Serious Discussion Microsoft Defender Antivirus and firewall = 100 % clean?

[Oblivion99]

Hello

New laptop with Windows 11 pre-installed

The laptop was only online for a couple of minutes during initial setup and when downloading software from Microsoft Store

Only downloaded software from the Microsoft Store

Never visited any websites

Before it went offline:
Windows fully updated
Microsoft Defender Antivirus and Real-time protection on
Microsoft Defender firewall on

Completed Full scan = clean

Would you trust, that the laptop / system is clean?

Thank you

 

[Sephirothnight]

Hello,
there is no reason why it should not be

 

[Shadowra]

You can always scan with Malwarebytes or Kaspersky Virus Removal Tools, but for me, it's clean

 

[oldschool]

Hello,
there is no reason why it should not be

Absolutely. Especially if you have a NAS router firewall or modem combo.

 

[lokamoka820]

This setup is what I use from 2016 till now, and I scan my laptop monthly with Malwarebytes and Kaspersky Virus Removal Tool, and sometimes install 3rd party AVs just for curiosity, and I found no problems at all.

 

[Oblivion99]

but for me, it's clean

Is that meant for the things I have done?

Or do you only believe it is clean when using: Malwarebytes or Kaspersky Virus Removal Tools?

Thank you

 

[Oblivion99]

Absolutely. Especially if you have a NAS router firewall or modem combo.

And what if not using a NAS router firewall?

Modern combo?

 

[lokamoka820]

Is that meant for the things I have done?

Or do you only believe it is clean when using: Malwarebytes or Kaspersky Virus Removal Tools?

Thank you

It is meant for your setup and the things you have done.

And Malwarebytes or Kaspersky Virus Removal Tools just to be more sure, they called second scanners.

If your device always connected to the internet, MS Defender is sufficient, even if it misses something, it will find it in a way or other after definition updates, it scans in the background, no need to do anything more.

 

[Oblivion99]

If your device always connected to the internet, MS Defender is sufficient, even if it misses something, it will find it in a way or other after definition updates, it scans in the background, no need to do anything more.

If a malicious file download itself onto my laptop
Will the real-time scanner then scan it immediately?
Or first when the malicious file is ran / activated?

 

[lokamoka820]

If a malicious file download itself onto my laptop
Will the real-time scanner then scan it immediately?
Or first when the malicious file is ran / activated?

MS Defender scan all downloaded files immediately before you can run it, you can test this by yourself by the following test:

Feature Settings Check - Drive-By Download Test - AMTSO

Verify if your desktop security software detects drive-by downloads of malware To verify if your desktop security software detects drive-by downloads of malware, a simulated “drive-by download” will be initiated: a new web page or tab will open and your browser will automatically attempt to...

www.amtso.org

 

[Oblivion99]

MS Defender scan all downloaded files immediately before you can run it, you can test this by yourself by the following test:

Feature Settings Check - Drive-By Download Test - AMTSO

Verify if your desktop security software detects drive-by downloads of malware To verify if your desktop security software detects drive-by downloads of malware, a simulated “drive-by download” will be initiated: a new web page or tab will open and your browser will automatically attempt to...

www.amtso.org

1.
As in "immediately ", or after a couple of minutes?

2.
"before you can run it"
I run it - as I open the file?
Or the system?

 

[lokamoka820]

Here is the exact scenario:

• You click on the file to download, or it downloads itself by clicking a malicious link.
• MS Defender will watch the downloaded file to complete, and you will not have access to it at all even if you try to run/copy/rename/whatever, no operations allowed.
• The exact second the file will complete downloading (you still don't have access to it) it will be scanned and quarantine if it is malicious.
• If it was encrypted or password protected, it will be scanned and quarantine in the same second it became accessible.

If you clicked on the test I sent you, you will see the operation practically.

By the way, even already installed software are checked periodically with MS Defender and deleted if it become malicious or suspected, check this thread:

Question - Wise Care 365 Blocked and Deleted by Microsoft Defender and after trying to reinstall Autorun Organizer show it as malware

malwaretips.com

 

[Oblivion99]

• You click on the file to download, or it downloads itself by clicking a malicious link.

1.
What other ways could a malicious file from the internet download itself unto the laptop / system?

• MS Defender will watch the downloaded file to complete, and you will not have access to it at all even if you try to run/copy/rename/whatever, no operations allowed.
• The exact second the file will complete downloading (you still don't have access to it) it will be scanned and quarantine if it is malicious.
• If it was encrypted or password protected, it will be scanned and quarantine in the same second it became accessible.

2
Does above apply, no matter how the file has downloaded itself?

3.
Does above also apply to a file someone uploaded to the laptop / system via wifi?

 

[lokamoka820]

1.
What other ways could a malicious file from the internet download itself unto the laptop / system?

In this thread, you will find the ways you can get infected:

Serious Discussion - What All the Ways I Can Get Infected Machine, and How to Avoid That?

What All the Ways I Can Get Infected Machine, and How to Avoid That?

malwaretips.com

2
Does above apply, no matter how the file has downloaded itself?

3.
Does above also apply to a file someone uploaded to the laptop / system via wifi?

The mentioned scenario will apply to any file crated/opened/copied/pasted/modified/etc. to your laptop/system, it is not about how the file downloaded or where it came from, it is about any file in the system new or old.