Stop me from wasting time on defender offline  

steve108 said:

What AV do you use @Ghot?

Bitdefender Internet Security 2020. It takes over Defender and works in conjunction with Defender.

Jimbo93 said:

I used something called snapshot b4 I heard of macrium in 2008 or so, paid for it too. Started using macrium maybe 4 years ago. Yeah very useful.

- - - Updated - - -

So I am trying the in place upgrade while defender is completely turned off. That should do the trick.

Here is the short version of the In-place upgrade tutorial...

DISABLE non-Microsoft:
a) antivirus software
b) firewall software
c) drive encryption software

Make a full OS backup with a program like Macrium Reflect (free)
Macrium Software | Macrium Reflect Free

Go here and get the Media Creation Tool and save it to your desktop.
https://www.microsoft.com/en-us/soft...load/windows10

RUN the Media Creation Tool and use it to: Create an ISO image... save IT to your desktop.
This will be the latest version of the ISO image.




Right click the ISO image and choose: MOUNT
Open File Explorer and you will see a new drive letter. It will look like a DVD optical drive.
Double click the new drive letter to open it.
Find setup.exe and double click it to start the in-place upgrade.

Choose the Keep personal files and apps option.

After it's all done... to UNmount the ISO image, right click the new drive letter and choose: EJECT.


The ONLY thing you will lose is some of your personalizations. Your programs and data will be intact.

steve108 said:

@Bree,
Did your jump from around 93% done to PC rebooting like I experienced? It didn't even give me a chance to see the final scan results Thanks.

I wasn't watching, but I don't recall an offline scan ever showing the final scan results.

The log is recorded in C:\Windows\Microsoft Antimalware\Support, mine apparently ended on attempting (and of course failing over WiFi) to perform a Cloud query.

Code:

2021-03-15T13:40:53.926Z [Cloud] Engine is requesting config to do cloud query [regular network].
2021-03-15T13:40:53.926Z [Cloud] Engine is requesting config to do cloud query [regular network].
2021-03-15T13:40:53.942Z Service stop requested (ServiceError: 0x0). Calling CleanupMpService ...
2021-03-15T13:40:53.942Z On demand scan closed without completion. Current scan state: 1. ScanSource: 7, Scan flags:0x10050004. NumberOfResources:2. bRemoveFromList:1
2021-03-15T13:40:54.054Z Unloaded module#0 MpComServer.
Microsoft Antimalware (F7F4CD20-7371-4319-B1DB-6FCFC68573EC) Log
Stopped On 03-15-2021 13:40:54 (Exit Code = 0x0)

Edit: tried again with Ethernet, with the same 'cloud query' result. Restart took place at 91%.

But according to the msssWrapper.log the local scan was completed successfully reporting an 0x0 result code.

Code:

INFO    2021/03/15 14:47:04:247 TID:1412 PID:1380
Launched Console UI, waiting...

INFO    2021/03/15 14:49:46:009 TID:980 PID:1380
CALLBACK: Scan complete.  hResult=0x0, threat count=0

INFO    2021/03/15 14:49:46:009 TID:1412 PID:1380
Wait finished (Scan signaled)

INFO    2021/03/15 14:49:46:009 TID:1412 PID:1380
Getting results from scan...

INFO    2021/03/15 14:49:46:009 TID:1412 PID:1380
Scan completed successfully, attempting to clean any active malware.  Number of threats from scan: 0

INFO    2021/03/15 14:49:46:025 TID:1412 PID:1380
RunCallisto returned 0x00000000

INFO    2021/03/15 14:49:46:025 TID:1412 PID:1380
PreserveCallistoDetections returned 0x00000000

INFO    2021/03/15 14:49:50:045 TID:1412 PID:1380
Looking for Defender registry key on target OS

INFO    2021/03/15 14:49:50:519 TID:1412 PID:1380
Changes were committed to target OS hive.

INFO    2021/03/15 14:49:50:613 TID:1412 PID:1380
SetOfflineScanRunFlag returned 0x00000000

INFO    2021/03/15 14:49:50:613 TID:1412 PID:1380
Offline scan completed with 0x00000000

FINISH    2021/03/15 14:49:50:613 TID:1384 PID:1380