Troubleshoot Windows Defender is not disable by Kaspersky

[JB007]

Hello,
I have explained here (post #24) Need Help - Apps do not launch from start menu and Windows search do not work ; my problems with Avast and that I have replaced it by Kaspersky Internet Security 2017.
Windows Defender continues to run along Kaspersky and when I try to disable it manually, when I reboot my PC Windows Defender is again running
If I look on the security panel I don't see Kaspersky but Kaspersky is running OK
Can you help me ?

 

[Parsh]

Please reply with what can you read under 'Virus Protection' in 'Security and Maintenance' in Control Panel as shown below.
In my case, Windows detects an AV (Avast).

 

[Janl1992l]

U can disable defender completly via reg edit:

• Win + R drücken regedit eingeben und starten
• Zum Pfad: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender gehen.
  • Ist Windows Defender nicht vorhanden, dann:
  • Rechtsklick auf Microsoft / Neuer Schlüssel mit dem Namen Windows Defender
• Im rechten Fenster nun ein Rechtsklick /Neu DWORD-Wert (32-bit) mit dem Namen DisableAntiSpyware
• DisableAntiSpyware doppelt anklicken und den Wert auf 1 setzen.

Its in german but not hard to make it in our lounge i hope

 

[Wave]

If you follow @Janl1992l then make sure to backup your registry first (since it'll be easier to revert than changing back the value).

Please follow these instructions and let me know the result:

1. Please download the Eicar Test File (this file is perfectly harmless however it's detected by most AV engines for testing purposes - it contains a set of bytes which will trigger the detection since the bytes are in the DB for most AV products): http://www.eicar.org/download/eicar.com.txt

2. Let me know if the download is successful, or if Kaspersky/WD intervened.

Thanks

 

[Parsh]

U can disable defender completly via reg edit:

• Win + R drücken regedit eingeben und starten
• Zum Pfad: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender gehen.
  • Ist Windows Defender nicht vorhanden, dann:
  • Rechtsklick auf Microsoft / Neuer Schlüssel mit dem Namen Windows Defender
• Im rechten Fenster nun ein Rechtsklick /Neu DWORD-Wert (32-bit) mit dem Namen DisableAntiSpyware
• DisableAntiSpyware doppelt anklicken und den Wert auf 1 setzen.

Here in English:

1. Use the Windows key + R keyboard shortcut to open the Run command, type regedit, and click OK to open the registry.
2. Browse the following path:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
   
   
3. If you don't see DWORD DisableAntiSpyware, right-click on an empty space, select New, and click on DWORD (32-bit) Value.
4. Name the key DisableAntiSpyware.
5. Double-click the newly created key, and set the value from 0 to 1

@JB007 I advise you to make a system restore point before trying this. Good Luck!

 

[jogs]

There's a small program called Defender Control, it disables WD.
Link Defender control v1.2

 

[Wave]

There's a small program called Defender Control, it disables WD.
Link Defender control v1.2

Yes, but messing with features like WD in this way are not good and may cause more trouble later down the road than good. As well as this, even if he does remove WD, his Kaspersky security may not even be working because WD should have been disabled when Kaspersky was enabled... Therefore, it's better to investigate and find out why this is happening and resolve it using documented supported methods as opposed to going round manipulating the registry (for the record, I'm pretty sure that Defender Control just changes the registry like @Parsh and @Janl1992l suggested however I can always download it and check).

 

[Parsh]

Yes, but messing with features like WD in this way are not good and may cause more trouble later down the road than good. As well as this, even if he does remove WD, his Kaspersky security may not even be working because WD should have been disabled when Kaspersky was enabled... Therefore, it's better to investigate and find out why this is happening and resolve it using documented supported methods as opposed to going round manipulating the registry (for the record, I'm pretty sure that Defender Control just changes the registry like @Parsh and @Janl1992l suggested however I can always download it and check).

I will agree with that. First thing we can do is to investigate whether Windows does detect another AV (Kaspersky here) or not, through Control Panel. If it does, then a not-so-obvious issue is preventing this thing. If it does not, maybe manipulating KIS settings or a clean reinstall of Kaspersky can help.

 

[Ink]

Yes, but messing with features like WD in this way are not good and may cause more trouble later down the road than good.

How is different to the advise given by @Janl1992l?

@JB007Temporary disable Kaspersky protection.

Run the Avast Uninstall Tool from Avast Uninstall Utility | Download aswClear for Avast Removal . It should not matter if ran im Safe or Normal mode, but execute from Windows Desktop. Restart Windows.

You can try to run a repair installation for Kaspersky and restart Windows once more.

