Windows 10: Safety scanner shows a number of infected files while scan and shows non at the end result

I'm a Windows 11 user. I scanned my computer using Microsoft safety scanner. While the scan is going, it showed the number of infected files as 3 but after finishing the scan, it said that there are no infections and also there's nothing about an infection in the report. Why is that? Is it normal? Pls advise.

:)

 

Microsoft Safety Scanner (64-bit) scanning showing 164 infected files however final scan results says 0 detected

Hi. I'm David, and I'm happy to help you.

Microsoft Safety Scanner may report that it found threats before the end of the scan and show no detection at the end. What happens is that it finds possible infections, but at the end of the scan, it does a full check on these items, and it may find that there is no infection.

This is normal behavior for Microsoft Safety Scanner.

Therefore, if at the end of the scan, no threats were reported, nothing was found by Microsoft Safety Scanner.

Feel free to ask back any questions.

 

microsoft safety scanner showing same files infected

If you're seeing these 15 infected files only during the scanning process listed next to the line titled 'Files infected', then that's a well-known situation that confuses many who don't understand how this, or any other Microsoft malware scanner truly operates.

During the scan itself, the Safety Scanner displays this Files infected counter that includes all of the individual fragments of potential malware it has detected using the signatures contained within the downloaded file. However, once the scanning portion has reached roughly 95% completed (per the progress bar), the scanning tool (and most other Microsoft scanners like Defender) perform a 'phone home' request using a cloud service also known as MAPS (Microsoft Active Protection Service).

What this MAPS request does for the Safety Scanner is allows it to not only verify that the items detected aren't actually a false positive detection, but also that the remediation (fix) for these particular items hasn't been updated or changed, as well as that the combination of items are truly 'active' malware and not simply leftover fragments of an already 'dead' or failed malware attack, which commonly occurs for example when a website file download is either aborted or fails to truly operate due to protections like SmartScreen filter or others built into either the Edge browser or Windows itself.

Once the MAPS process is complete, the reporting and any remediation instructions or other items required for the Safety Scanner to finish its process are returned to the client via the cloud and performed locally, at which point the Safety Scanner UI displays a final reporting of whether any truly active malware was detected and/or removed, which in many cases results in 0 (no) active items having been found.

If this no active malware infections result is what you're seeing, that's totally appropriate, since as the above description shows, the initial detections of 15 'Infected files' is only preliminary, so it's this final determination by MAPS that truly matters.

Rob

 

microsoft safety scanner showing same files infected

Microsoft safety scanner keeps showing same 15 files infected