msert.exe results are confusing

The final result is authoritative: the 386 shown during the scan were preliminary suspected files, while 0 infected files means MSERT did not confirm any threats by the end of that scan.^1^

MSERT marks potentially suspicious files while scanning and evaluates them further during its final phase. Consequently, the running counter can rise and then return to zero; it does not mean that 386 confirmed infections were silently ignored.

Verify the detailed result

1. Press Windows key + R.
2. Enter:

      %SYSTEMROOT%\debug\msert.log
   

3. Press Enter and open the log if prompted.
4. Review the entries near the bottom for:
   • the final scan summary;
   • named threat detections;
   • remediation actions;
   • errors beginning with 0x.

Microsoft documents %SYSTEMROOT%\debug\msert.log as the detailed detection log for Safety Scanner.^2^

If the log shows a successful scan with no named detections or errors, no further MSERT action is indicated. If it contains an error code, use Microsoft’s error-code procedures; remedies vary by code and can include downloading a fresh scanner, restarting Windows, or running a full scan.^3^

MSERT is an on-demand scanner rather than a replacement for real-time protection. If another scan is needed later, download a new copy first because Safety Scanner expires 10 days after download and Microsoft recommends using the latest version for updated malware definitions.^2^

References

1. Microsoft Safety Scanner says it is finding infected files while running but when finished says no viruses or spyware found! - Microsoft Q&A
2. Microsoft Safety Scanner Download
3. How to troubleshoot an error when you run the Microsoft Safety Scanner | Microsoft Support