If malware has a strong enough grip on your computer to do that to the registry, it is already in control of your computer. AFAIK any AV can be killed by means of registry changes.
It is supposed to get disabled, but sometimes that doesn't work.
Thank you for pointing this out. Is there a way to know for sure if it is completely disabled or not?
I forget the exact name of the WD process that you can see in Windows task manager, or in whatever app you use to monitor running processes. I am running linux right now, so I can't check. Just make a note of it, on a system where it is running properly. If you see that process running on another system, then you know that WD is not disabled.
WD or now MD main-process: MsMpEng.exe => "Antimalware Service Executable" / "Microsoft Defender Antivirus Service"
I downloaded Defender Control v1.6 ,which EndangeredPootis has recommended, and it shows caption if Windows Defender is disabled.In my case yes, Kaspersky product I have has disabled it.
This only affects home users, you can still disable Windows Defender through Group Policy.
Anti-Tamper prevents that, Microsoft reasoning is obviously that, but also to force third-party Anti-Virus vendors to use the proper APIs, instead of hacks.
Yes, but see above, some third-party Anti-Virus vendors were using hacks to disable Windows Defender instead of the proper APIs, those weren't working properly since Microsoft introduced Anti-Tamper.
Yes it is. It doesn't install anything onto your system. You just run it and click Disable Windows Defender and when you exit it, it leaves nothing on your system. You can run it again and re-enable Windows Defender again if you ever need to.
