Just ran the "Microsoft Support Emergency Response Tool" got a yellow triangle - what does it mean please?

remover · Nov 20, 2023

Sometimes I get it every other month. Or on a re-scan? regards & thanks [ Windows 11 64bit ] (Version 23H2 22631.2715)

Ghot · Nov 20, 2023

remover said:
Sometimes I get it every other month. Or on a re-scan? regards & thanks [ Windows 11 64bit ] (Version 23H2 22631.2715)

In the results window it lists the malware it found and says it was removed.
It seems that you could click the malware's name, that's shown there, for more info.

More info...

Microsoft Safety Scanner Download

Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers.

learn.microsoft.com

Review the scan results displayed on screen. For detailed detection results, view the log at %SYSTEMROOT%\debug\msert.log.

remover · Nov 20, 2023

_Thanks Ghot -- Looks like at the log: %SYSTEMROOT%\debug\msert.log --- I get the following:
(the malware's name is not a hotlink?) anything further to do?

Microsoft Safety Scanner v1.401, (build 1.401.414.0)
Started On Mon Nov 20 13:37:03 2023

Engine: 1.1.23100.2009
Signatures: 1.401.414.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode

Quick Scan Results:
-------------------
Threat Detected: VirTool:Win32/DefenderTamperingRestore and Removed!
Action: Remove, Result: 0x00000000
regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware
SigSeq: 0x0000055555C57273

Results Summary:
----------------
Found VirTool:Win32/DefenderTamperingRestore and Removed!
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Mon Nov 20 14:21:22 2023

Return code: 6 (0x6)

---------------------------------------------------------------------------------------
Microsoft Safety Scanner v1.401, (build 1.401.414.0)
Started On Mon Nov 20 16:02:58 2023

Engine: 1.1.23100.2009
Signatures: 1.401.414.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode

Ghot · Nov 20, 2023

@remover

Now that I can't help with. Here's Microsoft's answer...

Redirecting

The VIRTOOL:Win32\DefenderTamperingRestore message means nothing more than that MSERT ran one of its virtual tools. This tool found that Microsoft Defender Antivirus was configured poorly and changed the settings to be more secure.

This is not a virus or other type of malware. It is simply MSERT reporting that it performed a settings check and adjusted the settings based on the results.

Honestly, I first heard about MS Safety Scanner a day or two ago.... I read about it and decided... I'm gonna pass on this one.
This seems to me, like just another half baked idea from Mircosoft.

When you run another AV or anti-malware program, it's supposed to turn Defender off, temporarily or permanently.
It looks like MS Safety Scanner is reacting to that. Possibly Malwarebytes on your computer.

Apparently, MS Safety Scanner is checking to see if anything has changed any Windows Defender settings.
In your case it found a registry entry changed. This does not mean it's a bad thing... it just means that it's something MS is not happy with.

This is the hint I got from reading about MS Safety Scanner. It seems to look for other programs that may change Microsoft settings.
Personally, that's something I don't care about. In MY opinion, there are a LOT of Microsoft settings that need changed.

MS Safety Scanner seems to be a tool that more interested in removing "tweaks", than in finding malware. ^^

You can also do what I just did.... Google: VirTool:Win32/DefenderTamperingRestore and read all about it.

Here's what Capt. Kirk (AdvancedSetup), has to say about it in Malwarebytes forum...

VirTool:Win32/DefenderTamperingRestore question

First of all, apologies if this is the wrong section, this is more a question rather than a Malware case (I think), so if needed please move the topic to the corresponding section. Okay, so, I was doing a montly checkup on my PC. Malwarebytes and McAffee didn't find anything strange. But when I r...

forums.malwarebytes.com

He ran all kinds of other tests, trying to find if... VirTool:Win32/DefenderTamperingRestore ...was actually malware.
Apparently it wasn't.

@flashh4
You may want to research this a bit. Seems like MS Safety Scanner is more of a "vulnerability scanner", than a true AV or Malware scanner. Me... I stay far away from vulnerability scanners. They always seem to do more damage, than good.

remover · Nov 20, 2023

Thank you Ghot! very much for your research & explanation in this matter. Will avoid using the MSERT scanner & use the "microsoft windows malicious software removal tool." We have no issues with that. (it came with the laptop) The scan for malicious software tool just finished in the Green. Will cya down the log. best regards to you !

Ghot · Nov 20, 2023

remover said:
Thank you Ghot! very much for your research & explanation in this matter. Will avoid using the MSERT scanner & use the "microsoft windows malicious software removal tool." We have no issues with that. (it came with the laptop) The scan for malicious software tool just finished in the Green. Will cya down the log. best regards to you !

