Windows 10: VirTool:Win32/DefenderTamperingRestore constantly being detected after safety scanner...

i will admit that I'm quite reckless with downloads but i only do so when i think its safe, i recently scanned my computer and i found virtool that was meant to weaken my antivirus.it was said to be removed by MSERT however it keeps reappearing every couple of days even when i haven't downloaded anything new. clearly MSERT isn't removing it so is there another way of doing so oddly Malwarebytes does not detect anything whatsoever and never has detected anything. so it is odd how only MSERT detects it.hopefully someone can answer how to get rid of this thanks

:)

 

Microsoft Safety Scanner found a Trojan Horse... vintool32/defendertamperingrestore.

My computer was was running slow and freezing up and I ran Microsoft Safety Scanner and it found and removed vintool32/defendertamperingrestore. I restarted my computer and it ran perfect for two days and I ran another scan and the same file was back.
Is there a way to fix this problem for good?

 

Threat detected: VirTool:Win32/DefenderTamperingRestore

Good evening.

Today I did a scan with Microsoft Security Scanner and it found this virus and removed it.

Threat detected: VirTool:Win32/DefenderTamperingRestore

regkeyvalue://hklm\software\microsoft\windows defender\\DisableAntiSpyware

SigSeq: 0x0000055555C57273

Then I've done another scan with microsoft safety scanner, another with malwarebytes and another with kaspersky.

They haven't found anything.

I read here the description of the virus and it seems a false positive, linked with windows defender :

https://www.microsoft.com/en-us/wds.../DefenderTamperingRestore&ThreatID=2147741622

If someone has experience with this threat can confirm that is a false positive or a real virus ?

And if it's a real virus, or I have to do something else ?

 

Win32/DefenderTamperingRestore caught by Windows Defender

Looks like Microsoft has updated the entry on their security site - this is a catch to reconfigure real-time detection if it has been disabled. Below is what is listed on MS's site now:

Summary

This detection is for suboptimal configurations that may prevent Windows Defender Antivirus from functioning properly.

If you see this detection, a suboptimal configuration was detected, and Windows Defender Antivirus will auto-heal by automatically resetting to more secure configurations.

https://www.microsoft.com/en-us/wds.../DefenderTamperingRestore&ThreatID=2147741622