Microsoft Windows Defender keeps detecting BrowserModifier:Win32/SupTab!blnk

Question

On my computer, Windows Defender keeps detecting this:

After I click Clean system or Apply Actions. It just comes back again after a few seconds. I am a software developer myself, and I study ransomware and adware, so I am pretty sure that my browsers are clean. At least, as far as I can see. All my browsers seem healthy, with no search engine hijacks or toolbars. My extensions and plugins contains nothing suspicious. I have also tried to remove ALL my extensions, but no luck.

I have tried the following anti-viruses with no infections found:

• BitDefender 2017
• AdwCleaner
• Malwarebytes
• Hitman Pro

All with 0 found infections.

My computer seems to run normally. No CPU hogs or HDD/SSD activity.

When I Google around about this infection: All I get are those stupid product placement sites for (scareware?) anti-virus programs, and a generic guide to remove viruses.

I have never in my 12 years of computer background not been able to remove an infection. I have no idea how the infection got on there in the first place, or if there even is an infection at all (false positive?).

I see the infection show up pretty quick on Googles Search suggestions. So it's clear I am not the first one.

Answer 1

I found similar issues on these MS forums pages:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning/windows-defender-keeps-saying-harmful-software/25532dc1-2ca7-402b-8a91-2be7c44fd65a

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning/i-can-remove-browser-modifier-win32subtabblnk/49bbb618-d919-4269-a6c8-784a0953396b

A program named VulcanRT seems to be a common denominator in both - could it be you have something similar?

Some tips I found in the above sources that might be useful:

• Check browser add-ons/extensions that might be causing the issue
• Try resetting your browser/s
• After cleaning up with Windows Defender, clean Temp files and reset the computer

Here's what somebody who managed to clean it up had to say:

In the end this is what I did :

I did run the programs listed in the link above, and I did reset Internet Explorer. Restarted after each step. Even after resetting IE, once it was opened the warning came back.

Roguekiller was the one program that found anything, deleted what it found.

At that time WD came up with a new link in its warning for this which led to a folder/program that I could uninstall (VulcanRT), I can reinstall it later if need be though I think my graphics will be fine without it. Uninstall successful. I also uninstalled Google Chrome completely.

Ran Revo Uninstaller Pro, looked for anything installed in the last few hours before the issue started. There were two redistributable files, uninstalled both of them. Uninstall successful.

Uninstalled a game that I had installed through Steam (which I have never have problems with installs from but did this anyway).

Restarted after each of these steps and kept IE closed during everything.

Not sure which of the above steps did the trick but I have now had IE open for awhile and the warning has not come back up.

Here's a joyful update from reddit:

I have fixed the problem.

I went to the directories shown in Window Defender and manually deleted the shortcut .lnk files. For me they were Google Chrome and Internet Explorer. In File Explorer they were .exe files instead, deleting these remove the applications from the Start Menu. Well I can live without it.

It does look like a false positive to me. A system restore I performed did not fix it. Note that I restored it to an earlier point in time before the notifications started showing.

Hope this helps!

If it doesn't, some Google-fu might lead you to the right answer - as you said, there are a lot of results so you can just go over them :)