Windows 10: VirTool:Win32/DefenderTamperingRestore is triggering / recurring almost everyday on alot of...

Hello,We've recently moved from our main AV that we used for years to microsoft defender. So we've uninstalled our main AV on all of our devices, and we pushed / enabled microsoft defender via our RMM platform and on 80% of our devices everything runs / is fine.BUT, on 20% of our devices we are getting a lot of alerts regarding : "AV: Defender VirTool:Win32/DefenderTamperingRestore" this alert has to do with a reg key : hklm\\software\\policies\\microsoft\\windows defender\\\\DisableAntiSpyware , in the alert see picture it's not clear to see what is causing this alert, so it's driving us cr

:)

 

Win32/DefenderTamperingRestore

Hi there.

Anybody can help me with how to clean my computer from this virus:
Win32/DefenderTamperingRestore

Usually, when I run MSERT.exe it says that this virus was eliminated. But I have some questions:

a) Is it a memory-resident malware?

b) Is it launched in my computer startup?

c) Or is it activated when I run some software. How can I know which software is launching it? I guess that MSERT must know.

d) Where it is located?

e) How can I delete it?

f) FINALLY.......IS IT DANGEROUS? (For example, Is my computer safe to use it with my credit card payments)

Regards

Hernán Covarrubias

Mobile: +569 9870 3539

Private mail: *** Email address is removed for privacy ***

 

Win32/DefenderTamperingRestore

Hello I am an independent advisor for the Microsoft community. I did a quick search and found that this isn't actually a virus, it's actually Windows Defender notifying you about your settings. Here is the page with more info:

https://www.microsoft.com/en-us/wdsi/threats/ma...