MSE question

[Marcus]

Does anybody know where Microsoft Security Essentials stores scan log files? I can't find the damn things anywhere!

A few minutes ago I removed Avast! 4.8 totally and put on MSE, updated, did a quick scan, rebooted and went off line and have just done a full scan. Log are not in my account/AppData/Local or LocalLow or Roaming.

Quick look in C:\Windows shows nothing,even in Logs. I admit I haven't checked system32 - bit of an odd place anyway to put log files - not expecting to find 'em in there.

So where've they gone to??

Any MSE users able to fill me in on this?

[Ahem...I'm assuming that MSE does produce a log file even if a given scan turns up nothing of interest. Otherwise I shall feel a total plonker! ; which has been known in the past ]

[yardbird]

http://social.answers.microsoft.com/Forums...4d-e1bb71f20832

Look around the above website! I use MSE on 2 other pc's but did not get around to downloading it to this one yet! FWIW

EDIT I know YoKenny1 & myself used the beta, he may still use it. I use Trend Micro Internet Security, and was warned about conflick issues. But both programs ran fine!

I never thought about looking for the log... someone will come by & answer your post..

[mountaintree16]

I have used it a little bit since I installed it on the machine of a friend that I was taking a quick look at (she had no AV, just WD), and I've installed it on the machine of another friend of mine as well, so I have a decent amount of experience with it. The interface is very user-friendly but I did not see anywhere for a logfile. Kaspersky has a spot, AVG has a spot, Avira has a spot, and it's been a long time since I've used Norton or McAfee, but I'm sure they must have a spot too.

It doesn't seem to me that MSE really has anywhere for a logfile to be... unless it's not accessible from within the program itself, but if it's not accessible form within the program itself, then well that doesn't make much sense. I am going to see if I can't find an answer on this on the Microsoft site, and hopefully someone who knows for sure or not may be able to reply here

[yardbird]

Marcus -- noknojon runs MSE I was just in PM with him, he's fighting a flood right now

[mountaintree16]

I hope he's okay

[yardbird]

right now its more like a big leak in his garage -- but he's off the coast of Victoria, Australia

[mountaintree16]

I hope everything will be alright for him

Marcus-

Give this a look I'm still hunting but this looks good so far

http://social.answers.microsoft.com/Forums...4d-e1bb71f20832

Edit,

Here's another link I found:

http://social.answers.microsoft.com/forums...19-4FA6774FBD5A

[Marcus]

Thanks mt16 and yardbird for that info; I'll see what turns up and let people know here.

Will catch up with you guys and noknojon later.

Cheers!

[mountaintree16]

You're welcome!

Yes, when you have a chance, let us know! I actually was wondering the same thing, if it had a logfile, in the back of my mind. Definitely a useful thing to have!

Cheers

[yardbird]

some are pointing to the event viewer?

Edit: good luck on that, seems your not the only 1 who posted that question

[yardbird]

http://social.answers.microsoft.com/Forums...cb-fda4393ac50f

this is back in Nov 2009....

As of version 1.0.1961.0, Microsoft Security Essentials shows you when the last scan was performed and the type of scan at the bottom of the main screen.

If a threat was found, you will see that information in the History tab.

If you want to see when earlier scans were performed, you need to check the Event Viewer - Control Panel/Administrative Tools/Event Viewer.

good luck..

[Marcus]

Yardbird, and mt16: there are two log files in, of all places, .../Windows/Temp(!!!). Damn silly place to put them! I've had a look at these and they're not not scan logs. Opened in notepad and you're faced with gibberish

The only place I can find any info is in the eventviewer but you won't find logs in there as we understand the term "logs".

It looks to me that no formal scan logs are either hardwired in or an option in MSE and that the only logs (if they can be called that) are those of picked up infected files/objects ONLY; so it looks like Yardbird's reply (above this one), is likely to be right.

For some strange reason that link (and mountaintree's two links) don't work correctly for me. I log in with no problem and then get to an MS page which is virtually blank! Weird. I can't get past it. No error messages or other dialog; just nothing happening. I've tried logging in there before a few times with the same (non) responsive page appearing. Very strange.

I wonder what noknojon's input would be here?

I hope he's ok with that flooding problem; it does sound more than a straightfoward domestic plumbing problem.

[mountaintree16]

That's weird. I can copy and paste the text if you'd like Marcus.

Thanks for reporting back here too

That's so odd... logfiles are helpful, even if nothing is really found, still an event log is nice...

Weird...

[Marcus]

Yes please. I'd like to see that information. At least there'd be a record somewhere of what MS plus community has to say.

On second thoughts it does make a sort of sense in that MS wanted to keep MSE as simple and automated as possible so they might've reasoned thus: why produce yet another log if nothing is found?

Let's give the user some information only if anything is found.

In other words keep it as uncluttered as possible with the absolute least amount of logging. The bare essentials, literally, as the name might suggest.

Anyway I'll wait for mountaintree's input.

[yardbird]

Leave the post here, you may get more replies! I would have to download it & play around with it... but I'm at work for another 1/2hr. I also heard it send the info - logs to MS? but I can't confirm that.. lots of forums to read thru.....

[mountaintree16]

Absolutely

Be aware; it's pretty long. Let me know when you've seen it and I'll erase it or most of it as its pretty lengthy.

From the first link;

How to set MSE log file size limit?

Locked

Saturday, October 10, 2009 2:06 PM

At the folder "C:\Users\All Users\Microsoft\Microsoft Antimalware\Support\" The MPLog file grows quite big in size.