Windows 11 is somewhat like a swamp. Each person has to find their way through it.
Everybody will choose a different path.

Best advice I can give is to use 3rd party backup software. Here are two of the most commonly used ones...

Macrium Reflect, AOMEI Backupper and Hasleo Backup Suite - GUIDES

How to use backup software... 1. When everything is working perfectly... make a full Windows backup. 2. Then, if something breaks... restore from the latest backup. 3. Then... try "whatever you were doing" a different way. If it still breaks Windows, then... go to step #2. 4. Repeat...

www.elevenforum.com

As long as Microsoft is gonna use us as test dummies... we "need" to have fresh backups.

Porthos · Nov 20, 2023

Have you neutered Windows in any way?
Do you have any 3rd party AV installed other than Defender that comes with Windows?

Porthos · Nov 20, 2023

Just looked at your specs and you have Malwarebytes Premium installed.
You need to turn off the following in Malwarebytes to reneable Defender.

remover · Nov 20, 2023

Porthos said:
Have you neutered Windows in any way?
Do you have any 3rd party AV installed other than Defender that comes with Windows?

None, Windows Security in Malwarebytes has been off since I saw your post at Malwarebytes Forum !!

Porthos · Nov 20, 2023

That issue comes up quite often in the Malware Removal section at Malwarebytes even with your current settings.
I suggest posting over there and getting it fixed.

Scannerman · Nov 21, 2023

Ghot said:
View attachment 78536

Windows 11 is somewhat like a swamp. Each person has to find their way through it.
Everybody will choose a different path.

Best advice I can give is to use 3rd party backup software. Here are two of the most commonly used ones...

Macrium Reflect, AOMEI Backupper and Hasleo Backup Suite - GUIDES

How to use backup software... 1. When everything is working perfectly... make a full Windows backup. 2. Then, if something breaks... restore from the latest backup. 3. Then... try "whatever you were doing" a different way. If it still breaks Windows, then... go to step #2. 4. Repeat...

www.elevenforum.com

View attachment 78538

As long as Microsoft is gonna use us as test dummies... we "need" to have fresh backups.

As long as Microsoft is gonna use us as the test dummies we need to keep making complete drive images!

Clone that OS and everything on it, tuck it in a nice dry dark corner and save it for a rainy day!

Ghot · Nov 21, 2023

Scannerman said:
As long as Microsoft is gonna use us as the test dummies we need to keep making complete drive images!

Clone that OS and everything on it, tuck it in a nice dry dark corner and save it for a rainy day!

LOL, I "clone" mine a... lot.

These are all full OS backups.

I keep the amount of used space on my C:\ drive at about 30GB.
That way... backups and restores are very fast.
So... they're not a hassle to run.

I install games and large programs on a storage drive (namely, the F:\ partition)

And I use Karen's Replicator to copy Disk 1 to Disk 2. One click to run.

flashh4 · Nov 21, 2023

@Ghot ....... excellent job of explaining & i too stay away from MS tools. I spoke with one of my teachers about this & his quote "Beware of stranger tools from MS" than an old one from long ago that failed miserably, but he wouldn't elaborate on it ! I am like you i stay away from tools/programs as you mentioned ! There are a lot of tools/programs out there that works wonders if you know how to read them !! Have a great Turkey day Ghot !

Ghot · Nov 21, 2023

flashh4 said:
Have a great Turkey day Ghot !

You too.

ShamrockRig · Nov 21, 2023

Ghot said:
LOL, I "clone" mine a... lot.
These are all full OS backups.

View attachment 78553

View attachment 78554

I keep the amount of used space on my C:\ drive at about 30GB.
That way... backups and restores are very fast.
So... they're not a hassle to run.

I install games and large programs on a storage drive (namely, the F:\ partition)

And I use Karen's Replicator to copy Disk 1 to Disk 2. One click to run.

please tell me you're games aren't installed on an old spinner lol

Ghot · Nov 21, 2023

ShamrockRig said:
please tell me you're games aren't installed on an old spinner lol

They are, but it's a very fast spinner, and they are very old games.

0000 Crystal - WD Black 7200rpm FZBX.png

Games not installed...

Diablo II
All the Baldur's Gate games
Planescape Torment
Revenant
The original Unreal
Arcanum
Oblivion
The Witcher
Quake II

The only relatively new game I have is Tower of Time.

I also have a lot of freebie junk games from Good Old Games...

ShamrockRig · Nov 21, 2023

Ghot said:
They are, but it's a very fast spinner, and they are very old games.

View attachment 78637

Ahhh i gotcha, That makes sense i guess! Any of my newer games specify ssd only now xD Hard drive requirements are now a thing for gamers haha other than the obvious space for install