Malwarebytes and Windows Defender

[ex-jedi]

Recently Malwarebytes seems to be playing less well with Windows Defender. On restart either Windows Defender is deactivated or I'm shut out of Controlled Folder Access settings...

After my latest restart I can't switch on Defender Real-time protection or Controlled Folder Access. Disabling all but Web Protection seems to allow Defender back in.

Is this a bug or has Malwarebytes now taken over Real-time protection and Controlled Folder Access/Ransomware from Defender?

 

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes for Windows Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

1. Download Malwarebytes Support Tool
2. Once the file is downloaded, open your Downloads folder/location of the downloaded file
3. Double-click mb-support-X.X.X.XXXX.exe to run the program
   • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
4. Place a checkmark next to Accept License Agreement and click Next
5. You will be presented with a page stating, "Get Started!"
6. Click the Advanced tab on the left column
   
   
    
7. Click the Gather Logs button
   
   
    
8. A progress bar will appear and the program will proceed with getting logs from your computer
   
   
    
9. Upon completion, a file named mbst-grab-results.zip will be found on your Desktop. Click OK
   
   
    
10. Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
    
       

Click "Reveal Hidden Contents" below for details on how to attach a file:
 

Spoiler

To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

 

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/hc/en-us/requests/new to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/hc/en-us/articles/360038523934

 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

[Porthos]

I would turn off controlled folder access.

And change the following setting in Malwarebytes.

 

[ex-jedi]

Hi @Porthos, thanks for your reply

I have the register Malwarebytes in the windows security center option enabled. I'm not sure if you're saying I should leave it on or deactivate it.

Cheers

mbst-grab-results.zip

[Porthos]

1 minute ago, ex-jedi said:

Hi @Porthos, thanks for your reply

I have the register Malwarebytes in the windows security center option enabled. I'm not sure if you're saying I should leave it on or deactivate it.

Cheers

mbst-grab-results.zip 9.25 MB · 0 downloads

For Defender to work you must DEACTIVATE it.

[Porthos]

Malwarebytes by default registers in the action center which turns off Defender. Malwarebytes is designed to be a REPLACEMENT to antivirus.

Most of us prefer to have both running including myself. That is why the option is available to turn off the option to register in the Windows security center.

[ex-jedi]

I didn't realise that the Premium version 4 of Malwarebytes now registers itself as the system’s security program by default. I think I'll run it alongside defender too. But is there some official guidance about the optimum Premium  Malwarebytes & Defender Setup?

[Porthos]

6 minutes ago, ex-jedi said:

But is there some official guidance about the optimum Premium  Malwarebytes & Defender Setup?

No at least as far as I can find. The setting is a Windows Defender thing. Defender is designed to turn itself off whenever another AV is installed and registers in the security center because you should not run more than one AV. The catch is, Malwarebytes is not an actual AV in the same sense that the other AV companies classify theirs. It is classed as a replacement but retains the ability to run alongside them as well therefore the optional setting to "not register" in the security center.

Other AV's do NOT really want you to run anything else alongside their programs.

[OldMainframeGuy]

9 hours ago, Porthos said:

No at least as far as I can find. The setting is a Windows Defender thing. Defender is designed to turn itself off whenever another AV is installed and registers in the security center because you should not run more than one AV. The catch is, Malwarebytes is not an actual AV in the same sense that the other AV companies classify theirs. It is classed as a replacement but retains the ability to run alongside them as well therefore the optional setting to "not register" in the security center.

Other AV's do NOT really want you to run anything else alongside their programs.

Porthos:   I'm a bit confused by this.  I'm running the latest version of Malwarebytes Premium on the latest version of Windows 10 and I have Malwarebytes configured to register with the Windows Security Center.  I don't see any evidence that Windows Defender is disabled.   It's in my system tray with a green checkmark and the security dashboard shows everything green.  Windows Defender still runs its scans.   Both products looks like they're coexisting.   What would I see to indicate Defender is disabled?

Rob

[exile360]

I believe Windows Defender only disables itself in the most recent builds/updates of Windows 10, so if you don't have the latest version/patch installed, it is possible that it is following a past behavior of not automatically disabling itself.

[Porthos]

1 hour ago, OldMainframeGuy said:

Porthos:   I'm a bit confused by this.  I'm running the latest version of Malwarebytes Premium on the latest version of Windows 10 and I have Malwarebytes configured to register with the Windows Security Center.  I don't see any evidence that Windows Defender is disabled.   It's in my system tray with a green checkmark and the security dashboard shows everything green.  Windows Defender still runs its scans.   Both products looks like they're coexisting.   What would I see to indicate Defender is disabled?

Rob

With any new install Malwarebytes 4.0’s new default behavior is to register in Windows Defender Security Center (also known as Windows Security Center, Windows Action Center) as a primary line of defense. Due to Microsoft’s implementation of Windows Defender Security Center, this means that Windows Defender will disable itself as a result (depending on your operating system). Though we do not prevent you from running traditional anti-virus with Malwarebytes, we recommend that you keep Malwarebytes registered as your primary security to get the most comprehensive protection against threats. 

If you are upgrading from Malwarebytes 3.x, then the behavior is a little different. Your current Windows Security Center registration information for Malwarebytes 3.x will carry over. For example, if you have Malwarebytes 3.x registered in Windows Security Center, then that is what you will see with 4.0. If instead, Malwarebytes 3.x is not registered in Windows Security Center, then it will not register on upgrade to Malwarebytes 4.x and will instead remain in compatibility mode unless you change this in Malwarebytes 4.0’s Settings.

