A few months ago, I eradicated a nasty piece of malware from my Windows PC. It had set up shop in C:\Program Files (x86)\ohnZpFjHU—a gibberish folder name that screamed “I don’t belong here.” I thought I’d won the battle when I deleted it, but it left behind an annoying souvenir: undeletable exclusions in Windows Defender’s registry. Every time I tried to remove them, I hit a brick wall of errors. Here’s how I fought through it, error by error, and finally reclaimed my system.
The Problem: “Unable to Delete All Specified Values”
It started when I opened Registry Editor (regedit) as an admin and navigated to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths. There it was: “C:\Program Files (x86)\ohnZpFjHU”, a leftover exclusion from the malware. I right-clicked, hit Delete, and… nothing. Just this:
[Window Title]
Error Deleting Values
[Content]
Unable to delete all specified values.
[OK]
Okay, no big deal, right? I’ve got admin rights—I’ll force it. Nope. I tried taking ownership of the Paths key (right-click > Permissions > Advanced > Change Owner), only to get slapped with:
Windows Security
Unable to set new owner on Paths.
Access is denied.
OK
Even the Command Prompt, running as admin, betrayed me:
C:\WINDOWS\system32>reg delete “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths” /v “C:\Program Files (x86)\ohnZpFjHU” /f
ERROR: Access is denied.
At this point, I was annoyed. This wasn’t just a registry entry—it was a taunt from malware I’d already beaten. I wasn’t about to let it win.
The Troubleshooting Odyssey
I threw everything at it. Here’s what I tried—and what failed:
Defender Off: Disabled Windows Defender’s real-time protection and even stopped its service in services.msc. The exclusion laughed in my face.
Elevated Privileges: Running regedit and CMD as admin didn’t cut it. Permissions were locked tighter than Fort Knox.
Ownership Dance: I tried taking ownership via GUI and CLI (takeown and icacls). No dice—still “Access is denied.”
Safe Mode: Booted into Safe Mode with Command Prompt, ran the reg delete command again. Same error. Something was guarding this key even in minimal mode.
SYSTEM Account: Used PsExec (psexec -i -s cmd) to run commands as SYSTEM. I thought I’d cracked it—SYSTEM has god-tier privileges, right? Nope, still denied.
I was ready to give up and live with the blemish. After all, the folder didn’t exist anymore—Defender wasn’t actually skipping anything. But it bugged me. A lot.
The Breakthrough: A Policy Plot Twist
Then I stumbled on a lead: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths. This is where Group Policy stores Defender exclusions—settings that override user-level tweaks. I checked it out in regedit, and there they were: the same weird paths, including “C:\Program Files (x86)\ohnZpFjHU”. The malware hadn’t just tampered with Defender’s operational exclusions—it had enforced them via policy, locking me out.
Here’s the kicker: I could delete these entries. No errors, no resistance—just a right-click and “Delete.” I didn’t catch the values (probably just 0 to enable the exclusion), but it didn’t matter. Once they were gone, I opened Windows Security, went to “Virus & threat protection > Manage settings > Add or remove exclusions,” and removed the offending path without a hitch. I checked HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths again—poof, it was empty. The UI had synced up and cleaned house.
What I Learned
- Policy Trumps All: The Policies key was the puppet master. As long as it listed that exclusion, the operational key (…\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths) was untouchable. Deleting the policy entry broke the spell.
- Malware’s Sneaky Move: This wasn’t an accident. The malware had used the Policies path to cement its exclusion, making it harder to undo even after I’d nuked its files. Clever, but not clever enough.
- Windows Defender’s Lockdown: Defender guards its registry keys fiercely—sometimes too fiercely. Even SYSTEM couldn’t touch them until the policy override was lifted.
How You Can Fix It
If you’re battling a similar ghost exclusion, here’s the short version:
Open regedit as admin.
Check HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths.
Delete any suspicious entries (back up the registry first—File > Export).
Go to Windows Security and remove the exclusion via the UI.
Verify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths is clear.
If that fails, dig deeper with tools like SubInACL or a Linux live USB (I didn’t need to go that far, but they’re options). And always scan for malware—those exclusions might mean something’s still lurking.
The Payoff
It’s gone. No more error messages, no more reminders of that malware. My registry’s clean, and I’ve got a story to tell. Sometimes the smallest victories—like deleting a stubborn key—feel the biggest.
logthemall 