MS Rootkit scan failed

Birk · Apr 10, 2023

I tried the MS rootkit scan by following Brink's instructions - nothing happened. When I tried the command prompt I got this response:

I got the same basic response from Powershell. I'm running current Win 11/64 Home Ver. 22H2 Build 22621.1485.

Try3 · Apr 10, 2023

The OP is referring to
Run Microsoft Defender Offline Scan - ElevenForumTutorials
[I've alerted Brink to the existence of this thread]

All the best,
Denis

Brink · Apr 10, 2023

Hello Birk,

I just tested the command in build 25336, and it's still working for me.

Double check to make sure an error hasn't been made with the command. Click/tap on the command in the tutorial to have it automatically copied to the clipboard, then paste it into elevated terminal to see if you see the same issue.

AndreTen · Apr 10, 2023

I think "Elevated" is the important word here. Birk, did you started the terminal as admin?

Wisewiz · Apr 10, 2023

AndreTen said:
I think "Elevated" is the important word here. Birk, did you started the terminal as admin?

It says, "Administrator:" in the header of his Command Prompt window.

IanMosley · Apr 10, 2023

Birk said:
I tried the MS rootkit scan by following Brink's instructions - nothing happened.

Just ran this as Powershell Admin - working OK here.

Wisewiz · Apr 10, 2023

IanMosley said:
Just ran this as Powershell Admin - working OK here.

Ran it in Cmd Prmpt; working perfectly here.

Ghot · Apr 10, 2023

@Birk

If, for some reason, you still can't get it to work... there's always this...

TDSSKiller tool for detecting and removing rootkits and bootkits

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.com

flashh4 · Apr 10, 2023

I agree with @Ghot Run the TDSSKIller and see if it finds anything !! Make sure you run it as "Run as Administrator" !

Birk · Apr 11, 2023

Yes, I did use Terminal (Admin) which I think is the same as "elevated". But if that is incorrect just let me know.

Wen I used Powershell I got 4 options - and tried them all. Same results. The options were Powershell, Powershell (x86). Powershell ISE, and Powershell ISE (X86).

I'll try TDSSKILLER and see what happens.

==================================

I guess this means I have no worries..

Try3 · Apr 11, 2023

Birk said:
I tried the MS rootkit scan by following Brink's instructions

Brink has just posted in another thread that some, but not all, third-party anti-malware utilities can stop Run Microsoft Defender Offline Scan - ElevenForumTutorials working correctly.

All the best,
Denis

Birk · Apr 11, 2023

I have no 3rd party anti-malware software running on my system. When I reran the Defender offline scan again I got the same results as I originally posted. When I looked in the directory where the log file was supposed to be (C:\Windows\Microsoft Antimalware\Support) there was nothing there.

Try3 · Apr 11, 2023

I can see that's what the tutorial says.
I always thought the logs were in
"C:\ProgramData\Microsoft\Windows Defender\Support"
and in
Event viewer,
Log - Microsoft-Windows-Windows Defender/Operational
Source - Windows Defender
EventID - various.

I've never been able to use them to extract anything I could understand.

Perhaps you could ask about them in the tutorial thread itself but if, as I think you have said above, it did not run then there might be no log at all.

Denis

kelper · Nov 5, 2023

I have the same issue as the OP.

I have run SFC /scannow and DISM /cleanup-image /scanhealth with no issues found. I also created a new admin user, but still Defender offline scan never starts and there is no reboot.

I was using PowersShell and CMD as admin.

My systems 1 and 2 both have this issue and system 2 is Win 10.

I am trying a repair install of 23H2 right now but it's taking ages.

kelper · Nov 5, 2023

A repair install has fixed the problem and the offline scan is proceeding.

Birk · Nov 5, 2023

Well gosh! I tried again directly with Powershell and got this:

PowerShell 7.3.9
PS C:\Windows\System32> PowerShell Start-MpWDOScan
Start-MpWDOScan : Errors were encountered when attempted to run WDO scan on your device.
At line:1 char:1
+ Start-MpWDOScan
+ ~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (MSFT_MpWDOScan:ROOT\Microsoft\...\MSFT_MpWDOScan) [Start-MpWDOScan],
CimException
+ FullyQualifiedErrorId : HRESULT 0x80070005,Start-MpWDOScan

PS C:\Windows\System32> Start-MpWDOScan
Start-MpWDOScan: Errors were encountered when attempted to run WDO scan on your device.
PS C:\Windows\System32>

My system is 23H2 Build 23631.2506. SFC /scannow reports no problems.

I also tried using the Windows Security Offline Scan option, but all that does is take me back to the Save your work dialog, but clicking on the Scan option just takes me back to the previous window.

TairikuOkami · Nov 5, 2023

Running Windows Security Offline Scan does not make much sense if you are running Defender.
It is better to get a second opinion. Since you like offline, Emsisoft Emergency Kit would be the best.

Birk · Nov 5, 2023

Not heard of that one before - I'll try it. Thanks.

kelper · Nov 5, 2023

TairikuOkami said:
Running Windows Security Offline Scan does not make much sense if you are running Defender.
It is better to get a second opinion. Since you like offline, Emsisoft Emergency Kit would be the best.

But I don't normally run Defender! I use Webroot, but wanted to try Defender offline as a backup.

Try3 · Nov 5, 2023

Birk said:
I also tried using the Windows Security Offline Scan option

The valid reasons for running Defender offline scan are stated in
Help protect my PC with Windows Defender Offline - MSSupport

When should I use Microsoft Defender Offline?

Run Microsoft Defender Offline if:
- Windows Security (also called Windows Defender Security Center in previous versions of Windows) detects rootkits or other highly persistent malware on your PC and recommends you use Microsoft Defender Offline.
- You suspect your PC might have malware hiding on it, but your security software doesn’t detect anything.

All the best,
Denis

MS Rootkit scan failed

Well-known member

My Computer

Well-known member

My Computer

Administrator

My Computers

Well-known member

My Computers

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Windows Insider

My Computer

𝐒𝐩𝐞𝐚𝐤𝐬 𝐀𝐧𝐜𝐢𝐞𝐧𝐭 𝐆𝐞𝐞𝐤

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Similar threads