Safety Scanner found 12 infected files but scan results said no problems detected

Hi,

The "Files Infected" count displayed on the Microsoft Safety Scanner, scan in progress screen or any of their other security products for that matter, is actually just a preliminary status indication that there are items which may contain malware. In many cases these specific items have been found in the past to be related to malware, but they are all really just small fragments that have matched signatures, but aren't yet truly confirmed as the specific malware that might include them.

Near the end of the scanning process, say 95% complete, the Microsoft scanners all perform a MAPS (Microsoft Active Protection Service) request via internet to the the Microsoft cloud servers in order to upload their initial findings and request confirmation that these findings are either truly malware or instead possible false positive detections or incomplete fragments of inactive malware.

So what actually happened is that the scanner found possible malware fragments, communicated with the MAPS servers and confirmed there weren't any active malware that it can identify running and completed its operation by reporting these final results as well as uploading its reporting to MAPS as a record.

Back to your case, according to the screenshots there's nothing truly wrong with what the Safety Scanner found.

Thanks for your time.
Best regards,
Danny

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

I agree with @John Clegg here about the contradictory messaging. The scan progress screen should show "Suspicious files: 12" -- not "Files Infected: 12"

Additionally, based on the description @Anonymous gave of what the tool actually does, the description at the top of the scan progress screen should be modified to say something like this: "After this operation completes, the tool will send any suspicious files to Microsoft to determine if they are viruses, spyware, or other potentially unwanted software and report the results."

That would reassure users that the suspicious files will be further evaluated to determine if they are actually infected, so the final result of no infections will not be so contradictory that it leads to posts being created on Microsoft forums.

And since I'm already in here giving unsolicited advice about how to improve an already useful tool, it would be helpful if there was some indication of what it is doing when it starts the progress bar over again. Even if I start it on a scan of just the C drive, it seems to scan it multiple times. I assume it's using a different heuristic each time or something, but a better indication of how many heuristics or how many scans it needs would be nice. That would help me to estimate how much longer it will take to complete. The full scan takes all day on my computer with tons of files, so that extra indication would be very informative.

Danny, your answer is just silly.

What is wrong with Catwoman-3559's screenshots are that the first one says "Infected files: 12" and then the second one says "The scan completed successfully and no viruses, spyware, and other potentially unwanted software were detected."

These two pieces of information directly contradict each other and simply don't make sense.

MS could easily correct this confusion by changing the verbiage in the initial screenshot to “Possibly" Infected files: 12” or "Potentially" Infected files: 12" AND something like "Please see final "Scan results."

-John

Agree with @John Clegg and @Jon M above. The tool should also enumerate the identified "suspicious files" to allow further investigation at the user discretion.

I have used the MS Safety Scanner for somewhere in the vicinity of 15 years. The scan reports always have stated what the OP describes. I have always had my suspicions that the scanner does find more and removes more malware than what it states. My desktop has been doing weird things for awhile. Slow. My ESET says everything is fine. I downloaded this scanner and let it work. It scanned overnight. In the am, scan is almost done finds like 25 issues. It ends and the report states nothing was found. But now, my desktop is back to its normal behavior. Apps start faster, switching apps is faster, weird links popping up in the address bar. All of that is gone. This scanner removed something. I suspect that there are more malwares in the wild than any of the IT people want to admit. This is just the MS way of removing them.