Jump to content

Scans not showing malware

Recommended Posts


Today when I clicked "check for updates" two updates started to download but then stopped on their own. When I tried to download them again windows said the system was already up to date. That seemed kinda fishy to me so I tried troubleshooting first and then did a scan with windows and malwarebytes and found nothing.

I downloaded rkill and sophos virus removal tool and got a warning from Windows about Smartscreen not being able to be reached. I've never gotten that type of warning before and I got it again when I downloaded the farbar tool. Sophos didn't find anything as well so I decided to do another scan on Windows but when I tried accessing Window's security center the app wasn't loading and when I tried accessing it through the settings app everything else was loading fine but the security center.

Another weird thing is when I tried redownloading Malwarebytes it wouldn't let me move my mouse to click the download link. My internet I think ended up disconnecting. I restarted my laptop and that's when my internet started working again and windows security center loaded without any problems. I'm just wondering if any  of this means my computers infected or I'm being weird.

I also included the rkill log sorry if its not needed. 

Addition.txt FRST.txt Malwarebytes Log.txt Rkill.txt

Share this post

Link to post
Share on other sites

Hi,   @NNYQ       :welcome:
My name is Maurice. I will be helping and guiding you, going forward on this case.   Please let me know what first name you like to go by.

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 
If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible. 
Please only just attach   all report files, etc  that I ask for as we go along.

Please do not run any other tools on your own without checking with me first.


Thank you for the reports.  The Rkill is a very specialized mini script.   It has a small defined scope set.  It found nothing.

The Malwarebytes for Windows reports no P U P  & no malware.

You report that the Sophos special scan found nothing.

The FRST shows that the Windows 10 is the latest build and has the latest security update from Microsoft.



Windows 10 has the Microsoft Windows Defender which can run the Windows Defender Offline scan.
Windows Defender Offline in Windows 10 can be run directly from within Windows, without having to create bootable media.

Click the Windows Start menu button on the Taskbar, select Settings icon. Then choose Update and Security.
In Windows Settings  >>> click on Windows Security from the left side list.
Next, In Windows Security section:  Click on the grey button Open Windows Security
next click on the blue Scan options
Look down the options list.  Tick on Windows Defender Offline scan.   Then click the grey "Scan now" button.

and let it scan the system.

Keep in mind that the design and what is scanned by Windows Defender is a whole different design from Malwarebytes. But do let me know how this scan goes and what the result is.

Share this post

Link to post
Share on other sites

Hello thank you for helping me! I go by Natalie. So that "Reparse Point/Junctions Found" on rkill really didn't mean anything? Okay thanks I was worried it might have been something serious. And I did the offline scan and couldn't find the log but security center says no action is needed. And I was looking at event viewer and saw this right before the scan started:

Windows Defender Antivirus Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
     Old value: N/A\Scan\OfflineScanRun = 
     New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Scan\OfflineScanRun = 0x0

Does this mean offline scan was disabled? 


Share this post

Link to post
Share on other sites

Hi Natalie.

You report   


I did the offline scan and couldn't find the log but security center says no action is needed

That's good to know.

You are able to run a Offline Windows Defender scan at any time, on demand.


Re-check to see that the Windows 10 '  Windows Defender is on.

Start >  Settings >  Update and Security  >  click Windows Security

click Open Windows Security.   Take a look.


Separately,  you may run an independent scan using a free ESET scanner.    a on-demand scanner.

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"

Save the file to your system, such as the Downloads folder, or else to the Desktop.
Go to the saved file, and double click it to get it started.

When presented with the initial ESET options, click on "Computer Scan".
Next, when prompted by Windows, allow it to start by clicking Yes
When prompted for scan type, Click on Full scan
Click on the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.
When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
Click The blue “Save scan log” to save the log.
If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
Press Continue when all done.  You should click to off the offer for “periodic scanning”.

Share this post

Link to post
Share on other sites

Eset found 2 potenial items the expressvpn is legitimate but I have no idea what the second item could be. The item was deleted is there anything else I should do?


Share this post

Link to post
Share on other sites

Actually I think I'm just going to do a clean install of windows. Thank you so much for your help!

Share this post

Link to post
Share on other sites

The ESET scnner tagged 2 installer files  ( that is what .msi files are )  that are not active.   Just stored copies.

They are classified by Eset as potentially unsafe application,   which is somewhat the same as potential unwanted program or P U P.

P U P  are not the same class as malware.


You can run a different scan for yet another opinion.

You can check this system using another free tool at Microsoft.  
The Microsoft Safety Scanner is a free stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system. 
The download links & the how-to-run-the tool are at this link at Microsoft 
take a minute to locate & then send the log that it made, named msert.log 
It should be at C:\Windows\debug\msert.log 

I personally would not do a Windows re-install in this kind of situation.   The 2 tagged installer files are not active and are not malicious malware.

and after all, the 2 tagged items were removed.   There were no other tagged items.



Share this post

Link to post
Share on other sites
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.