Fix Microsoft Defender Repeatedly Reporting a PUA That Is Not Found
Question details
The user needs to stop persistent, cross-device Microsoft Defender notifications about a Potentially Unwanted Application (PUA) that is no longer present.
- Product
- Windows Security (Microsoft Defender)
- Device & OS
- Windows
- Scenario
- The user continues to receive cloud alerts on synced devices regarding a PUA (such as PUA:Win32/IObit), despite multiple local scans finding no threats.
- Observed behavior
- Microsoft Defender continuously issues alerts for a specific PUA across connected devices, but the local device's protection history and active scans show no detections.
Ensure your Windows operating system and Microsoft Defender antivirus definitions are completely up to date before attempting to clear your scan history or run offline diagnostics.
Clear Defender Protection History and Run an Offline Scan
Use this solution to clear out stuck or ghost alerts in your local Windows Security cache and perform a deep system scan to ensure no remnants remain.
Often, Microsoft Defender gets stuck in a loop, continually alerting you about a threat that has already been deleted or quarantined. Clearing the local scan history cache forces Defender to reset its alert logs.
An offline scan is also highly recommended because it checks your system outside the standard Windows environment, ensuring rootkits or stubborn PUAs cannot hide.
Open File Explorer and go to C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service (you may need to enable hidden items in the View menu to see ProgramData).
Delete all files inside the Service folder, then empty your Recycle Bin. This clears the stuck threat history.
Click the Start menu, type 'Windows Security', and open the app. Navigate to 'Virus & threat protection'.
Click on 'Scan options', select 'Microsoft Defender Offline scan', and click 'Scan now'. Your PC will restart and perform a deep scan.
Remove Associated Third-Party Cleanup Tools
Uninstall system optimization software like IObit that frequently triggers Potentially Unwanted Application (PUA) alerts.
Review Microsoft Account Device Sync Alerts
Check your Microsoft account online to dismiss stale cloud alerts that are broadcasting to your other connected devices.
Experience a Secure, Lightweight Office Suite with WPS Office
While resolving complex Windows security and PUA alerts, it is crucial to keep your daily productivity environment secure and efficient. WPS Office offers a free, lightweight, and highly compatible alternative to Microsoft Office, avoiding the bloat and background processes that sometimes interfere with system performance.
- 1. Download the installer: Visit the official WPS Office website and click the free download button.
- 2. Install the application: Run the downloaded executable file and follow the quick installation prompts.
- 3. Open and edit your files: Launch WPS Office and instantly open your existing Microsoft Office documents with perfect formatting.
Frequently Asked Questions
Why does Microsoft Defender keep warning me about a PUA that I already deleted?
This happens when the Microsoft Defender protection history cache fails to update. The system continuously re-reads the old log file, mistaking the historical record of the threat for a new, active infection. Clearing the history cache usually stops the notifications.
What does PUA:Win32/IObit mean?
PUA stands for Potentially Unwanted Application. Microsoft flags IObit and similar third-party PC registry cleaners or optimizers as PUAs because they can modify system settings aggressively, sometimes leading to unintended system instability or false positives.
How can I stop Defender alerts from showing up on my other synced computers?
Windows Security alerts can sync through the cloud via your Microsoft account. If you fix the issue on the main PC but alerts persist elsewhere, you should log into your Microsoft account online and clear the alerts in the security dashboard, or temporarily unlink and re-link the affected device.
