I use Norton Security. Monthly I do scans with Malwarebytes and Emsisoft Emergency scanners and also do Norton's scan. None ever find anything. Today, for first time in probably a year or more, I ran Microsoft Safety Scanner for 64 bit. It had one detection, "virtool:win32/defendertamperingrestore" , and stated it removed it. I searched for it. There is not that much information. One search result pointed to a Microsoft support page: https://www.microsoft.com/en-us/wds...DefenderTamperingRestore&threatId=-2147225674 Based on that page, this does not seem to by any kind of virus but just a setting in Microsoft Defender: " Summary This detection is for suboptimal configurations that may prevent Windows Defender Antivirus from functioning properly. If you see this detection, a suboptimal configuration was detected, and Windows Defender Antivirus will auto-heal by automatically resetting to more secure configurations. " That is a description from finding this with Defender. I did not scan with Defender but Microsoft Safety Scanner. I assume it is the same. I rescanned with all scanners. None found anything, including a re-download and re-run of Microsoft Safety Scanner. Should I worry about this? I could do a system image restore from an imagine done ~6 months ago to be extra safe, but would rather not if this detection is what is stated in that Summary and only a setting in Defender.
Perhaps this may give you some clues https://community.norton.com/en/forums/virtoolwin32defendertamperingrestore
I found that earlier. It is somewhat reassuring but no confirmation and it is just iterating that Microsoft blurb more than anything.