Microsoft Defender ASR rules remove icons and apps shortcuts from Taskbar

[piquiteco]

To err is human and I understand people make mistakes but if this problem happened in the Enterprise Business edition of MD, who knows what kind of problems might occur for us lowly home edition users? I am trying to keep my faith in MD but am not so sure what to do right now.

Yes, to err is human, it happened after Microsoft released the security intelligence update build 1.381.2140.0 for Microsoft Defender for ALL windows 10 and 11 users on Jan 13th as described here -> Application shortcuts might not work from the Start menu or other locations by Microsoft. However, home users of Microsoft Defender in default settings were not affected, only if you had changed the ASR Rules in your Microsoft Defender, by the time you got the update you would be affected. The most affected were more companies that use endpoint or advanced users who changed the advanced settings like I did.

 

[oldschool]

My question is since MD is always running in the background and can still do a periodic scan even when you have a third party AV installed, would another bad MD update still cause a problem?

@piquiteco is correct, because you don't have Defender with that particular ASR rule enabled.

Or is the third party AV going to block the update? Is the third party AV a good solution to to the update problems?

Not an issue because of the above.

 

[Andy Ful]

For example this

There are many posts on Reddit, but most posters (except this guy) noticed that the applications were not uninstalled. He/she was not probably an administrator.

 

[piquiteco]

i thought i was going mad earlier... random icons just vanished but could see in protection history the reason why (the "block win32 API calls from office Macro" ASR Rule

It's because it was Friday the 13th you forgot? On mine I didn't even see the logs, @Andy Ful commented on the logs, now that it's clear, I hope he doesn't even read my comment, I think he can literally beat me up of course. If you are going to use advanced MD settings, you have to know what you are doing. I thought I got infected by malware even after I just formatted the machine lol.

 

[Captain Holly]

Thanks for the answers @oldschool and @piquiteco. I had hope that Defender would still be ok to use. I also hope none of us have any other problems with MS, whether with Defender or anything else. All along I have had the idea that MS does not put near the same emphasis and effort into Home edition MD as they do in Enterprise. Whether they do or do not, I am still trying to keep my faith in MS and always follow good online security, watch my step online and use common sense.

C.H.

 

[Templarware]

Like I previously said, I solved it with a system restore, but now I noticed that my Documents and Downloads folder are in english.

 

[Azure]

Microsoft created a powershell script to restore the shortcuts of some applications

list is dominated by Microsoft applications, but administrators find third-party apps such as Notepad++, 7-Zip, Firefox, or Camtasia Studio as well in the listing.

Though more could be added

Administrators may modify the script to add more applications to the listing. All that is required for that is to add a new line to the list of applications array using the provided syntax (which merely is "Application Name" = "filename").

Microsoft Script to restore (some) deleted Windows shortcuts after Defender ASR incident - gHacks Tech News

In a response to a faulty security update released on Friday, Microsoft published a PowerShell script to restore some of the deleted shortcuts.

www.ghacks.net