows Super-Lite Image.

 

You need WUB and uninstall defender alltogether.
https://www.sordum.org/9470/windows-update-blocker-v1-8/
https://github.com/ionuttbara/windows-defender-remover
(just remove defender, not the other options, that would be a little too much)
Doing this for years now, started with 8 then 10 and now 11.
Defender never found any real threat. Only false positives.
Malware usually is socially engeneered (start this .exe to get acces to porn), and defender can't cure stupid anyways.

 

Yes, but you can get rid of that shit on a running machine, no need to start from scratch.

 

The key is to not install any of it to begin with - "Defender" firewall & "anti-virus" along with edge, all autonomous updating, ms store, etc, and all the rest of the malware that installs with an OEM image. There are plenty of third party replacements for those (on an internet connected machine) that DO NOT EXCHANGE TELEMETRY, or suck down worthless updates that change your machine config out from under you to suit microsoft. If you run a completely offline production machine then NONE of that crap is needed and it can all just hit the bit-bucket.

 

True, but most people already have a running system, plus there is a huge userbase who is scared of installing from scratch.
I don't unterstand why, but thats just how it is. For those WUB plus a DefenderUninstall-Script is an easy solution.
I personally would never use a stock installation, just like you, but there are a lot of people out there who do not wantt to deal with tech stuff.

 

I'm using this (free since last year) firewall manager since years with no issue. It supports rule groups and controls Windows firewall without need to uninstall it: https://www.tapatalk.com/groups/vistafirewallcontrol/

I'm not big fan of 3rd party Windows tweaks tools. You never know what it breaks and when.

 

When I noticed such behaviour in v24H2 after updating from 23H2 and the impossibility to restore the quarantined stuff like before, I returned to my latest image which still was v23H2 (using Acronis True Image; any couple of days I write a current system partition image; that's definitely worth the pain). After that I inhibited any further Windows update version newer than 23H2 via Group Policies. That might be a hint for people who don't want to completely uninstall Windows Defender.

The problem to install Windows from scratch isn't "fear". It's just the superannoying hassle to be occupied a couple of days with program installation and configuration stuff. That really sucks.

 

Last edited: Mar 30, 2026

No, that's not necessary if you have a current system partition image stored.

 

I have always found that a few R2R keygens need to be rerun, and 25H2 was no different.

Of COURSE it makes sense to exclude all your drives from Defender scanning except your OS drive, as you should already know & trust what those drives/folders contain, and of course exclude any folders which may contain cracks (usually a .dll in the Program Files folder,etc.),m and for that reason it makes sense to exclude all of Program Files folders, and why not ProgramData, too?

I DO exclude most OS drive folders from Defender scanning just to avoid potential lag, BUT I always allow Defender to monitor my normal downloads folder (different from my "alternative" downloads folder, which is on my archiving drive).
And also AppData folders get scanned, as that's where browsers tend to process stuff.

But I know of NO VST plugins that Defender would flag or quarantine.
I am not sure why you got a sunned bunch of quarantined items, but that is NOT normal.
Windows Defender will keep your excluded files & folder through updates.

A terrible solution for many people, just to get rid of Defender?

 

Honest question to you and all reading this: Has in your lifetime defender or any other pc antivirus ever found a real threat?
I asked that question in a hand full of threads and up to now noone ever wrote yes plus what it was.
I start: YES. 1989 a scanner found an SCA virus and a ByteBandit virus on some game disks I wanted to copy for my Amiga. That was the last time an antivirus solution was helpful. After that thousands of false positives and NOT ONE real postive. So for the last 15 years I go without any antivirus, I use jottis malware scanner for stuff I don't trust though.

 

I always go "naked".

In fact, I can't remember when was the last time I installed an antivirus... Oh, yes... It was back in 2007, I worked as an accountant for two restaurants. One of them, where my office was, waiters and cooks even my boss, went to the office off hours to watch some pr0n... One day, while I was working, everything was misbehaving, can't remember what exactly was but I remember that there was some kind of strange redirections while surfing internet (needed for the bank, email and such). I never knew what was happening because of course, nobody was telling me anything, keeping their sneaky trips to the office a secret.
Couple of days later, my boss came to the office because he wanted to check the bank with me and, obviously, it happened again: going to the bank url and there you are: some pr0n showing up, this time, on windows you could not close at all... Then, he tried to show himself as surprised, but in the end he told me what happened, because all that pr0n was straight and everybody knew I'm gay... Anyway, it wasn't too bad but not desireable for an office with its sensitive data and personal staff data, so I installed some nod32 or whatever it was and cleaned it, but... hey, this is what happens when you have braindead colleagues touching where they don't have to.

Now, after all this anecdote,
I have to say that Windows 11 is a pain in the ass regarding to antivirus. You can never deactivate it forever (I never could, even with that GPEDIT trick). If you deactivate it and restart windows, it reactivates itself. If you deactivate it and the computer stays too long on, it eventually gets back to its default position: ON.
This is one of the reasons why my headquarters for studio is in my Windows 10 desktop computer. No supervision for the viruses. After so many years using computers you end up knowing what you can do or not to stay safe.

 

Why make it so difficult? Just leave your installers and keygen double-packed as an archive, disable antivirus, just extract them when needed and install.

 

A naïve statement if ever. Its the only solution unless mickeysoft radically eliminates the need for spyware and telemetry embedded in its OS.

 

Took me ages to find this. It works very well in Windows 11:
https://github.com/ionuttbara/windows-defender-remover

 

Well, if you're on the internet zero a/v is probably not the best idea. But there's way better solutions than defender that are not going to exchange telemetry and false flag as much.