Mail from Microsoft that realtime protection is disabled on startup

Cylon

Hello!

Since a month (or two) I am getting emails with warnings from Microsoft/Windows that Realtime protection is no longer active on my PC. If I then open Windows Security center, it tells me all is fine and my PC is protected by F-Secure. If I then check F-Secure, I get to see all greens and the message that it is up-to-date and running.

I am not sure of the exact moment that this started, but from what can see, the messages always come when I start my PC. So it seems as if there is a second or so where Windows doesn't detect F-Secure yet or perhaps F-Secure actually hasn't started yet when Windows performs the check.

I couldn't really find anything about this on the Forum, but has anyone experienced this before? Is there a way to maybe enable more logging to find the cause? I did find a single message from F-Secure in the eventviewer that directly preceded the mail, but that just says "Network alert" and points to the Edge executable, nothing else.

I am running:

• F-secure Internet Security v19.0, up to date
• Windows 11, 22H2, Build 22621.1848

Its not critical as everything seems to work fine, I am just wary of being trained to ignore safety related messages by receiving an apparently false alarm every day.

Thanks!

Steven

Firmy

Hello @Cylon

Thank you for your reply.

It seems that the issue is related to Microsoft's side. You can find more information about it in this link from their discussion: https://answers.microsoft.com/en-us/msoffice/forum/all/microsoft-defender-pc-reboot-false-positive-email/fc693282-db9f-4deb-a9d1-33393d106a1a

If you need any further assistance, please don't hesitate to let me know. I'm here to help.

Thank you, and have a great day.

Firmy

Hello @Cylon

Welcome to the F-Secure Community. Thank you for your post.

To better understand the situation, could you please clarify whether you received the message via email or as a pop-up message on your PC?

If the message was received as an email, it's important to be cautious as it could be a phishing attempt. We recommend not clicking on any links or attachment in the email. To verify its legitimacy, it is advisable to directly contact Microsoft for further guidance.

On the other hand, if the message appeared as a pop-up on your computer, it might be related to your browsing history, cache, or cookies. You can try clearing them by following the steps outlined in this link: https://community.f-secure.com/common-home-en/kb/articles/8741-how-to-clear-browser-cache-cookies-or-site-data-on-windows-chrome-firefox-ie

Alternatively, if you can provide us with a screenshot, it would help us better understand the situation.

It's great that you are being cautious, as it's always important to stay vigilant. Based on the status of F-Secure Internet Security, it indicates that your computer is protected. For more information about the status, you can visit the following link: https://help.f-secure.com/product.html#home/total-windows/latest/en/task_E34DF5D0EA8A4A759A730BFEC2FE7611-latest-en

Please feel free to reach out if you need any further assistance. We are here to help.

Thank you, and have a wonderful day.

Ukko

Hello,

I am also only an F-Secure user. And sorry for my English

Your description (with the exception of "emails" wording AND precisely 'realtime protection') is very close to my experience and some other users; and partially discussed in the Community at the time.

I couldn't really find anything about this on the Forum, but has anyone experienced this before? Is there a way to maybe enable more logging to find the cause? I did find a single message from F-Secure in the eventviewer that directly preceded the mail, but that just says "Network alert" and points to the Edge executable, nothing else.

If these emails are not really email letters, but rather 'toasts' or system notifications - then my experience is about something like that too.

For example, after turning on system --> some minutes later --> toast/notification about disabled AV protection or troubles with that. This is.. despite the fact, that all is fine and Windows Security with F-Secure itself showing "good" state.

I tried to figure out if this is wrong or known limitations and ended with 'suspicion' that - this is 'limitation' and all is fine with protection as such. Rather visual glitch.

However, good if you will provide more information as requested in official reply. And if your experience indeed is about 'emails' - then suggestions and help from the reply above is crucial!

Thanks!

Cylon

Hello!

First of all: thank you for your kind replies! To answer:

Yes, they were actual emails. They didnt contain clickable links and the mail header reported it as originating from "MYDEFENDER@MICROSOFT.COM" (sorry caps, it's copied), which is an actual address. The mail looked like this ("Main" is my PC name):

<<You have to be around for a little while longer before you can post links.>>

And they would always arrive in my mailbox about a minute after startup. Upon checking, everything seemed fine. So in that respect, they are a lot like your toasts, Ukko! I still think it was a very short time after startup (maybe milliseconds?) where Windows was already checking if AV was on, but F-secure was not yet ready to say: "Yes, I am awake!".

Either way, it seems to have stopped, so I am not sure why it happened, but I guess that closes this case. Thanks again for your replies at any rate!

Cylon

I wasnt allowed to embed a link to the online message apparently. But it also wouldnt accept the upload of the image (58 KB jpg). Not sure what went wrong, but the second time I was allowed to upload: