how to fix: amsi: \Device\HarddiskVolume4\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Hey Rachid,

The path you're seeing points to MSBuild.exe, which is a legitimate Microsoft component used for building .NET applications. The location under Windows\Microsoft.NET\Framework64\v4.0.30319 is normal.

AMSI stands for Antimalware Scan Interface. The amsi: prefix indicates that the detection involved AMSI scanning. The MSBuild.exe path identifies a process associated with the detection, but it doesn't necessarily mean the executable itself is infected.

One thing worth knowing is that malware can also abuse the legitimate MSBuild executable to run malicious code, so I'd check what triggered the detection before making any changes.

Here's what I'd suggest.

1. Check the actual detection

Open Windows Security > Virus & threat protection > Protection history.

Find the entry involving MSBuild.exe and check the threat name, detection time and action taken.

Also check whether it's a new detection or just an older entry still showing in the history. If it comes back after restarting Windows, that's worth investigating further.

2. Check the MSBuild file signature

Open PowerShell and run:

$paths = @(
    "$env:windir\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe",
    "$env:windir\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-AuthenticodeSignature -FilePath $path |
            Select-Object Path, Status,
                @{Name='Signer';Expression={$_.SignerCertificate.Subject}}
    }
}

The genuine Microsoft executable should have a valid Microsoft digital signature. Keep in mind that a valid signature doesn't rule out malicious code being executed through MSBuild.

3. Check Microsoft Defender's detection details

If you're using Microsoft Defender, open PowerShell (preferably as Administrator) and run:

Get-MpThreatDetection | Select-Object InitialDetectionTime, ThreatID, ProcessName, Resources
Get-MpThreat

These commands show which threats Defender has detected and when.

You can also update Defender and run a full scan. Open PowerShell as Administrator:

Update-MpSignature
Start-MpScan -ScanType FullScan

4. Check whether something is launching MSBuild unexpectedly

Do you use Visual Studio or other development tools? If so, seeing MSBuild running can be perfectly normal.

If you don't, or the warning keeps returning after every restart, I'd investigate what is launching it.

Microsoft's Sysinternals Autoruns can help identify suspicious startup entries and scheduled tasks. I'd look for anything referencing MSBuild or unexpected files under Temp or your user profile.

Download: https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

If MSBuild is still running when the warning appears, you can also check its command line and parent process using PowerShell:

Get-CimInstance Win32_Process -Filter "Name = 'MSBuild.exe'" |
    Select-Object ProcessId, ParentProcessId, ExecutablePath, CommandLine

This command is read-only. It only shows processes that are still running at the time you run it.

5. If the detection keeps coming back

I'd also consider running Microsoft Defender Offline Scan or Microsoft's Safety Scanner.

The Offline Scan restarts Windows and checks for malware outside the normal running environment, which can help with persistent threats.

Safety Scanner: https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download

I wouldn't delete MSBuild.exe or disable AMSI. Neither would fix the underlying cause, and disabling AMSI would reduce your protection.

Could you share a screenshot of the full warning, especially the threat name and the antivirus reporting it?

Also, does the warning appear every time you start Windows, or did it only happen once?

Those two details would help narrow this down quite a bit.