https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download
Microsoft Safety Scanner
%SYSTEMROOT%\debug\msert.log
It has some issues with how it initially describes files as "Infected" but which turn out NOT to be an issue
When I ran it on my newly installed work station it said it found 50 "Infected" files, but when it completed it gave me a clean bill of health. All it did was tweak a setting my Antivirus had installed to tell windows it had taken over from Microsoft Defender as show in the %SYSTEMROOT%\debug\msert.log file
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | ---------------------------------------------------------------------------------------Microsoft Safety Scanner v1.427, (build 1.427.102.0)Started On Mon Apr 7 20:27:13 2025Engine: 1.1.25030.1Signatures: 1.427.102.0MpGear: 1.1.16330.1Run Mode: Interactive Graphical ModeFull Scan Results:------------------Threat Detected: VirTool:Win32/DefenderTamperingRestore and Removed! Action: Remove, Result: 0x00000000 regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware SigSeq: 0x0000055555C57273Results Summary:----------------Found VirTool:Win32/DefenderTamperingRestore and Removed!Successfully Submitted MAPS ReportSuccessfully Submitted Heartbeat ReportMicrosoft Safety Scanner Finished On Mon Apr 7 22:01:41 2025Return code: 6 (0x6) |
Screen shot of the Microsoft Safety Scanner in action. I have a bout 3 millions files and it took over an hour and a half
0 Comments