Hot Take Microsoft quietly reveals whether you need a third-party antivirus software in Windows 11

[SeriousHoax]

Also the same Microsoft Defender,

First, it makes Defender look the other way. It calls Add-MpPreference (with the cmdlet name split by a backtick, a small obfuscation to dodge naïve string-matching detections) to exclude %ProgramData% and %APPDATA% from scanning, exclude .exe, .msi, and .dll files from scanning, and exclude PowerShell, regasm.exe, rundll32.exe, msedge.exe, and chrome.exe from scanning.

Second, it widens the gap. A second Add-MpPreference block extends the exclusion list to include the .png file extension and the conhost.exe process—the exact two additions the next stage will need. It then writes AmsiEnable=0 into HKLM\Software\Policies\Microsoft\Windows Script\Settings, disabling Windows’ Antimalware Scan Interface—the layer that normally lets Defender read scripts before they execute. After this point, the malicious activity is being conducted in folders, with file types, and through processes that Defender has been instructed to ignore.

Source:

Fake Google Antigravity downloads are stealing accounts in minutes

Another AI launch, another trap. A trojanized Google Antigravity installer runs like normal, but secretly hands over your accounts to the attackers.

www.malwarebytes.com

Also the same Microsoft's automatic analysis decided that the Android mining and banking malware that I submitted are not worth analyzing. Status "Submitted" means the AI has decided to ignore it.

Also the same Microsoft has laid off employees who were fixing user-submitted false positives.
Very Nice, great success

 

[Zero Knowledge]

Ehm... why?

Because most malware does not survive a router reboot, doesn't mean you won't get reinfected the minute you turn it on though.

Even the NSA USA government advises people to reset or reboot once a week. Malware that survives a reboot/firmware upgrade is usually not used for home users.

 

[Marko :)]

Because most malware does not survive a router reboot, doesn't mean you won't get reinfected the minute you turn it on though.

Even the NSA USA government advises people to reset or reboot once a week. Malware that survives a reboot/firmware upgrade is usually not used for home users.

I have two issues with this.

First: router malware is extremely rare (almost non-existent) and the only way to get your router infected is if the attacker has physical access to the device. In that case, I think you have bigger problems than the malware itself. Even majority of vulnerabilities in Windows and Android are exploitable only if hacker gets physical access. These types of attacks don't concern me at all.

Second: I wouldn't blindly trust what US government says. Remember, Donny also said people should drink disinfectant to cure COVID-19. His minister of health is constantly promoting false health-related claims.

 

[Andy Ful]

As @SeriousHoax posted, the MD protection on the compromised computer with high privileges is kinda an illusion.

However, the same is true for any Home AV. Adding exclusions for persistence is a popular method in the case of MD. But there are many nasty ways to do it in the case of other AVs. Furthermore, MD has probably the best protection against UAC bypasses (I tested this several times).
So, at Home, MD + Edge + SmartScreen on a Standard User Account is enough or not enough, just like other Home AVs.

The protection of Home AVs can be satisfactory for some users, but of course, it should be improved in the case of children or happy clickers.

 

[monkeylove]

I think malware is now involved in "standard usage patterns" as they now appear in "legitimate" software and sites.

 

[Acadia]

PCWorld's opinion:

Windows 11's built-in antivirus is good enough for most people—with one catch

See where Windows Security stands tall and where it falls short for regular, daily use.

www.pcworld.com

 

[Minimalist]

I still prefer to use 3rd party antivirus over Microsoft defender, manly because overall impact on performance is lower with some 3rd party AVs than with MD.
I also prefer to use tools from developers that focus in one specific area and don't try to develop everything and a kitchen sink.

From my experience I agree that MD would be enough for my computing needs.
But OTOH, from same past experience, I would not feel any less safe even if I didn't use any AV, including MD.
AM is for me just last safety net, which is rarely, if ever, used on my system.

 

[Andy Ful]

PCWorld's opinion:

Windows 11's built-in antivirus is good enough for most people—with one catch

See where Windows Security stands tall and where it falls short for regular, daily use.

www.pcworld.com

From the article:
--------------------------------
You still need to smart, careful, and aware by:

• Not visiting shady websites
• Not downloading unsolicited files
• Not clicking links in emails or social media messages

---------------------------------

This also follows from some posts in this thread. We talked a lot in other threads about hardening the web browser and Firewall by using personal configurations via NextDNS, Cloudflare, AdGuard, etc. Also, blocking the outbound connections of some LOLBins can be welcome (especially against Click-Fix attacks). Such a hardening can significantly increase the protection of Home AVs.

 

[SeriousHoax]

As @SeriousHoax posted, the MD protection on the compromised computer with high privileges is kinda an illusion.

