Forum Discussion

GGkRel's avatar
GGkRel
Copper Contributor
Nov 03, 2025

Hundreds of DSM-Synology NAS work files are intercepted by Defender as threats!

Hi everyone. . .

 

Sorry, long...

 

For a couple of days now, I've been experiencing an annoying, persistent, and unresolvable problem affecting the Synology Drive Client 3.5.2 working folder D:\.SynologyWorkingDirectory.

I'm running Windows 11 Pro 64-bit v25H2, and a couple of days ago, I accidentally discovered that Windows Defender has become incredibly slow when launched from its taskbar icon.

Once I opened Defender, it presented a report with HUNDREDS (!) of threats, all caused by (temporary?) files in the hidden working folder "D:\.SynologyWorkingDirectory."

The vast majority of the threats were eliminated. However, a few were classified as "severe" and warned that Defender may not have been able to completely eliminate the threat.

I'm almost certain these aren't real threats, partly because of my extreme care with my browsing habits and behavior,
but primarily because there are hundreds of them and they're constantly being created, exclusively in the D:\.SynologyWorkingDirectory folder. 
Defender, for its part, constantly deletes them, making it incredibly slow, and opening its history is equally slow.

I ran a thorough system scan with Defender, both online and offline, but nothing was found. I also ran a scan with MalwareBytes, and nothing was found, perhaps also because the files are quickly deleted by Defender.

I therefore suspect that Windows Defender has arbitrarily classified Synology's temporary files as threats.

Even deleting Windows Defender's history was a painstaking task due to numerous (!) failed attempts due to the low-level and operational protections in Windows 11 Pro 64-bit v25H2.

The only solution was to boot WinRE from a Windows installation USB drive, then delete the scans folder (D:\ProgramData\Microsoft\Windows Defender\Scans) from DOS.
I also had to obtain the Bitlocker key, but clearing the history is pointless because it continually recreates itself with new detections!

I'm forced to pause Synology Drive Client v3.5.2.

How can I get support for this issue?

Regards . . 

No RepliesBe the first to reply

Resources