The check came back clean. Here is what it looked at.

What a scan of one computer examines

• One computer, at the moment it runs. It is not running in the background afterward, so it says nothing about the days before or after.
• Up to 250 files that start automatically with Windows. Each file’s fingerprint (a hash) is compared against public lists of known malware.
• 25 registry indicators. These are specific places and values in the Windows registry where unwanted software is known to leave marks.
• The built-in antivirus’s own detection history. The scan reads what Windows’ antivirus has already recorded.

What that cannot show

• A file that is new, or changed so its fingerprint differs, has no match on a list of known malware. A hash check finds what has been seen before.
• A file beyond the 250 examined, or a mark somewhere other than the 25 places, is outside the check.
• The antivirus history records what the antivirus detected. It cannot show something it never detected.
• It cannot see inside a mailbox. Forwarding, inbox rules, and sign-ins on a Microsoft 365 or Google Workspace account are stored with the mail service, not on the computer.
• It does not cover the other computers, phones, or tablets.
• It reflects the day it ran. A computer examined on Tuesday says nothing about what was installed on Wednesday.

Reading the antivirus history yourself

On the computer, open Windows Security, choose Virus & threat protection, and look at Protection history. Microsoft’s support page for Windows Security lists Protection history as its own area and says the Current threats page shows quarantined and allowed threats.

A normal result is an empty list, or old items that show as removed or quarantined with dates you can match to an event you remember. An item that shows as allowed, or a detection dated shortly before the problem began, is the kind of entry to write down and bring to the review.

What a guided mailbox review covers

Microsoft’s guidance for a compromised Microsoft 365 account names the places to look. A mailbox review goes through five of them with you:

• Inbox rules, including hidden ones. Rules that forward or redirect mail, or move messages to Notes, Junk Email, or RSS Subscriptions.
• Forwarding. Whether mail is being sent to another address, and whether a copy still stays in your mailbox.
• Sign-ins. The IP address, location, time, and success or failure of each one, from the sign-in logs.
• App permissions. Programs that were given access to the account, which can be removed.
• Sign-in methods. The phones and devices registered for approval prompts, and any you do not recognize.

What a mailbox review cannot show

It cannot tell you what a person read, and it only covers the dates the logs cover. Messages someone deleted from Sent Items may be gone from view. It also says nothing about the computer you sign in from, which is why the two checks are separate and both are worth doing when you cannot tell which one is involved.

A mailbox that shows no rules, no forwarding, and sign-ins only from places you recognize is a good result. It still covers the dates the logs reach back to. If the first odd message was sent before that, the review cannot see it.

How we report it

We look at it with you. A person reads the result and writes it up with dates: what turned up, what didn’t, and what the check can’t see. A clean result covers the computer, the files, and the settings that were examined on the day they were examined.

That is the difference between “nothing found” and “nothing there”: the first can be shown, and the second cannot.

Related

• A Forwarding Rule in Your Email You Didn’t Create
• Keeping Evidence Before You Clean Up a Computer
• Antivirus Shows as Off and Nobody Turned It Off
• Sign-In Approval Prompts on Your Phone You Didn’t Start

Sources

• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Support: Virus and threat protection in the Windows Security app
• Microsoft Support: Stay protected with Windows Security