However, the same is true for any Home AV. Adding exclusions for persistence is a popular method in the case of MD. But there are many nasty ways to do it in the case of other AVs. Furthermore, MD has probably the best protection against UAC bypasses (I tested this several times).
So, at Home, MD + Edge + SmartScreen on a Standard User Account is enough or not enough, just like other Home AVs.

The protection of Home AVs can be satisfactory for some users, but of course, it should be improved in the case of children or happy clickers.

A single UAC prompt while installing an app should not be considered as a compromised computer. Because by that logic, every Windows PC out there should be considered a compromised computer, as Windows installs an admin account by default. This is alos Microsoft's excuse, but IMO, it's the lamest excuse possible.

Here, I added multiple folders to Defender's exclusion very easily. Can you show us a method as easy as "Add-MpPreference" where exclusions are added into a popular third-AV?
Adding exclusions to Defender should never be so easy, even if UAC is completely off. That's the main point, along with Microsoft caring less about home users now, as they don't even check false positive submissions anymore.

Spoiler: Content of the bat file

 

[Brahman]

The problem starts when you have some Gen Alphas in your home and they start to explore "Minecraft Launcher Free" or similar wordings on your home PC. Strict control (aka no admin account) is not always possible with home PCs.

 

[Sorrento]

Users who elect to use a 3rd party AV do not necessarily & I in my case do not pay £/$100's of what ever currency you use, for me I pay a pittance for any AV so its an irrelevancy in the decision - This thread evokes strong feelings of Déjà vu, or we just may have had similar threads many, many times, most on here already have good protection & practice safe surfing so whatever we use, likely we will be OK ...

 

[Andy Ful]

A single UAC prompt while installing an app should not be considered as a compromised computer. Because by that logic, every Windows PC out there should be considered a compromised computer, as Windows installs an admin account by default. This is alos Microsoft's excuse, but IMO, it's the lamest excuse possible.

When the malware bypasses UAC, the user does not see the UAC prompt. MD is very good at detecting such attacks, so this can reduce the chances of elevation to apply exclusions and make persistence. Most AVs allow malware elevation more frequently. At this infection stage, the malware has many possibilities to make persistence.

Adding exclusions to Defender should never be so easy, even if UAC is completely off. That's the main point, along with Microsoft caring less about home users now, as they don't even check false positive submissions anymore.

That is true. MD has some weak points, and other AVs have some (different) weak points. For some reason, Microsoft thinks that attacks with exclusions are not so dangerous for home users (I do not agree).
In Enterprises, the MD exclusions are protected by Tamper Protection. This is also possible at home, but this method causes MD to ignore the MPPreference-related settings in ASR rules, ASR exclusions, and MD exclusions. However, many users can still protect exclusions in this way, especially those who use the MD default settings.

 

[RansomwareRemediation]

I and everyone I know use Defender alone on default settings. 0 infections and we're talking about average users that don't really know how to recognize scam, let alone what is malicious and what not. Windows Firewall is also more than enough as it blocks internet access to all new apps by default. I'd even argue your router firewall is even more important than Windows one.

And don't be fooled, @Andy Ful 's configurator is only as powerful as Defender/Microsoft, lets it be. His app doesn't do anything magical, just changes some settings for advanced users through registry. Something you could achieve simply by going to Group Policy Editor and changing the values yourself.

Some kind of security DNS (Cloudflare, Quad9 or ControlD) + Google Safe Browsing and maybe some kind of security extension like Bitdefender Traffic Light if you're really paranoid, will do much better job than any antivirus software regarding web protection. And it costs you exactly 0,00€.

Security DNS servers usually use more than one threat intelligence source, along with Google Safe Browsing and Bitdefender Traffic Light, you're getting way better protection than just using one antivirus vendor.

I personally use Cloudflare Zero Trust + Google Safe Browsing in Firefox + uBlock Origin.

uBlock Origin is better because it gives user way more control than AdGuard extension. It also supports more syntaxes so pretty much all filter lists work in it correctly. And... it's way more efficient in resource usage than any other ad blocker out there. I'm talking about MV2 version, of course.

Ehm... why?

You forgot one, if not the most important thing. Hackers target companies, not you as an average Joe. They are aware you won't pay ransom, companies might not have a choice if they want to continue functioning.

10 years ago, if not more, hackers targeted indiscriminately; it didn't really matter if you were an average Joe or the company. We were equal. Nowadays, they exclusively attack companies because why waste time on you when they can earn way more money in enterprise sector. You can clearly see this in ransomware attacks. Everyone was attacked when it came, now you rarely see someone getting it and more often how some company or hospital got attacked.

Finally someone with common sense! THANK YOU!


Everyone is free to use whatever they want. We're just pointing out that you don't need to spend hundreds of €/£/$ yearly in order to have excellent protection. I most of the cases, free products will protect you even better than paid ones.