 

[Marko :)]

I've read about this on other internet forums. Apparently, even if you disable Windows Defender, after next few updated Windows Defender will be enabled again. Same is with bigger updates and Windows 10 settings, after upgrade some settings resets itself on default values (I'm talking from personal experience).

 

[Janl1992l]

I've read about this on other internet forums. Apparently, even if you disable Windows Defender, after next few updated Windows Defender will be enabled again. Same is with bigger updates and Windows 10 settings, after upgrade some settings resets itself on default values (I'm talking from personal experience).

Hm with the reg tweak it never enable it itself by me since almost 1 year. should work even after big updates.

 

[JB007]

Hello,
Thanks all for your replies

Please reply with what can you read under 'Virus Protection' in 'Security and Maintenance' in Control Panel as shown below.
In my case, Windows detects an AV (Avast).
View attachment 137392

@Parsh, thanks
I have yet posted this screen shot, Kaspersky is not detected, only WD.

U can disable defender completly via reg edit:

• Win + R drücken regedit eingeben und starten
• Zum Pfad: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender gehen.
  • Ist Windows Defender nicht vorhanden, dann:
  • Rechtsklick auf Microsoft / Neuer Schlüssel mit dem Namen Windows Defender
• Im rechten Fenster nun ein Rechtsklick /Neu DWORD-Wert (32-bit) mit dem Namen DisableAntiSpyware
• DisableAntiSpyware doppelt anklicken und den Wert auf 1 setzen.

Its in german but not hard to make it in our lounge i hope

Thanks @Janl1992l
I'm just waiting a bit before going on the register and modifying it

If you follow @Janl1992l then make sure to backup your registry first (since it'll be easier to revert than changing back the value).

Please follow these instructions and let me know the result:

1. Please download the Eicar Test File (this file is perfectly harmless however it's detected by most AV engines for testing purposes - it contains a set of bytes which will trigger the detection since the bytes are in the DB for most AV products): http://www.eicar.org/download/eicar.com.txt

2. Let me know if the download is successful, or if Kaspersky/WD intervened.

Thanks

@Wave, thanks I tried the download and the file is detected by both WD and Kaspersky.

Here in English:

1. Use the Windows key + R keyboard shortcut to open the Run command, type regedit, and click OK to open the registry.
2. Browse the following path:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
   
   
3. If you don't see DWORD DisableAntiSpyware, right-click on an empty space, select New, and click on DWORD (32-bit) Value.
4. Name the key DisableAntiSpyware.
5. Double-click the newly created key, and set the value from 0 to 1

@JB007 I advise you to make a system restore point before trying this. Good Luck!

@Parsh , thanks for the translation

 

[Wave]

I recommend you reinstall Kaspersky in that case and see if the problem resolves on it's own. Please try that and then recheck on control panel

 

[JB007]

How is different to the advise given by @Janl1992l?

@JB007Temporary disable Kaspersky protection.

Run the Avast Uninstall Tool from Avast Uninstall Utility | Download aswClear for Avast Removal . It should not matter if ran im Safe or Normal mode, but execute from Windows Desktop. Restart Windows.

You can try to run a repair installation for Kaspersky and restart Windows once more.

Hello @Spawn
Thanks, are you sure about Safe or Normal mode because on Avast site they say Safe mode... ?

 

[JB007]

Hum,
I just looking at WD parameters on another PC and I saw that the "Limited Periodic Scanning" feature is missing on my PC with the issue.
What do you think about this ?

 

[MITKH]

Spoiler

Spoiler

 

[Parsh]

Hello,
Thanks all for your replies

@Parsh, thanks
I have yet posted this screen shot, Kaspersky is not detected, only WD.
View attachment 137441

As suspected. Now, uninstall KIS from your system followed by using Kaspersky removal tool to make a clean removal of Kaspersky.
Then, after restart of system, install KIS again. This should hopefully solve the issue.

 

[JB007]

As suspected. Now, uninstall KIS from your system followed by using Kaspersky removal tool to make a clean removal of Kaspersky.
Then, after restart of system, install KIS again. This should hopefully solve the issue.

Hi @Parsh
Thanks, I will try but not sure to use Kaspersky removal tool because it caused me a great issue on another PC, an also for other MalwareTips members... This issue was solved thanks to the MalwareTips community and especially @Xtwillight and @Evjl's Rain : Need Help - Error 0x81000203

 

[Deleted member 2913]

@JB007,

Limited Periodic Scanning is available in the settings when WD detects 3rd party AV presence & disables itself.

 

[MITKH]

how disable widows defender full on widows 10 :
see this video : ~ 6mb

Suprafiles.net - Free File Sharing Service