MBAM & Windows Defender

[galileo]

I have been asked by several users as to whether or not there is any value in running Windows Defender "if" one is running MBAM real-time (paid)...? Is there any added benefit to running both - or - does MBAM real-time do everything and more than Defender?

If there is no "meaningful" added benefit, I would prefer to have my users remove any/all extraneous applications in favor of maximizing performance and minimizing potential interaction issues. I am sure everybody has some thoughts on this but, I am particularly interested in definitive comments on the security scope of each and less interested in personal preferences....thanks.

galileo

[lordpake]

Windows Defender does monitor locations that MBAM is not watching. This includes places like Hosts file, autostart locations and such.

[YoKenny1]

I always check for Windows Defender updates daily as I find that it needs to be updated manually from its portal.

End Windows Defender then go to the portal then select either 32bit or 64bit as applicable to your system then Run it then start it up again:

http://www.microsoft.com/security/portal <== current is v1.55.517.0

[exile360]

Windows Defender also catches more of the "common" spyware and adware that MBAM wouldn't detect (primarily because most AV's etc would detect it). I use Defender myself, and much like YoKenny1 I update my definitions manually daily. Instructions on installation can be found here. If you're running Vista right click the definitions installer and select Run as administrator.

[Insomniac]

Hmm... my defender definitions are a bit out of date.... and yet making defender check results in it reporting no new updates available. I have updated it this way in the past and it has worked, so it it simply a matter of the server it contacts not being up-to-date or is it somthing else?

Is the security portal usually ahead of the automatic updates? I'll try updating as an admin later and see if that helps.

Hmm, still finds no updates. I'm pretty sure it's merely there server not being quite up-to-date though, as I often get windows defender updates via windows update automatically. The most recent update it found was 2 days ago, updating defender to 1.55.314.0

It seems that there is a bit of a lag between the manual update source and wherever defender and windows looks by default.

[exile360]

The definitions are updated very frequently (sometimes more than once a day) but they only upload updates to the normal update server (and Windows Update) when there is a major update to the defs, which is generally once every couple of weeks (sometimes even less frequently).

[Insomniac]

Windows update updated defender defs today. Judging by my update history, they seem to update fairly regularly. These are the days defender has updated it's definitions from windows update this month: 3rd, 6th, 10th, 12th, 13th, 17th, 20th, 24th, 27th (today). Not every day by any means, but (at the moment at least) much more than once every couple of weeks.

[exile360]

Yes, I've noticed they seem to be piping in the updates more frequently now. Especially since the Conficker Worm was unleashed.

[Insomniac]

They've gotten their act together with defender, now they just need to release a windows build with a good firewall... (I realise you can use firewall control apps to make it good, but wouldn't it be just awesome for them to release a windows firewall that provides great inbound and outbound security with default settings?)

[exile360]

They almost did with the firewall in Vista, but they changed their minds about it (probably the same reason they didn't include their AV, OneCare). They want to avoid those anti-trust lawsuits. From what I've heard, though, OneCare will become free (firewall features and all) once Windows 7 is release, you'll just have to download it from their Live add-ons site.

[Insomniac]

I still think it would be nice to have it integrated with windows, like defender, the current firewall and Internet explorer all are. Have some option to disable them if you want (so users still have the choice of going 3rd party, and so it's not a monopoly. Make it so that when it is disabled, it is FULLY disabled so it won't interfere with 3rd party stuff as well.)

There are quite a few reasons this would be a great idea. First and foremost, it means that new users are protected from the get-go, and don't have to worry about antivirus and the problems they occasionally cause. Also, if it is bundled with windows this would pretty much eliminate conflicts between the antivirus and other programs. Seeing as EVERY copy of windows would have it enabled by default, it would force software developers to address any issues their software has with it.

It always seemed rediculous to me that one of the first things a fresh windows install tells you is to install 3rd party antivirus. If they've gone to the trouble of adding an internet browser, a firewall, and an antispyware app... why not do it properly and include the most important component, a realtime antivirus program? Especially as they already develop and support one.

Surely, if they enabled the ability to properly disable these programs the lawsuits wouldn't be a problem? I can't see how they could lose such a case... It's their product, and they should have the right to take it to wherever they want. People can always use a Mac or run Linux if they don't like windows.

[exile360]

I fully agree, but MS already tried, they even had to remove their default Search option thanks to Google and as far as I know the main argument used by the security vendors (especially McAfee and Symantec) is that if it's already built in to Windows there would be no motivation for most typical computer users to pay for third party products. More tech educated users such as us would obviously make different choices but your average individual purchasing a new computer takes whatever is free. There's no way that those vendors (and you could probably safely add Checkpoint to that list) would allow it to happen without a fight. A lot of the features currently built into Vista are getting gutted for Windows 7 and will be made available the same way as OneCare. On the one hand, it gives you a more bare bones experience and you add what you want, but on the other, you have to go and download it and don't have it integrated by default. Cloud computing is the future though, so MS plans on continuing in this direction. They'll provide services (some free and some paid) that are subscribtion based through the internet.

[Insomniac]

Grrr.... I can understand why the companys think that... but if I were to make a basic calculator application and charge for it, does that give me the right to sue microsoft for bundling one with windows?

[exile360]

I doubt it, the main thing is that these companies have been securing Windows for a long time and it's their primary source of income. I think MS bundling free AV with Windows would have the biggest impact on the corporate markets, which is the bread and butter not just for MS, but also for third party security vendors.