I'll just comment on comparison regarding ISP routers; at least in my country, 99% population uses ISP supplied router. It's fast enough and people don't mess around in router settings. This way they don't have to buy equipment, set it up themselves and ISP takes care for everything in case of any issues. The only benefit of using your own router is having total control and way more features than ISP router couldn't even provide. But still... the fact is 99% of people don't need the features my own router has; people only want fast internet access and that's what every ISP-issued router will provide.

For me, 3rd party antivirus software is simply a scam. Just look at "protection modules" that your "antivirus" software offers. There's no better example than Android antivirus apps; these apps are everything except antivirus.

Just because you don't get infected, that means absolutely nothing. It's like saying I don't wear a seat belt, because I will never have an accident. I would never and will never trust a company like Microsoft. Knowing how they treat their clients.

 

[Minimalist]

Just because you don't get infected, that means absolutely nothing.

I agree that not being infected by itself does not say much about anti malware efficacy.
More important information would be: how many times did anti malware solution prevented infection from happening. If it never had to intervene than we can't say much about how good it is, just by this information.

 

[SeriousHoax]

That is true. MD has some weak points, and other AVs have some (different) weak points. For some reason, Microsoft thinks that attacks with exclusions are not so dangerous for home users (I do not agree).

Ok nice! So we actually agree on this.

In Enterprises, the MD exclusions are protected by Tamper Protection. This is also possible at home, but this method causes MD to ignore the MPPreference-related settings in ASR rules, ASR exclusions, and MD exclusions. However, many users can still protect exclusions in this way, especially those who use the MD default settings.

I see. Can you tell us how to achieve this?
So it means that by doing this, we won't be able to use Configure Defender or similar tools to modify Defender settings.

 

[Andy Ful]

I see. Can you tell us how to achieve this?

I use these policies (Windows restart is required):

# MD skips native (PowerShell MpPreference) ASR rules + ASR exclusions + MD exclusions.
# The currently active rules and exclusions are still correctly read when using get-mppreference in PowerShell.
# Tamper Protection is enabled and locked in the Windows Security Center.

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"ManagedDefenderProductType"=dword:00000007
"DisableLocalAdminMerge"=dword:00000001

Those settings are used when managing Defender via MDM.

So it means that by doing this, we won't be able to use Configure Defender or similar tools to modify Defender settings.

Most settings can still be configured, except for ASR-related rules and Defender exclusions.
Other methods must be used to maintain ASR rules. I could include this in ConfigureDefender, but this would make it more complex.

 

[Marko :)]

Just because you don't get infected, that means absolutely nothing. It's like saying I don't wear a seat belt, because I will never have an accident. I would never and will never trust a company like Microsoft. Knowing how they treat their clients.

Trust me. If you have a brain and use logic, you cannot get infected. This comes from a person that used PC without any antivirus protection for years. In fact, I only use Defender and on minimal settings just so Windows wouldn't bother me to activate protection.

The only way to get infected nowadays it's by running malicious file. If you don't download anything or download files only from reputable sources, you simply cannot get infected. Not even through malicious website script as web browsers rapidly evolved and now pretty much all block malicious script. If you use ad blocker, the chance is pretty much equal to zero.

This is like those online scams. If something looks too good to be true, then it is. Scams work after all because people don't question anything these days and believe everything is real. I know people that fell for a scam "post selling lost packages". If you thought for a bit and asked yourself "how tf are they selling package that were never found", you'd never fall for this scam. But no... my friends simply entered their credit card info and hoping that "expensive camera" will arrive.

 

[Andy Ful]

If you have a brain and use logic, you cannot get infected.

This is also a reason why most people can sometimes get infected.

 

[Halp2001]

Nowadays Microsoft Defender has come a long way since its early days. And when combined with the valuable free tools that @Andy Ful has made available to everyone, any user —even if they are not a security expert or don’t know how to handle the registry or Group Policies— can strengthen their system with just a few clicks. This accessibility makes a big difference: for most people Defender is more than enough without spending extra on protection, though of course others may choose different security software according to their own needs and preferences.

 

[RansomwareRemediation]

Nowadays Microsoft Defender has come a long way since its early days. And when combined with the valuable free tools that @Andy Ful has made available to everyone, any user —even if they are not a security expert or don’t know how to handle the registry or Group Policies— can strengthen their system with just a few clicks. This accessibility makes a big difference: for most people Defender is more than enough without spending extra on protection, though of course others may choose different security software according to their own needs and preferences.

I'll make it short and clear. As long as other antivirus vendors exist, Microsoft Defender is NOT enough. There is a reason the other AVs exist, otherwise they wouldn't exist and we would all have to use MD. Malware is evolving more and more, there is even AI malware.