Safety Scanner found 12 infected files but scan results said no problems detected

Hi,

The "Files Infected" count displayed on the Microsoft Safety Scanner, scan in progress screen or any of their other security products for that matter, is actually just a preliminary status indication that there are items which may contain malware. In many cases these specific items have been found in the past to be related to malware, but they are all really just small fragments that have matched signatures, but aren't yet truly confirmed as the specific malware that might include them.

Near the end of the scanning process, say 95% complete, the Microsoft scanners all perform a MAPS (Microsoft Active Protection Service) request via internet to the the Microsoft cloud servers in order to upload their initial findings and request confirmation that these findings are either truly malware or instead possible false positive detections or incomplete fragments of inactive malware.

So what actually happened is that the scanner found possible malware fragments, communicated with the MAPS servers and confirmed there weren't any active malware that it can identify running and completed its operation by reporting these final results as well as uploading its reporting to MAPS as a record.

Back to your case, according to the screenshots there's nothing truly wrong with what the Safety Scanner found.

Thanks for your time.
Best regards,
Danny

-----------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Danny, your answer is just silly.

What is wrong with Catwoman-3559's screenshots are that the first one says "Infected files: 12" and then the second one says "The scan completed successfully and no viruses, spyware, and other potentially unwanted software were detected."

These two pieces of information directly contradict each other and simply don't make sense.

MS could easily correct this confusion by changing the verbiage in the initial screenshot to “Possibly" Infected files: 12” or "Potentially" Infected files: 12" AND something like "Please see final "Scan results."

-John

I agree with @John Clegg here about the contradictory messaging. The scan progress screen should show "Suspicious files: 12" -- not "Files Infected: 12"

Additionally, based on the description @Anonymous gave of what the tool actually does, the description at the top of the scan progress screen should be modified to say something like this: "After this operation completes, the tool will send any suspicious files to Microsoft to determine if they are viruses, spyware, or other potentially unwanted software and report the results."

That would reassure users that the suspicious files will be further evaluated to determine if they are actually infected, so the final result of no infections will not be so contradictory that it leads to posts being created on Microsoft forums.

And since I'm already in here giving unsolicited advice about how to improve an already useful tool, it would be helpful if there was some indication of what it is doing when it starts the progress bar over again. Even if I start it on a scan of just the C drive, it seems to scan it multiple times. I assume it's using a different heuristic each time or something, but a better indication of how many heuristics or how many scans it needs would be nice. That would help me to estimate how much longer it will take to complete. The full scan takes all day on my computer with tons of files, so that extra indication would be very informative.

Agree with @John Clegg and @Jon M above. The tool should also enumerate the identified "suspicious files" to allow further investigation at the user discretion.

I totally agree with the answers above that the wording is confusing and should be changed. Secondly when the scanner is doing it's mapping step if you have a large number of "Infected files" (I had over 400) the scanner seemed like it is stuck because the file counter stops. I restarted my scanner a second time in safe mode because I thought the first time, which took more than 2 days, failed. There could be a message added to indicate what was happening during the mapping step so users would not assume that the scanner had stopped or was stuck.