Presenoker and uTorrent
Unfortunately, uTorrent and BitTorent have a history of being flagged as Presenoker by Windows Defender. As Microsoft does not share any data, it is unknown which versions of uTorrent create the issue and whether they carry the real Presenoker or are just flagged as security risks.
Presenoker is one of the most common Trojans Horses encountered by Windows 10’s built-in Defender because of the file types it is carried by, most notably some instances of uTorrent.exe, as seen in the screenshot above. Most such cases are not truly malware in the classic sense, but rather files deemed as unsafe by the AV industry.
The Presenoker Virus
The Presenoker virus or trojan is a colloquial name referring to two versions of Presenoker: one deemed simply a potentially wanted program, like utorrent.exe, and the other an outright malware which slows down your system and rapidly takes up resources for bitcoin mining.
The version of Presenoker that isn’t flagged only as unsafe, but outright installs other malware on your machine is much more difficult to deal with. Differentiating between the versions can be difficult at first, but it quickly becomes noticeable if your
What is Win32/Presenoker PUA?
Presenoker is the name given to a trojan horse commonly detected by Windows Defender as Trojan:Win32/Presenoker or PUA:Win32/Presenoker. The majority of user issues come when Defender detects Presenoker but repeatedly fails to remove it.
The true removal of Presenoker is done through very mundane means, but it will require a bit of an explanation. Read it below to understand what you’re doing.
Since an updated version of Windows 10 called 2004, the default settings of Defender were changed to flag potentially unsafe programs as real “threats”, which is why you receive the popups.
The real problem occurs on another scan: it turns out Defender doesn’t remove programs it deems PUPs (potentially unwanted programs) but just blocks them and leaves them in one of its folders called Detection History. Windows Defender finds the malware again because it scans the entire system including its own folders.
However, there is another version of Presenoker which is a true malware that installs other programs on your machine without your knowledge. Since Defender names both the same way, there is no way to know which one you have. The removal guide below covers both. You will need to look for any unknown new programs that hog resources. If you don’t find any, continue with the rest.
Some threats reinstall themselves if you don't delete their core files. We recommend downloading SpyHunter to remove harmful programs for you. This may save you hours and ensure you don't harm your system by deleting the wrong files.
First, you should look if there are any programs installed by Presenoker while it was active on your system.
- A quick way to remove Presenoker is to type appwiz.cpl in your Windows Search box and click it.
- You are in the Control Panel. Look for programs installed around the time you started experiencing issues.
- The easiest way to spot Presenoker or other malware programs is to look at the publisher – if there is no name click Uninstall on it.
- The reason you are doing this is to ensure Presenoker doesn’t get installed again by another malware program once the removal is complete. Take a good look at anything you think might be suspicious.
The rest of the removal will require you to go in Windows Defender’s native folders.
- Some of the folders you will access are hidden. If you can’t see hidden folders, do the following: go in any folder you want, click on “View Tab” like the screenshot below, then “Hidden Items.“
- Now, navigate to C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service. The first time that you access “Scans”, you must have admin privileges and select “continue”.
- Once you access Service, you should see “Detection History.” Delete this folder and you should be done.