Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 941237" data-attributes="member: 78686">I think malware or even legit programs adding themselves into the exclusions is another unsettling thing. If you install McAfee then for some reason McAfee put itself into Microsoft Defender&#039;s exclusions. A year ago when I installed Acronis True Image, it put itself into Defender&#039;s exclusion which I discovered 4-5 days later after I uninstalled the program. Both required admin rights but when trusted programs ask for that while installing then surely we will allow that.I also found a malware today which added something to Defender&#039;s exclusion while it was executed. The sample is at least 10 days old and the payload is detected by every AV, so Defender also detected and removed it, but the exclusions remained. The malware is a combination of 4 files. One .bat, two .dat, one .dll.Interestingly the exclusion was not for any files, instead the Defender UI was showing file type, &quot;exe&quot; and &quot;dat&quot; into the exclusion.Microsoft makes it easy to manage it via registry modification, powershell, group policy etc. for ease of use I assume.One of the plus point of Microsoft Defender is that it&#039;s very much integrated into the system, but this plus point is also one of its main weak point. Adding exclusions shouldn&#039;t be so easy.I never encounter any malware in my real world usage so Defender is more than enough for me, but I hope Microsoft do something in the future to counter these issues.</blockquote>

[QUOTE="SeriousHoax, post: 941237, member: 78686"] I think malware or even legit programs adding themselves into the exclusions is another unsettling thing. If you install McAfee then for some reason McAfee put itself into Microsoft Defender's exclusions. A year ago when I installed Acronis True Image, it put itself into Defender's exclusion which I discovered 4-5 days later after I uninstalled the program. Both required admin rights but when trusted programs ask for that while installing then surely we will allow that. I also found a malware today which added something to Defender's exclusion while it was executed. The sample is at least 10 days old and the payload is detected by every AV, so Defender also detected and removed it, but the exclusions remained. The malware is a combination of 4 files. One .bat, two .dat, one .dll. Interestingly the exclusion was not for any files, instead the Defender UI was showing file type, "exe" and "dat" into the exclusion. Microsoft makes it easy to manage it via registry modification, powershell, group policy etc. for ease of use I assume. One of the plus point of Microsoft Defender is that it's very much integrated into the system, but this plus point is also one of its main weak point. Adding exclusions shouldn't be so easy. I never encounter any malware in my real world usage so Defender is more than enough for me, but I hope Microsoft do something in the future to counter these issues. [/QUOTE]

Verification