@remover
Now that I can't help with. Here's Microsoft's answer...
The VIRTOOL:Win32\DefenderTamperingRestore message means nothing more than that MSERT ran one of its virtual tools. This tool found that Microsoft Defender Antivirus was configured poorly and changed the settings to be more secure.
This is not a virus or other type of malware. It is simply MSERT reporting that it performed a settings check and adjusted the settings based on the results.
Honestly, I first heard about MS Safety Scanner a day or two ago.... I read about it and decided... I'm gonna pass on this one.
This
seems to me, like just another
half baked idea from Mircosoft.
When you run another AV or anti-malware program, it's supposed to turn Defender off, temporarily or permanently.
It looks like MS Safety Scanner is reacting to that. Possibly Malwarebytes on your computer.
Apparently, MS Safety Scanner is checking to see if anything has changed any Windows Defender settings.
In your case it found a registry entry changed. This does not mean it's a bad thing... it just means that it's something MS is not happy with.
This is the hint I got from reading about MS Safety Scanner. It seems to look for other programs that may change Microsoft settings.
Personally, that's something I don't care about. In MY opinion, there are a LOT of Microsoft settings that
need changed.
MS Safety Scanner seems to be a tool that more interested in removing "tweaks", than in finding malware. ^^
You can also do what I just did.... Google:
VirTool:Win32/DefenderTamperingRestore and read all about it.
Here's what Capt. Kirk (AdvancedSetup), has to say about it in Malwarebytes forum...
First of all, apologies if this is the wrong section, this is more a question rather than a Malware case (I think), so if needed please move the topic to the corresponding section. Okay, so, I was doing a montly checkup on my PC. Malwarebytes and McAffee didn't find anything strange. But when I r...
forums.malwarebytes.com
He ran all kinds of other tests, trying to find if... VirTool:Win32/DefenderTamperingRestore ...was actually malware.
Apparently it wasn't.
@flashh4
You may want to research this a bit. Seems like MS Safety Scanner is more of a "vulnerability scanner", than a true AV or Malware scanner. Me... I stay far away from vulnerability scanners. They always seem to do more damage, than good.
