Fix: Windows Defender Detects Virus in Chrome Browser Cache

If you are using Google Chrome as your browser, you may encounter a problem where Windows Defender detects a virus on your Chrome browser cache. This can be annoying and frustrating, especially if you are trying to download a file or access a website that you trust. In this blog post, we will explain what causes this issue and how to fix it.

What Is Chrome Browser Cache?

Chrome browser cache is a temporary storage space where Chrome saves some data from the websites you visit. This data can include images, scripts, stylesheets, and other files that help load the web pages faster and improve your browsing experience. Chrome browser cache also saves your preferences and settings for some websites, such as your login information, language, and theme.

Why Does Defender Detect Virus on Chrome Browser Cache?

There are several possible reasons why Defender detects virus on Chrome browser cache. One reason is that some websites may contain malicious code or ads that try to infect your computer with malware. When Chrome saves these data in the cache, Defender may flag them as suspicious and block them from running. Another reason is that some files in the cache may be corrupted or outdated, which can cause Defender to misidentify them as threats. A third reason is that there may be a conflict between Defender and Chrome’s security features, such as Safe Browsing or security extensions.

How to Fix Defender Detecting Virus on Chrome Browser Cache?

To fix Defender detecting virus on Chrome, you can try the following methods:

• Switch to a browser with built-in security features. Some browsers, such as Microsoft Edge or Firefox, have their own security features that can protect you from malicious websites and downloads. You can use these browsers instead of Chrome to avoid the issue.
• Unblock Chrome and restore quarantined files. If Defender has blocked Chrome from running or quarantined some files from the cache, you can unblock them and restore them to their original locations. To do this, open Windows Security and go to Virus & threat protection > Protection history. Find the items related to Chrome and click on Allow or Restore.
• Disable Windows Defender. If you are sure that the files in the cache are safe and you trust Chrome’s security features, you can disable Windows Defender temporarily to stop it from interfering with Chrome. To do this, open Windows Security and go to Virus & threat protection > Manage settings. Turn off the Real-time protection toggle. Remember to turn it back on when you are done using Chrome.
• Scan for PUP using a dedicated tool. PUP stands for potentially unwanted programs, which are software that may harm your computer or privacy in some way. Some PUP may hijack your browser settings or redirect you to unwanted ads or websites. To scan for PUP, you can use a dedicated tool such as Malwarebytes or AdwCleaner. These tools can detect and remove PUP from your computer and restore your browser settings.
• Turn off Chrome Safe Browsing. Safe Browsing is a feature in Chrome that warns you about dangerous websites and downloads. However, sometimes it may block legitimate files or websites that are falsely detected as harmful. To turn off Safe Browsing, open Chrome and go to Settings > Privacy and security > Security. Select No protection (not recommended).
• Ensure the file you’re downloading is safe. Even when downloading a file from a legitimate source, it’s imperative to ensure it is safe to download. Follow the below steps to ensure the file is virus-free: Visit VirusTotal’s official website. Copy the download link of the file you are having trouble downloading. Paste it in the URL tab of VirusTotal and click on Analyze URL. Wait for the results to show up. If the file is clean, you will see a green message saying “No engines detected this URL”. If the file is infected, you will see a red message saying “X engines detected this URL”, where X is the number of antivirus engines that detected the file as malicious.
• Does the issue pertain to a particular file? If the issue only occurs when you try to download a specific file, it may be because the file is corrupted or has a false positive detection by Defender. You can try to download the file from another source or contact the file owner for assistance.
• Disable any security extensions. Some security extensions in Chrome may conflict with Defender or Safe Browsing and cause false alarms. You can try to disable any security extensions you have installed in Chrome and see if that solves the issue. To disable extensions, open Chrome and go to More tools > Extensions. Find the extension you want to disable and toggle off the switch next to it.
• Exclude the Downloads folder from Windows Defender. If you frequently download files from the internet, you may want to exclude the Downloads folder from Windows Defender’s scan. This can prevent Defender from blocking or deleting your downloaded files. To exclude the Downloads folder, open Windows Security and go to Virus & threat protection > Manage settings > Add or remove exclusions. Click on Add an exclusion and select Folder. Browse to the Downloads folder and click on Select Folder.
• Add the file to Windows Defender’s whitelist. If you are sure that the file you are trying to download is safe and you want to keep it on your computer, you can add it to Windows Defender’s whitelist. This will prevent Defender from scanning or deleting the file in the future. To add the file to the whitelist, open Windows Security and go to Virus & threat protection > Manage settings > Add or remove exclusions. Click on Add an exclusion and select File. Browse to the file you want to whitelist and click on Open.
• Temporarily disable Microsoft Defender Firewall. Microsoft Defender Firewall is a feature that helps protect your computer from unauthorized network access. However, sometimes it may block some legitimate network activities, such as downloading files from the internet. To temporarily disable Microsoft Defender Firewall, open Windows Security and go to Firewall & network protection. Click on your active network profile and turn off the Microsoft Defender Firewall toggle. Remember to turn it back on when you are done using Chrome.

