Windows 10: Windows Defender - Scan API vs AMSI

Hello,

I'm using Windows Defender's legacy API to scan the output generated (fetched from various web sites) from my own application, if it's infected with malware or not.


At first i've tried to use Windows Defender with AMSI interface but that interface doesn't provide any details about the found malware. It just gives result true or false depending on if malware found or not. But i have to report the details of malware.


So i switched back to WD legacy api to scan malware. I'm writing my program's output to a file and scan it with WD legacy api which also provides me ThreatInfo struct that contains the all info about the detected malware.


But whenever i write my program's output to a file WD may sometimes scan and quarantine the file before i scan. So i decided to exclude that folder from WD which also causes API to skip scanning the explicit file that i try to scan with legacy api.


In the end i've two problems / questions:


1) Does AMSI interface provides a technique to get details of the scanned malware?

2) How can i prevent WD to scan my program's generated files before i scan and get it's details from WD api.


Btw, MSDN says this is the legacy api, is there a new API to use WD?

:)

 

defender scans

Hi Ian,

Thanks for posting your query on Microsoft Community.

This issue might occur if you have set any task scheduler for Windows Defender.

I suggest you to delete the task for Windows defender and check if it helps.

Follow the below steps:

• 
  Search and open Schedule tasks.
  
• 
  In the left-hand menu, open the Task Scheduler Library, then select
  Microsoft >Windows >Windows Defender.
  
• 
  Double-click Windows Defender Scheduled Scan.
  
• 
  Select the Triggers panel, then select Delete.
  

Hope it helps, reply to us with the status of your issue. We will be happy to assist you.

 

right click scan in windows defender?


thanks for that.. i didn't notice the tutorial section :x

I did the suggested registry change and it's now listed on the desktop context menu.. but all this does is ask if I want to open it, update, or start a scan... I was hoping for the option where you right click a specific file and it will have listed 'scan with windows defender' like other antivirus programs have.. MSE had it. I'll keep looking around to see if I can find it in the meantime..

 

Windows defender custom scan does not scan external drives

Hi Joe,

to scan external drives using Windows Defender, follow the steps provided below.

• Open Windows Defender.
• Go to Settings tab.
• Select the Advanced option.
• tick the checkbox for Scan removable drives.

Regards.