Advice Request Windows Defender Cloud Protection is ON even with Kaspersky installed

[RoboMan]

Hello; is this common behaviour?

I'm using Kaspersky Internet Security 2020 in one of my machines with Windows 10 LTSC 1809, latest updates installed.

The machine works great, but my attention got caught since I saw Anti Malware Executable Service running, which is characteristic from WD. Also MsMpEng.exe is always running. When I open Windows Security Center, I say it says "no action needed, Kaspersky installed", but if I open the antivirus configuration I see Defender "cloud protection" is still enabled (real time protection disabled).

Is this normal? Is this module always on?

 

[harlan4096]

Probably no... MsMpEng.exe should not be executed unless Kaspersky protection is paused or disabled, that's why I always disable completely (except SmartScreen) WD via WPD...

 

[RoboMan]

Probably no... MsMpEng.exe should not be executed unless Kaspersky protection is paused or disabled, that's why I always disable completely (except SmartScreen) WD via WPD...

Upon disabling WD completely with O&O ShutUp10 and rebooting, Cloud Protection is now off and MsMpEng.exe is no longer a backgroung process. Thx!

 

[MacDefender]

I don't see MsMpEng running on my Windows 2004 machine with KTS.

Note that, at least with F-Secure which updates/reloads live, the brief period of time where F-Secure updates its engine executables (not signatures, but the build of F-Secure itself), F-Secure deactivates and Windows Defender does start for a few seconds before F-Secure comes back.

I haven't had Kaspersky long enough to see it do such a build update, but I'd imagine something similar happens there by default. Unless Windows Defender is explicitly disabled, if Windows thinks your AV stopped running, it will allow Windows Defender to take over.

 

[fabiobr]

Hello; is this common behaviour?

I'm using Kaspersky Internet Security 2020 in one of my machines with Windows 10 LTSC 1809, latest updates installed.

The machine works great, but my attention got caught since I saw Anti Malware Executable Service running, which is characteristic from WD. Also MsMpEng.exe is always running. When I open Windows Security Center, I say it says "no action needed, Kaspersky installed", but if I open the antivirus configuration I see Defender "cloud protection" is still enabled (real time protection disabled).

Is this normal? Is this module always on?

Similar behavior with me:

Windows Defender active with Kaspersky on the system | MalwareTips

I turn on my PC and that happened, Kaspersky is on patch J, no changes and this never happened before. I noticed by right-clicking a file and saw Windows...

malwaretips.com

 

[bayasdev]

Use Defender Control and nuke it

 

[imuade]

I think Microsoft changed something on how a 3rd party AV should register in WSC, I have seen this issue affecting some AVs (Comodo, Immunet) and other AVs adding a dedicated service to deal with WSC (Avast, Panda)

 

[harlan4096]

Also it seems sometimes (maybe after Windows Updates), WD services are reactivated

 

[RoboMan]

So Microsoft's play is pushing their own antivirus even when you want another company for that... I don't like it.

 

[bayasdev]

When I used KIS, WD automatically re-enabled itself two minutes later after turning off KIS causing CPU spikes

 

[oldschool]

So Microsoft's play is pushing their own antivirus even when you want another company for that... I don't like it.

Internet Explorer redux?

 

[fabiobr]

When I used KIS, WD automatically re-enabled itself two minutes later after turning KIS causing CPU spikes

I think it's a Kaspersky bug on registering itself on WSC.