If you suspect your device is infected with malware, you can use the free malware removal guide below to remove all infections from your it.

Malware Removal Guide

• STEP 1: Use Rkill to terminate malicious processes
• STEP 2: Uninstall malicious programs from your computer
• STEP 3: Remove malicious browser policies from Windows
• STEP 4: Remove malicious files and folders from Windows
• STEP 5: Reset your browser settings to their defaults
• STEP 6: Use Malwarebytes to remove trojans and browser hijackers
• STEP 7: Use HitmanPro to scan your computer for rootkits and other malware
• STEP 8: Use AdwCleaner to remove adware and malicious browser policies

STEP 1: Use Rkill to terminate malicious processes

In this first step, we will download and run Rkill to terminate malicious processes that may be running on your computer.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKILL DOWNLOAD LINK
   (The above link will open a new page from where you can download Rkill)

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 2: Uninstall malicious programs from your computer

In this second step, we will manually check if any unknown or malicious programs are installed on the computer. Sometimes adware and browser hijackers can have a usable Uninstall entry that can be used to remove them.

Now that the malicious programs have been removed from your computer, we can proceed with the next step in this guide.

STEP 3: Remove malicious browser policies from Windows

In this third step, we will download the Chrome Policy Remover file (credits to Stefan Van Damme) and remove the malicious browser policies. .

1. 
   

   Download the Chrome Policy Remover.

   
   

   Download the “Chrome Policy Remover for Windows” file from the below link. This file is a batch script designed to automatically remove Chrome policies.

   

   CHROME POLICY REMOVER DOWNLOAD LINK
   (The above link will download delete_chrome_policies on your computer.)
   
   

   Note: Windows might display a security warning because the file is a batch script (.bat). This is a standard security measure. Since the Chrome Policy Remover is a trusted tool, clicking “Keep” allows you to proceed with the download.

2. Right-click “delete_chrome_policies.bat” file and select Run as administrator

   We will now run the “delete_chrome_policies.bat” fiel as administrator.Running the delete_chrome_policies file as administrator grants it the necessary permissions to modify system settings related to Chrome policies. This ensures the tool can effectively remove the policies.

   

3. Click Yes/Run at the confirmation prompt and allow the process to complete.

   Windows will ask for confirmation before allowing the script to make changes. Clicking “Yes” or “Run” (depending on your Windows version confirms your intent to run the tool and remove the Chrome policies. The script will then run and automatically remove the policies, after which you can close the command prompt window.

   
   

   

Now that the malicious policies were removed, in the next step, we will reset your browser settings to their defaults.

STEP 4: Remove malicious files and folders from Windows

In this fourth step, we will manually search and remove malicious scheduled tasks and folders on your computer.

1. Delete malicious scheduled tasks.

This infection may create a malicious scheduled task in the Task Scheduler to ensure that it is automatically reinstalled every 5 minutes after it has been deleted. This task may run at regular intervals to ensure that the infection persists on your system.

1. Search for “Task Scheduler” in the windows search as shown below..
   You can also open the Task Scheduler app by pressing the Windows + R buttons and then type “taskschd.msc” and press Enter.
2. In the Task Scheduler window, navigate to the Task Scheduler Library on the left side of the screen.
3. Locate the malicious scheduled task in the list of tasks. It may have a randomly generated name (eg. Chrome_Policy, Chrome_Bookmarks, Chrome_Folder) or may be identified as a suspicious or unknown task. Right-click on the malicious task and select “Delete” from the menu.

2. Delete malicious files located in AppData\Roaming folder

We will now delete the malicious file that is located in the AppData\Roaming folder.

1. Search for “Run” in the windows search as shown below, or press the Windows + R button to open the Run app.
2. In the run app text box, enter “%AppData%” and click OK. Windows will directly open up the Roaming folder which is inside the AppData folder.
   

   

3. In the AppData\Roaming folder, search and delete any unknown folders with names like Default, Chrome32, Energy, Bloom, and Travel (note that the actual name on your computer may be different, but you should look for programs with similar naming conventions).

3. Delete malicious files located in AppData\Local folder

Next, we will delete the malicious folders that are located in the AppData\Local folder and the malicious Chrome browser extensions.

