A cloud-native solution that protects workloads across hybrid and multi-cloud environments with threat detection and security recommendations
What likely happened is that Microsoft Defender showed preliminary or partial results differently from the other scanner, not necessarily that it ignored the items.
Supported behaviors from Microsoft content:
- During a scan, Microsoft security tools can show suspected items while scanning, but the final result may still say no threats were detected if those items were not confirmed as malware by the end of the scan.
- If a threat is marked partially removed, that means some malware files were cleaned but not all of them.
- If an item was allowed, Windows Security will not act on it until it is removed from the Allowed threats list.
- Remove, Quarantine, and Allow have different outcomes:
- Remove deletes the file.
- Quarantine moves it to a safe location so it cannot run.
- Allow lets it run and suppresses future alerts.
To check what Defender actually did:
- Open Windows Security.
- Go to Virus & threat protection.
- Check Protection history or Threat history.
- Check whether the item is listed under Allowed threats or Quarantined threats.
- If a threat was accidentally allowed, select it and choose Don't allow so Defender will act on it again.
If Defender had difficulty removing a threat:
- Run a Full scan in Windows Security.
- If the issue persists, run Microsoft Defender Antivirus (offline scan). This restarts the device and scans before Windows fully loads, which helps with persistent malware.
- Run the Malicious Software Removal Tool:
- Press Windows key + R
- Run %windir%\system32\mrt.exe
- Restart the PC.
- Install the latest Windows and protection updates.
If Defender keeps encountering scan or removal errors, Microsoft recommends:
- Running Windows Update
- Installing the latest protection updates manually
- Submitting feedback through Feedback Hub
So the difference seen between Stinger64 and Microsoft Defender does not by itself prove Defender ignored malware. In Microsoft Defender, the final confirmed result, the Protection history, and whether the item was allowed, quarantined, or partially removed are the key indicators of what actually happened.
- Antivirus and antimalware software: FAQ | Microsoft Support
- Virus and Threat Protection in the Windows Security App | Microsoft Support
- Troubleshoot problems with detecting and removing malware | Microsoft Support
- Antivirus and antimalware software: FAQ | Microsoft Support
- 20 Eicar Test Files Fully Downloaded End Results? - Microsoft Q&A
- MS Scan show impacted files during scan but show all good at the end of the scan? - Microsoft Q&A
- advice where to go from here? - Microsoft Q&A
- Potential problem when scanning a crashed computer - Microsoft Q&A