Advice Request Windows Defender Cloud Protection is ON even with Kaspersky installed

Please provide comments and solutions that are helpful to the author of this topic.

RoboMan

Level 34
Thread author
Verified
Top Poster
Content Creator
Well-known
Jun 24, 2016
2,399
Hello; is this common behaviour?

I'm using Kaspersky Internet Security 2020 in one of my machines with Windows 10 LTSC 1809, latest updates installed.

The machine works great, but my attention got caught since I saw Anti Malware Executable Service running, which is characteristic from WD. Also MsMpEng.exe is always running. When I open Windows Security Center, I say it says "no action needed, Kaspersky installed", but if I open the antivirus configuration I see Defender "cloud protection" is still enabled (real time protection disabled).

Is this normal? Is this module always on?
 

RoboMan

Level 34
Thread author
Verified
Top Poster
Content Creator
Well-known
Jun 24, 2016
2,399
Probably no... MsMpEng.exe should not be executed unless Kaspersky protection is paused or disabled, that's why I always disable completely (except SmartScreen) WD via WPD...
Upon disabling WD completely with O&O ShutUp10 and rebooting, Cloud Protection is now off and MsMpEng.exe is no longer a backgroung process. Thx!
 

MacDefender

Level 16
Verified
Top Poster
Oct 13, 2019
779
I don't see MsMpEng running on my Windows 2004 machine with KTS.

Note that, at least with F-Secure which updates/reloads live, the brief period of time where F-Secure updates its engine executables (not signatures, but the build of F-Secure itself), F-Secure deactivates and Windows Defender does start for a few seconds before F-Secure comes back.

I haven't had Kaspersky long enough to see it do such a build update, but I'd imagine something similar happens there by default. Unless Windows Defender is explicitly disabled, if Windows thinks your AV stopped running, it will allow Windows Defender to take over.
 

fabiobr

Level 12
Verified
Top Poster
Well-known
Mar 28, 2019
561
Hello; is this common behaviour?

I'm using Kaspersky Internet Security 2020 in one of my machines with Windows 10 LTSC 1809, latest updates installed.

The machine works great, but my attention got caught since I saw Anti Malware Executable Service running, which is characteristic from WD. Also MsMpEng.exe is always running. When I open Windows Security Center, I say it says "no action needed, Kaspersky installed", but if I open the antivirus configuration I see Defender "cloud protection" is still enabled (real time protection disabled).

Is this normal? Is this module always on?
Similar behavior with me:

 

imuade

Level 12
Verified
Top Poster
Well-known
Jul 29, 2018
566
I think Microsoft changed something on how a 3rd party AV should register in WSC, I have seen this issue affecting some AVs (Comodo, Immunet) and other AVs adding a dedicated service to deal with WSC (Avast, Panda)
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top