I disable Eset temporarily via right click menu and MD turns it's protection on. I disable Eset to install repacked software that it mistakes as malware. It deletes them so I keep them in rar form until install. After install Eset is fine. Last night as soon as I disable Eset, MD turned itself on and deleted the repack. I opened up Win11 security center and verified that MD had turned itself on, set itself as the primary antivirus, and took corrective actions. So now I would have to temporarily disable Eset and then disable MD everytime. I figure someone here might have insight into this. I removed Eset for now.
Serious Discussion Eset & MD Win11 Conflict
Hi DotNet. What you saw is Windows’ antivirus handoff working as designed, not necessarily an ESET/Defender conflict.
When ESET is registered and providing real-time protection, Defender normally moves out of active mode. If ESET is paused and Windows Security Center sees that no third-party product is currently providing real-time protection, Defender can automatically reactivate and become the primary antivirus. Microsoft explicitly documents this failover behavior in its Defender compatibility guidance. If ESET becomes fully active again, Defender should relinquish the primary role. A genuine conflict would be both products remaining active after ESET has resumed.
Removing ESET simply makes Defender the expected primary antivirus; it does not solve the underlying detection.
I would also be cautious about treating the repack as a confirmed false positive. Being quiet after installation proves little: the detected component may be an installer wrapper, patch or crack that is no longer present afterward—or something may have executed and removed itself. Two products objecting is not proof of malware, but it is enough reason not to defeat both products blindly.
Practical next steps:
- Open Windows Security → Virus & threat protection → Protection history and record the exact Defender detection name and affected file. Leave it quarantined for now; Microsoft notes that allowing/restoring it lets the file proceed (Protection History documentation).
- If you retained ESET's log or screenshot, compare its exact detection name. A
PUA,HackToolorRiskwareclassification is different from a specificTrojan,BackdoororStealerdetection. - Prefer the software publisher’s original, digitally signed installer. With a third-party repack, there usually is no trustworthy vendor hash against which to verify the modified package.
- If you genuinely believe ESET made an error, submit the quarantined sample for analysis rather than disabling protection. ESET documents that process here.
ESET itself does not recommend disabling protection to install software. Windows making that inconvenient is rather the point of the safety net. If one of these detected repacks was already executed while protection was off—especially if the alert names a Trojan, stealer or backdoor—I would have the system checked through MalwareTips’ Malware Removal Assistance area rather than relying on a subsequent clean scan.
Sources
If you exclude the original file and still have problems running it with ESET or WD (with both still taking action), I would be very careful unless you’re testing malware on an isolated system.
Did you try uploading the original file to VirusTotal to see what other security vendors say?
“Free” software and game mods are really good lures for malware. Using them puts users in the high-risk category automatically, in my opinion.
Did you try uploading the original file to VirusTotal to see what other security vendors say?
“Free” software and game mods are really good lures for malware. Using them puts users in the high-risk category automatically, in my opinion.
Repacks are mostly games that are ripped for size. If there are 2 reputable AV flagging it,likely it is infected. Trojans are mostly found on such cracks.
Kindly share the file name,path or detection name so peeps can have a better idea what this is.
MD does not respect all GP rules; changing the interval of clearing history to 1 day did not make any difference.
Recently browsing
Members who viewed this thread in the last 5 minutes
You may also like...
-
Serious Discussion Core Isolation / Memory Integrity sanfu -
-
-
Malware News That Chrome update warning is most likely a scam -
