Windows 10: MSERT.exe logging not showing infected file paths

SOC team discovered an alert in MDE, indicating a suspicious "Software" file in the "Korpode malware" category, leading to the isolation of the computer from the network. Upon inspection, no suspicious “software” file was found on the system. However, the end user is unable to access USB/DVD ports. They conducted a full scan with MDAV, which reported “no threats found,” and the protection updates were up-to-date.Upon running MSERT.exe Microsoft Safety Scanner, it detected 5 infected files, but the MSERT.log did not provide information about the specific files or their locations. Is there any

:)

 

MSERT Log Empty

Why does MSert tell me I have 16 infections but at the end it says no virus found and the log is empty with no listed infections?

 

MSERT scanned 23 files infected, viruses/malware

If the Microsoft Safety Scanner shows clean (no detections found) when finished, then it's most likely that MSERT suspected a possible threat during the scan, displayed it as such (infected files) but determined the file(s) were not an actual confirmed threat(s) upon completion.

Keep in mind that Microsoft Safety Scanner (MSERT) is intended to be a supplement to an existing anti-virus program (not a replacement).

 

Microsoft Safety Scanner > Files Infected count

There's a bit of a UX problem with the scanner. As it is running it may encounter files that are suspected of being infected but indicate a count as: "Files Infected: XX"

This suggests the files are infected and apparently no list of these potentially infected files are provided.

1. Change the label to "Possible Infected Files"
   
2. Write to the msert log the list of possibly infected files for further review/action.
   

I say this as I let the tool run for over 3 hours, racking up over 20 "Files Infected". My computer was disconnected from the Internet during the scan. So I was surprised that the files in question were somehow "cleared" despite a lack of Internet connection.

From the log:

Results Summary:

----------------

No infection found.

Failed to submit MAPS report: 0x80072EE7

Failed to submit clean hearbeat MAPS report: 0x80072EE7

Microsoft Safety Scanner Finished On Sun Apr 30 13:20:56 2023

If the suspected files couldn't be submitted, then how were they cleared? Which files were suspected?

I appreciate the tool just cannot trust the results.