1. Search for “Run” in the windows search as shown below, or press the Windows + R button to open the Run app.
2. In the run app text box, enter “%localappdata%” and click OK. Windows will directly open up the AppData\Local folder which is inside the AppData folder.
   

   

3. In the AppData\Local directory, search and delete the Default, WindowsApp and ServiceApp folders.

   Next, find the Google folder and go to Google > Chrome > User Data > Default (or Profile) > Extensions. Find the malicious extension folder within the Extensions folder and delete it. It may have a randomly generated name or may be identified as a suspicious or unknown extension.

   

4. Remove Chrome Shortcut Modification

This malware can hijack your browser shortcuts to target the malicious files. Here is a short guide on how to remove the Chrome shortcut modification:

1. Right-click on the Google Chrome shortcut on your desktop or Start Menu and select “Properties“.
2. Under the Shortcut tab, look for the “Target” field. This is where any added commands to the shortcut will be. Carefully examine the target path and remove any suspicious looking text that may have been appended, especially anything referencing the AppData folder.
   For example, remove text like “–load-extension=C:\Users%USERNAME%\AppData\Local\Default”.
   The target should point only to the chrome.exe file location, nothing more.
3. Click OK to save the changes and close Properties.
4. Launch Chrome again normally through the shortcut. The extension should no longer load on start up.

You can also right click the shortcut and select “Open File Location” to open the chrome.exe folder. Drag chrome.exe directly to your taskbar to create a clean shortcut.

Now that we have manually removed the malicious tasks and folders from your computer and cleaned your browser shortcuts, we can continue with the next step.

STEP 5: Reset your browser settings to their defaults

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 6: Use Malwarebytes to remove trojans and browser hijackers

In this step, we will install and run a scan with Malwarebytes Free to remove any infections, adware, or potentially unwanted programs that may be present on your computer.

Malwarebytes stands out as one of the leading and widely-used anti-malware solutions for Windows, and for good reason. It effectively eradicates various types of malware that other programs often overlook, all at no cost to you. When it comes to disinfecting an infected device, Malwarebytes has consistently been a free and indispensable tool in the battle against malware. We highly recommend it for maintaining a clean and secure system.

1. Download Malwarebytes for Windows

   You can download Malwarebytes by clicking the link below.

   

   MALWAREBYTES FOR WINDOWS DOWNLOAD LINK
   (The above link will open a new page from where you can download Malwarebytes)
2.  

   Install Malwarebytes

   After the download is complete, locate the MBSetup file, typically found in your Downloads folder. Double-click on the MBSetup file to begin the installation of Malwarebytes on your computer. If a User Account Control pop-up appears, click “Yes” to continue the Malwarebytes installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   When the Malwarebytes installation begins, the setup wizard will guide you through the process.

   • You’ll first be prompted to choose the type of computer you’re installing the program on—select either “Personal Computer” or “Work Computer” as appropriate, then click on Next.

     

   • Malwarebytes will now begin the installation process on your device.

     

   • When the Malwarebytes installation is complete, the program will automatically open to the “Welcome to Malwarebytes” screen.

     

   • On the final screen, simply click on the Open Malwarebytes option to start the program.

     

4. Enable “Rootkit scanning”.

   Malwarebytes Anti-Malware will now start, and you will see the main screen as shown below. To maximize Malwarebytes’ ability to detect malware and unwanted programs, we need to enable rootkit scanning. Click on the “Settings” gear icon located on the left of the screen to access the general settings section.

   

   In the settings menu, enable the “Scan for rootkits” option by clicking the toggle switch until it turns blue.

   

   Now that you have enabled rootkit scanning, click on the “Dashboard” button in the left pane to get back to the main screen.

5. Perform a Scan with Malwarebytes.

   To start a scan, click the Scan button. Malwarebytes will automatically update its antivirus database and begin scanning your computer for malicious programs.

   

6. Wait for the Malwarebytes scan to complete.

   Malwarebytes will now scan your computer for browser hijackers and other malicious programs. This process can take a few minutes, so we suggest you do something else and periodically check the status of the scan to see when it is finished.

   

7. Quarantine detected malware

   Once the Malwarebytes scan is complete, it will display a list of detected malware, adware, and potentially unwanted programs. To effectively remove these threats, click the “Quarantine” button.

   

   Malwarebytes will now delete all of the files and registry keys and add them to the program’s quarantine.

   

8. Restart your computer.

   When removing files, Malwarebytes may require a reboot to fully eliminate some threats. If you see a message indicating that a reboot is needed, please allow it. Once your computer has restarted and you are logged back in, you can continue with the remaining steps.

