I received warning for Win32/Defendertamperingrestore everyday

Hi Helpmefastt

Click your Start Button, then just type cmd

On the resulting list, right click Command Prompt and select 'run as Administrator'

Paste each of these commands into Command one at a time and press Enter, wait for each command to complete, before running the next command, if you receive an error on any command, ignore that and continue to the next command . . .

reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\real-time protection\DisableBehaviorMonitoring" /f

reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKLM\Software\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /f

reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f

reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f

reg delete "HKCU\Software\Policies" /f

reg delete "HKLM\Software\Microsoft\Policies" /f

Then, close Command Prompt and restart (not shut down) your PC . . .

Hi Tunachn,

I do not believe that "Vir Tool" is actually a "virus". I think it is just a notification that

something within Defender is not as it should be.

In your case, "DisableBehaviorMonitoring" is that which is wrong. As shown in your

screenshot. I expect that you have already scanned for viruses, repeatedly. So other

existing malware should not be present.

You can correct BehaviorMonitoring, and check for other conditions that might cause

"Vir Tool" to repeat, by using Windows PowerShell (Admin).

Open PowerShell (Admin) by right-clicking "Start" and select it. In PowerShell, type this Cmdlet.

Get-MpComputerStatus and hit <enter> You should see a list that looks like this...

Compare this list to the one you that you just created. You will find that DisableBehaviorMonitoring

will have the status of FALSE in your list. The only other item with status of FALSE should be "VirtualMachine".

If you have any others with the status of FALSE, they will cause "Vir Tool" to repeat.

To correct DisableBehaviorMonitoring, you will need to run another Cmdlet in PowerShell.

Type Set-MpPreference -DisableBehaviorMonitoring $False and hit <enter>.

If you found any others with the status of FALSE, they will need to be corrected also. Please respond

for instructions for correcting them.

To leave PowerShell type Exit <enter>.

Restart your PC and access Defender again.

Good luck, Glen

the problem is gone but now am worried that does my computer have any other virus coz i think the commands u told me are skipping files because before all these commands my quick scan used to scan 40000 files but now it only does 18000 why?

PLS HELP!!

Hi Helpmefastt

Rest assured, each of those commands are legitimate and will do no harm to your PC, and hopefully they will resolve the problem for you, check my Profile, if you wish, I have been here a long time and help many people . . .

i did a offline scan with microsoft defender now the same virus is affecting- regkeyvalue: hklm\software\policies\microsoft\windows defender\real-time protection\DisableBehaviorMonitoring

and it affected-regkeyvalue: hklm\software\policies\microsoft\windows defender\DisableAntiSpyware

too 

pls help BTW u didnt tell in how much time it auto heals

and my offline scan is showing the wrong date and time

am rlly worried PLS HELP!!!