What’s hvciscan_amd64.exe (HVCI Compatibility Scan)? Is it safe or a virus?

hvciscan_amd64.exe is a process written by Microsoft itself for its own OS.

Microsoft writes that the memory integrity system readiness scan tool, encompassing hvciscan_amd64.exe and hvciscan_arm64.exe, serves the purpose of assessing system compatibility with memory integrity.

This feature, a cornerstone of virtualization-based security (VBS) technology, is accessible in Windows 10, Windows 11, and Windows Server 2016 or newer versions. Memory integrity, alongside VBS, enhances the security framework of Windows, offering robust defenses against malware attempts to exploit the Windows kernel. By leveraging the Windows hypervisor, VBS establishes a secure, isolated virtual space that acts as the foundational trust layer for the operating system, even under the assumption that the kernel might be compromised. At the heart of this protective mechanism, memory integrity plays a pivotal role by ensuring kernel mode code integrity within this secluded VBS environment. It tightens security by controlling kernel memory allocations potentially exploitable to undermine the system, guaranteeing that kernel memory pages only gain execution rights following thorough integrity checks within this protected runtime environment, and maintaining that executable pages are never writable.

The tool alerts users about any existing compatibility concerns with the device, aiming to preemptively identify issues.

Researched by Carl @ SpyShelter Labs