advice where to go from here?

Question

advice where to go from here?

Anonymous

I ran the MS safety scan tool full scan and it found like 30 or more infected files is said it found and removed VirTool:Win32/DefenderTamperingRestore I ran another full scan to see if it found any more and still found over 30 infected files except this time when finished it said it found nothing, I decided just for the heck of it and the sake of not know what else to do I'm running another full scan and already up to 30 infected files again.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

0 additional answers

Answer 1

If the Microsoft Safety Scanner (MSERT) found a number of infected files during the scan but the final scan results indicate no malware was detected....this is normal behavior by many Microsoft Animalware Software but not very well documented by the Microsoft Security Team as I explain in Microsoft Security products indicates detected files during scan but does not show anything after completion (Post #22, scroll down).

Rob Koch, a Volunteer Moderator at Microsoft Community Answers offers a related explanation in this topic.
Danny (Yuhan Deng) at Microsoft Learn also offers a related summary in this topic.

According to Microsoft, a VirTool:Win32/DefenderTamperingRestore detection is for suboptimal configurations that may prevent Microsoft Defender Antivirus from functioning properly. If you see this detection it means that Microsoft Defender Antivirus auto-healed by automatically resetting to more secure configurations.

In most cases when MSERT reports a "VirTool:Win32/DefenderTamperingRestore" detection, it is reporting that Microsoft Defender Antivirus was not properly configured and the policies settings were adjusted to make it more secure. More specifically, the detection is related to changes found in Windows registry by something (good or bad) and that Tamper Protection was properly restored.

A "VirTool" detection is not related to any specific malicious file and does not necessarily mean your system is infected. In some cases, malware may make changes to various security settings in any attempt to disable them. However, there are legitimate security programs which, after they are installed, attempt to make changes to existing security software in order to be the primary controller. This would include attempts to make changes to (or disable) Microsoft Defender Antivirus security settings by third-party anti-virus software which typically adds a "DisableAntiSpyware" registry value in order to turn it off.

The detection is related to Microsoft Defender Tamper Protection which is an anti-tampering feature to protect certain Microsoft Defender Antivirus security settings from being disabled or changed by malware or other legitimate security products. This protection is intended to identify configurations changes that may prevent Microsoft Defender Antivirus from functioning properly. If the security settings (such as Virus and threat protection) are changed or disabled for any reason, Microsoft re-enables (restores) the setting back to default.