![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hi Tunachn,
I do not believe that "Vir Tool" is actually a "virus". I think it is just a notification that
something within Defender is not as it should be.
In your case, "DisableBehaviorMonitoring" is that which is wrong. As shown in your
screenshot. I expect that you have already scanned for viruses, repeatedly. So other
existing malware should not be present.
You can correct BehaviorMonitoring, and check for other conditions that might cause
"Vir Tool" to repeat, by using Windows PowerShell (Admin).
Open PowerShell (Admin) by right-clicking "Start" and select it. In PowerShell, type this Cmdlet.
Get-MpComputerStatus and hit <enter> You should see a list that looks like this...
Compare this list to the one you that you just created. You will find that DisableBehaviorMonitoring
will have the status of FALSE in your list. The only other item with status of FALSE should be "VirtualMachine".
If you have any others with the status of FALSE, they will cause "Vir Tool" to repeat.
To correct DisableBehaviorMonitoring, you will need to run another Cmdlet in PowerShell.
Type Set-MpPreference -DisableBehaviorMonitoring $False and hit <enter>.
If you found any others with the status of FALSE, they will need to be corrected also. Please respond
for instructions for correcting them.
To leave PowerShell type Exit <enter>.
Restart your PC and access Defender again.
Good luck, Glen