How to set MSE log file size limit? Is there a way to clear old log?

1 person got this answerI do too

Answers

Monday, October 12, 2009 9:12 PM

Jeff Toole [MSFT]

MSE logs when a file takes longer than usual to scan (an "Expensive" file).

I'm not aware of a way to limit the log file size in MSE, but the need for such functionality is known. We have added support for this, and hopefully it will make it into the next version of MSE. For now you will have to manually delete the file if it becomes too large (you may have to take control of the Microsoft Antimalware folder.

Jeff Toole - Microsoft Antimalware - This post is provided as-is with no warranty or support.

Proposed As Answer byJeff Toole [MSFT]

Monday, October 12, 2009 9:12 PM

Marked As Answer byJimR1

MVP

, Moderator

PA Bear MS MVP

MVP

GreginMich

Tuesday, October 13, 2009 1:44 AM

PA Bear MS MVP

MVP

Maybe in WinXP Pro but not in WinXP Home.

~Robear Dyer (PA Bear); MS MVP (IE, Mail, Security, Windows & Update Services) since 2002; Disclaimer: I neither represent nor work for Microsoft

Tuesday, October 13, 2009 2:53 AM

GreginMich

Robear, it works fine on the Professional, Home, and Media Center Editions. I just tested all 3. It should also work on the newer operating systems.

You can't open the msmpeng.exe file as it is the scanning engine for MSE.

I think MP stands for Malware Protection.

The only file you should be looking for is the one where the data is being logged. I'm not at a Vista machine right now, but the path for Windows 7 is:

\ProgramData\Microsoft\Microsoft Antimalware\Support\

The log file is MPLog-11112009-045052.log on my Windows 7 machine here.

There are other log files in there that can be interesting, but you first need to create the Support Logs as described here: http://social.answers.microsoft.com/Forums...1d-15b6fdc8e388

See this thread, too:

http://social.answers.microsoft.com/Forums...50-3c013f8d1d44

Not much more here except the location of the log files: http://social.answers.microsoft.com/Forums...5d-38805682c96a

-steve

~ Microsoft MVP Windows Live ~ Windows Live OneCare| Live Mesh|MS Security Essentials Forums Moderator ~

Proposed As Answer bycoolnewyorker

Friday, February 12, 2010 7:30 PM

How to see details of all threats found in a scan?

Locked

Monday, October 05, 2009 3:01 PM

barryc.ctr

Beta?:No

When I use MSE and scan a baseline folder full of malware, the resulting threats found are detailed in a smallish scrolling window. How can I save the info out to a single text or similar file that I can later review and/or parse?

Edited byKeith-Support Engineer

Microsoft Support

, Moderator

Tuesday, July 20, 2010 8:38 PMMeta tag

1 person got this answerI do too

Answers

Monday, October 05, 2009 3:06 PM

Stephen Boots

MVP, Moderator

You can't. However, there is apparently a log file being written which you may want to check. Details here:

Finally the link from the details here above;

There have been a number of questions asked about how to tell if the scheduled scan ran or not and the answer has been to check the system even logs. Is there an easier or more clear resource?

VP Tech Services

1 person got this answerI do too

Answers

Monday, October 05, 2009 4:12 AM

Ross Jaburg

I only posted the above question in order to answer it myself as I know a number of people might want to know where to get detailed info on the last (and recent) virus scan(s).

C:\ProgramData\Microsoft\Microsoft Antimalware\Support

is the location for some extremely detailed log files (open with notepad)

C:\ProgramData\Microsoft\Microsoft Security Essentials\Support

is where to go for install log, upgrade log, etc.

VP Tech Services

Marked As Answer byRoss Jaburg

Monday, October 05, 2009 4:13 AM

Monday, October 05, 2009 6:06 AM

Rob Koch

MVP, Moderator

For Windows XP these same two folders are found instead in the paths of:

C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Support

C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Security Essentials\Support

[yardbird]

same forums I was on MT16... something else to read when your done.....

And the text logs that are generated by creating a Support log can only be refreshed by rerunning the command line for the Support log. Additionally, the logs in the Support folder can

[Marcus]

Thanks mt.

...eerm...those logs are there...in Chinese!! Don't ask please!! I have absolutely no idea what is going on with MSE here. Either it's Chinese (95% sure) or it's total gibberish.

Time for a teabreak while I have a think about what to do next.

mountaintree I've saved this entire thread both as a text file and as an mht one. so you could delete it if you feel the need to.

Toss a coin: have Microsoft blooped here? Can members who use MSE check their logfiles and see what they come up with?

[yardbird]

can you send me or post the giberish you got from the event viewer, see if I can make it readable?

EDIT 50/50 chance

[mountaintree16]

No problem Marcus Happy to do it!

I was just gonna delete it coz it's so long. I'll leave it up for a few days for now anyway.

[yardbird]

in Chinese!! what? what MT16 posted is in english? lost me

[Marcus]

This log is not from the eventviewer. It's MSE's log and the full pathway on a Vista (x486) system is: C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\History\Results\Quick

_24C8A54A_6BEB_408A_8125_9FDDF6BE33CB_.txt

[mountaintree16]

I think Marcus was saying that his logfile or what appears to be his logfile is either Chinese or a whole lot of nothing aka jibberish that isn't readable/distinguishable.

[yardbird]

ok let me look it over...

[yardbird]

its a system file, what can read a system file?