Windows 10: Threat detected: VirTool:Win32/DefenderTamperingRestore

Good evening.

Today I did a scan with Microsoft Security Scanner and it found this virus and removed it.


Threat detected: VirTool:Win32/DefenderTamperingRestore

regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware

SigSeq: 0x0000055555C57273


Then I've done another scan with microsoft safety scanner, another with malwarebytes and another with kaspersky.

They haven't found anything.


I read here the description of the virus and it seems a false positive, linked with windows defender :

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/DefenderTamperingRestore&ThreatID=2147741622

If someone has experience with this threat can confirm that is a false positive or a real virus ?

And if it's a real virus, or I have to do something else ?

:)

 

Win32/DefenderTamperingRestore caught by Windows Defender

Looks like Microsoft has updated the entry on their security site - this is a catch to reconfigure real-time detection if it has been disabled. Below is what is listed on MS's site now:

Summary

This detection is for suboptimal configurations that may prevent Windows Defender Antivirus from functioning properly.

If you see this detection, a suboptimal configuration was detected, and Windows Defender Antivirus will auto-heal by automatically resetting to more secure configurations.

https://www.microsoft.com/en-us/wds.../DefenderTamperingRestore&ThreatID=2147741622

 

Win32/DefenderTamperingRestore caught by Windows Defender

Microsoft has updated their documentation since this morning indicating that it is the result of sub-optimal Windows Defender configurations. It would appear to be a false trigger:

https://www.microsoft.com/en-us/wds.../DefenderTamperingRestore&ThreatID=2147741622

 

Threat detection Options confusion

Hello,

I had a virus on my PC and windows defender quarantined it.

But I clicked on the “Action” button and has three options: Removes , Restore , and Allow

I clicked on Remove, but the threat status changed to: “threat removed or restored “

Which is confusing.

I then clicked again on the “Action” button and only 1 option appeared which is “ Allowed” I mistakenly Clicked on. But then I removed it from the “ allow history “

So my question:

• does allowing a “ removed or restored” threat means releasing it again in the PC or it means only allowing the future similar threat?

Because I run a scan after i removed it from allow history and nothing is detected.

I’m very confused. I would appreciate help.

My threat was : worm win32/bundpil. “Two letter “