Windows 10: I wanna know what 'VirTool:Win32/DefenderTamperingRestore' exactly is and is it malicious

I wanted to check my laptop before reinstall windows.I used malwarebytes scanning which only spends 5 minutes, and MSERT 1.391.3187.0 spends several hours to detect it,I saw malwarebytes says nothing, and MSERT says VirTool:Win32/DefenderTamperingRestore detected and removed.And I also checked another computer, more seems to be compromised ... but it detects nothing with MSERT 1.391.3199.0 and malwarebytes.One thing I concerning is, infected? computer been through twice 'reset this pc' with 'remove everything',And after that I did almost nothing with it, I mean, most of time it was turned

:)

 

I wanna know what 'VirTool:Win32/DefenderTamperingRestore' exactly is and is it malicious

I wanted to check my laptop before reinstall windows.

I used malwarebytes scanning which only spends 5 minutes, and MSERT 1.391.3187.0 spends several hours to detect it,

I saw malwarebytes says nothing, and MSERT says VirTool:Win32/DefenderTamperingRestore detected and removed.

And I also checked another computer, more seems to be compromised (...) but it detects nothing with MSERT 1.391.3199.0 (newer version?) and malwarebytes.

One thing I concerning is, infected(?) computer been through twice 'reset this pc' with 'remove everything',

And after that I did almost nothing with it, I mean, most of time it was turned off or most of time it has been offline, and installing only verified official programs.

I saw two things

1. Redirecting

2. Redirecting

First one seems accurate, including microsoft offical summary that tells this thing use to be detected when sub-optimal configuration on windows defender, Though seems bit old-That makes me doubted

But second one is more new, but little seems obscure? - he says this malware? cannot be deleted even with format or re-installed, but as far as I know, the only thing format cannot delete is Bios malware, but this doesn't seem to be like that.

Actually I'm doubting the speed of malwarebytes, it's too fast to check entire system, compared with MSERT-several hours.

But in this case, I'm wondering even with that fast Anti Virus, is it reliable enough?

 

Win32/DefenderTamperingRestore

Hi there.

Anybody can help me with how to clean my computer from this virus:
Win32/DefenderTamperingRestore

Usually, when I run MSERT.exe it says that this virus was eliminated. But I have some questions:

a) Is it a memory-resident malware?

b) Is it launched in my computer startup?

c) Or is it activated when I run some software. How can I know which software is launching it? I guess that MSERT must know.

d) Where it is located?

e) How can I delete it?

f) FINALLY.......IS IT DANGEROUS? (For example, Is my computer safe to use it with my credit card payments)

Regards

Hernán Covarrubias

Mobile: +569 9870 3539

Private mail: *** Email address is removed for privacy ***

 

Win32/DefenderTamperingRestore

Hello I am an independent advisor for the Microsoft community. I did a quick search and found that this isn't actually a virus, it's actually Windows Defender notifying you about your settings. Here is the page with more info:

https://www.microsoft.com/en-us/wdsi/threats/ma...