[Porthos]

2 hours ago, OldMainframeGuy said:

I don't see any evidence that Windows Defender is disabled.   It's in my system tray with a green checkmark and the security dashboard shows everything green.  Windows Defender still runs its scans.   Both products looks like they're coexisting.   What would I see to indicate Defender is disabled?

This what it looks like when Defender is off because Malwarebytes is registered in the security center. Defenders real-time protection is off and you only have an option for periodic scanning and even that is off by default in Defender.

 

Note my system tray icon is green as well. Now since my demonstration is over, I will turn Malwarebytes back off in the security center and I will then have the benefit of both.

I wish on install, there would be a check-mark/toggle in the installer to choose if Malwarebytes will the default antivirus provider or not. It would save us from having threads like this and in my opinion leaving the computer less protected because it turns off Defender by default on a new install because people do not realize Defender has just been DISABLED..

 

Current Windows version

 

@exile360 you can take notes for future assistance reference.

Edited February 3, 2020 by Porthos

[OldMainframeGuy]

Porthos:   Thank you for clearing this up for me.  I just assumed (whoops!) that the green checkmark on the Defender icon meant it was active; when I checked further, I could see that it was not.  I now have Malwarebytes set to not register itself with the Windows Security Center.   And I am running the same Windows version and build as you.

Rob

[Porthos]

2 hours ago, OldMainframeGuy said:

Porthos:   Thank you for clearing this up for me.  I just assumed (whoops!) that the green checkmark on the Defender icon meant it was active; when I checked further, I could see that it was not.  I now have Malwarebytes set to not register itself with the Windows Security Center.   And I am running the same Windows version and build as you.

Rob

My issue for others, especially new users is, Is that Defender has come a long way and there is little to no warning that Malwarebytes turns it off. Many security forum members  are pushing Defender as all you need. For some I agree and have a few of those type clients. but for others, Case in point, I had a client call me Saturday who said MB blocked a link in a "Amazon" email and when I looked and saw the email I knew it was fake and I showed her the signs. It did look convincing but if she did not have MB she would have been PHISHED for her Amazon username and password.

I do a good amount of testing and there are times Defender will catch things that MB does not. I know MB will block the bad files if executed but I do not go that far in testing.

Right after the above demonstration, I of course flipped the switch back off in MB and all was back to normal in my security world.

[ex-jedi]

I opened a ticket to get an 'official reply. Their agent replied...

 

Quote

I found the official Microsoft article within the link below which explains that if you install a third party antivirus, Windows Defender automatically gets disabled or goes in passive mode.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility

However, Malwarebytes Premium is a complete antivirus alternative. 

Malwarebytes guarantees the protection below:

Removes malware and spyware
Detects and removes malware and other advanced threats.
Automatically finds malware 24/7
Detects malware in real-time, before it can be a danger to your device
Stops exploit attacks
Shields vulnerable systems and softwares from exploit attacks.
Blocks ransomware attacks
Stops ransomware attacks before your data is held hostage.
Shields against malicious websites
Prevents access to and from known malicious websites.

For additional information please visit the link below:

https://www.malwarebytes.com/premium/
 

I think though I'll take advice from @Porthos and run Malwarebytes Premium alongside Windows Defender for now.

[Porthos]

7 minutes ago, ex-jedi said:

I opened a ticket to get an 'official reply. Their agent replied...

 

I think though I'll take advice from @Porthos and run Malwarebytes Premium alongside Windows Defender for now.

I just use what seems to work for me and my clients. Of course, I have lifetime licenses for all my computers and about 80% of my clients do as well. It is a win-win situation for me.

With the above being said, I would buy the subscription any day if I needed it.

[OldMainframeGuy]

50 minutes ago, Porthos said:

I just use what seems to work for me and my clients. Of course, I have lifetime licenses for all my computers and about 80% of my clients do as well. It is a win-win situation for me.

With the above being said, I would buy the subscription any day if I needed it.

I couldn't agree more; I also have one lifetime license and I often kick myself for not buying two.   Does Malwarebytes offer less protection (or functionality) when running as a "secondary" product alongside Defender as opposed to running it in place of Defender?

[Porthos]

1 minute ago, OldMainframeGuy said:

Does Malwarebytes offer less protection (or functionality) when running as a "secondary" product alongside Defender as opposed to running it in place of Defender?

It is the same either way. Full functionality and protection.

[pnoelw]

Excellent info here. Thanks for the discussion.

[coldtrain6989xd92]

So I have the latest build do I untick the box to always register with windows security center? Also what do I do after that about Windows defender as of now where i have the latest build of it and win 10 OS up to date?

[coldtrain6989xd92]

@PorthosI'll be waiting for your advise man?

[Porthos]

7 minutes ago, coldtrain6989xd92 said:

do I untick the box to always register with windows security center?

I would so you can have the full protection of both MB and Defender.

[coldtrain6989xd92]

Just now, Porthos said:

I would so you can have the full protection of both MB and Defender.

Thanks man! Any more advice?

[Porthos]

1 minute ago, coldtrain6989xd92 said:

Thanks man! Any more advice?

As good as Malwarebytes is, it is just a layer of protection.

Using a browser that has Ublock Origin and the Malwarebytes Browser guard enabled is also a layer of protection.

Not opening attachments from an email unless you were expecting it from a specific user during a specific time period.

Do not use Torrents. Do not install every free software you find. Do not click links in an unknown email. Go directly to the site listed in the email.

Having a monthly image of your computer on an external drive that is only connected during the backup is actually better than any protective software ever made. Macrium Reflect free is the program I use and place on every computer I service.

[exile360]

You can also refer to our Tips to help protect from infection.  It contains a lot of good info on keeping your system and data secure.