   

STEP 7: Use HitmanPro to scan your computer for rootkits and other malware

In this next step, we will scan the computer with HitmanPro to ensure that no other malicious programs are installed on your device.

HitmanPro is a second-opinion scanner that takes a unique cloud-based approach to malware scanning. HitmanPro scans the behavior of active files and also files in locations where malware normally resides for suspicious activity. If it finds a suspicious file that’s not already known, HitmanPro sends it to its clouds to be scanned by two of the best antivirus engines today, which are Bitdefender and Kaspersky.

Although HitmanPro is shareware and costs $24.95 for 1 year on 1 PC, there is no limit on scanning. The limitation only kicks in when there is a need to remove or quarantine detected malware by HitmanPro on your system and by then, you can activate the one-time 30-days trial to enable the cleanup.

1. Download HitmanPro.

   You can download HitmanPro by clicking the link below.

   HITMANPRO DOWNLOAD LINK
   (The above link will open a new web page from where you can download HitmanPro)

2. Install HitmanPro.

   When HitmanPro has finished downloading, double-click on “hitmanpro.exe” (for 32-bit versions of Windows) or “hitmanpro_x64.exe” (for 64-bit versions of Windows) to install this program on your computer. In most cases, downloaded files are saved to the Downloads folder.

   

   You may be presented with a User Account Control pop-up asking if you want to allow HitmanPro to make changes to your device. If this happens, you should click “Yes” to continue with the installation.

   

3. Follow the on-screen prompts.

   When HitmanPro starts you will be presented with the start screen as shown below. Click on the “Next” button to perform a system scan.

   

   

4. Wait for the HitmanPro scan to complete.

   HitmanPro will now begin to scan your computer for malicious programs.
   

5. Click on “Next”.

   When HitmanPro has finished the scan, it will display a list of all the malware that it has found. Click on the “Next” button to have HitmanPro remove the detected items.

   

6. Click on “Activate free license”.

   HitmanPro may now require to activate the free 30-days trial to remove the malicious files. To do this, click on the “Activate free license” button to begin the free 30 days trial and remove all the malicious files from your computer.
   

   When the malware removal process is complete, it will display a screen that shows the status of the various programs that were removed. At this screen, you should click on the Next button and then if prompted you should click on the Reboot button. If HitmanPro does not prompt you to reboot, please just click on the Close button.

STEP 8: Use AdwCleaner to remove adware and malicious browser policies

In this final step, we will download and install AdwCleaner to remove the malicious browser policies that were set by browser hijackers on your computer and delete malicious browser extensions.

AdwCleaner is a free popular on-demand scanner that can detect and remove malware that even the most well-known anti-virus and anti-malware applications fail to find. This on-demand scanner includes a lot of tools that can be used to fix the side effects of adware. browser hijackers and other malware.

1. Download AdwCleaner.

   You can download AdwCleaner by clicking the link below.

   

   ADWCLEANER DOWNLOAD LINK
   (The above link will open a new web page from where you can download AdwCleaner)

2. Double-click on the setup file.

   Double-click on the file named “adwcleaner_x.x.x.exe” to start AdwCleaner. In most cases, downloaded files are saved to the Downloads folder.
   

   AdwCleaner program will now open and you will be presented with the program’s license agreement. After you read it, click on the I agree button if you wish to continue. If Windows prompts you as to whether or not you wish to run AdwCleaner, please allow it to run.

   

3. Enable “Reset Chrome policies” to remove malicious browser policies.

   When AdwCleaner starts, on the left side of the window, click on “Settings” and then enable “Reset Chrome policies“.

   

4. Click on the “Scan” button.

   On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

   

5. Wait for the AdwCleaner scan to finish.

   AdwCleaner will now scan your computer for malware. This process can take a few minutes.

   

6. Click on “Quarantine” to remove malware.

   When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button to remove the malicious programs from your computer.

   

7. Click on “Continue” to remove the malicious programs.

   AdwCleaner will now prompt you to save any open files or data as the program will need to close any open programs before it starts to clean. Click on the “Continue” button to finish the removal process.
   

   AdwCleaner will now delete all detected malware from your computer. When the malware removal process is complete, you may be asked to restart your computer.

Your computer should now be free of Trojans and other malware.

If your current antivirus allowed this malicious program on your computer, you may want to consider purchasing Malwarebytes Premium to protect against these types of threats in the future.
If you are still having problems with your computer after completing these instructions, then please follow one of the steps:

• Run a computer scan with ESET Online Scanner
• Ask for help in our Windows Malware Removal Help & Support forum.