https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download
Microsoft Safety Scanner
%SYSTEMROOT%\debug\msert.log
It has some issues with how it initially describes files as "Infected" but which turn out NOT to be an issue
When I ran it on my newly installed work station it said it found 50 "Infected" files, but when it completed it gave me a clean bill of health. All it did was tweak a setting my Antivirus had installed to tell windows it had taken over from Microsoft Defender as show in the %SYSTEMROOT%\debug\msert.log file
---------------------------------------------------------------------------------------
Microsoft Safety Scanner v1.427, (build 1.427.102.0)
Started On Mon Apr 7 20:27:13 2025
Engine: 1.1.25030.1
Signatures: 1.427.102.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode
Full Scan Results:
------------------
Threat Detected: VirTool:Win32/DefenderTamperingRestore and Removed!
Action: Remove, Result: 0x00000000
regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware
SigSeq: 0x0000055555C57273
Results Summary:
----------------
Found VirTool:Win32/DefenderTamperingRestore and Removed!
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Mon Apr 7 22:01:41 2025
Return code: 6 (0x6)
Screen shot of the Microsoft Safety Scanner in action. I have a bout 3 millions files and it took over an hour and a half
0 Comments