Malwarebytes 4.3.0 with Windows 10 Defender

[lmacri]

16 hours ago, Dave-H said:

...I did say that I harvested the logs while MB was not registered in WD, that option was switched off. Was that right?...

Hi Dave-H:

I activated my Malwarebytes Premium license and ran a few tests (note that the Windows Fast Startup power option is disabled on my Win 10 Pro machine) and I believe I'm observing the same results as you.  If I turn OFF the setting at Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center and use Windows Defender as my primary real-time protection then Windows Defender's Limited Periodic Scanning is NOT OFFERED.

mbst-grab-results MB NOT Registered WIth WSC.zip

 

If I turn ON the setting at Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center and use Malwarebytes Premium as my primary real-time protection, I can turn ON Windows Defender Limited Periodic Scanning ...

mbst-grab-results MB Registered WIth WSC.zip

... but after I re-boot Limited Periodic Scanning is automatically turned OFF.

 

As I noted <above>, I believe this is different than what I observed when McAfee LiveSafe was my primary antivirus.  When I used McAfee LiveSafe v16 in 2019 (no Malwarebyes Premium, only Malwarebytes Free as an on-demand scanner) I recall I could turn on Limited Periodic Scanning and it would stay turned on and run the occasional quick scan with Windows Defender.  I also recall several Norton Security users with a Win 10 OS who reported that they could use Limited Periodic Scanning on their Win 10 machines (see Krusty13's 28-Jun-2018 comment in the Norton thread Canceling a Scheduled Scan for one example), but that was a few years ago so perhaps something has changed recently with Windows Defender.  I'll post in the Norton forum and see if I can confirm that Limited Periodic Scanning still works correctly with the latest Norton 360.
-------------
64-bit Win 10 Pro v2004 build 19041.867 * Firefox v87.0 * Microsoft Defender v4.18.2102.4 * Malwarebytes Premium v4.3.0.98-1.0.1236
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited March 31, 2021 by lmacri

[Dave-H]

Thanks very much @lmacri, that's exactly the behaviour I'm seeing!

So, it does seem as if this is possibly only a problem with Malwarebytes Premium, that it is disabling the periodic scanning option when it starts up, where other security suites are not doing so. I'm assuming that this isn't "by design".

I will be very interested to know the result of your further investigations.

Cheers, Dave.

🙂

 

[AdvancedSetup]

I'm sorry Dave but with thousands of reports of this behavior and the many that I looked at they are not using Malwarebytes. This sure seems to be a well known Microsoft Windows Defender issue and is not attributed to any specific antivirus product or program from what I've been reading.

Good luck though with your concerns over it's behavior.

Thank you

 

[exile360]

Please keep in mind that the Periodic scanning option should only be available if a product other than Defender is configured to be your primary AV because Defender will automatically run its periodic scans regardless if it is configured to be the primary AV protection for the system and MS provides no option to disable periodic scanning when Defender is set as the primary AV protection.

[Dave-H]

26 minutes ago, AdvancedSetup said:

I'm sorry Dave but with thousands of reports of this behavior and the many that I looked at they are not using Malwarebytes. This sure seems to be a well known Microsoft Windows Defender issue and is not attributed to any specific antivirus product or program from what I've been reading.

Good luck though with your concerns over it's behavior.

Thank you

 

OK, fair enough! 😁
It would be good to know why it works for some people and not others though, with any security program.
I guess unless Microsoft identify the problem and acknowledge and correct it, and document it, we will never know what the problem actually is.
I might put a report in on the Windows 10 Feedback Hub about it.
🙂

[AdvancedSetup]

Why Microsoft even provides that option is beyond me as they pretty much allude to the fact it is USELESS as it cannot detect PUP, or real malware in many cases.

Okay, well unless there is something else this topic would seem to be done

Cheers

 

[Dave-H]

Agreed!

If I get anything back from Microsoft about this (yeah, right!) I'll let you all know!

Thanks everyone for their help.

Cheers, Dave.
🙂.

[exile360]

You may find this useful:

https://support.microsoft.com/en-us/windows/schedule-a-scan-in-microsoft-defender-antivirus-54b64e9c-880a-c6b6-2416-0eb330ed5d2d

Creating your own scheduled scan may also be an option, that way it shouldn't be controlled by the option in Security Center.

[Dave-H]

Thanks. 👍

[exile360]

You're welcome.  Let me know if you run into any problems; I can likely help as I used to manually update and scan with MSE (the Windows 7/8 AV upon which the code for Defender is based) using the Windows Task Scheduler.

[Dave-H]

OK. Up to now I've been doing a scheduled scan with MB every week on Mondays and leaving WD to do a quick scan in the background whenever it wants to.
I think/hope that's probably enough.
🙂

[exile360]

40 minutes ago, Dave-H said:

OK. Up to now I've been doing a scheduled scan with MB every week on Mondays and leaving WD to do a quick scan in the background whenever it wants to.
I think/hope that's probably enough.
🙂

It should be.  You could always keep Defender active, too, if you're really concerned about it, and of course if you're keeping Windows up to date your system is also getting scanned by MRT each month.

[Dave-H]

That's exactly what I do, I keep MB and WD active all the time.
This has never caused any obvious problems.
And yes, MRT does its thing every month too (although I've noticed a few months when there hasn't been one).
🙂

[lmacri]

8 hours ago, lmacri said:

... As I noted <above>, I believe this is different than what I observed when McAfee LiveSafe was my primary antivirus.  When I used McAfee LiveSafe v16 in 2019 (no Malwarebytes Premium, only Malwarebytes Free as an on-demand scanner) I recall I could turn on Limited Periodic Scanning and it would stay turned on and run the occasional quick scan with Windows Defender.  I also recall several Norton Security users with a Win 10 OS who reported that they could use Limited Periodic Scanning on their Win 10 machines (see Krusty13's 28-Jun-2018 comment in the Norton thread Canceling a Scheduled Scan for one example), but that was a few years ago so perhaps something has changed recently with Windows Defender.  I'll post in the Norton forum and see if I can confirm that Limited Periodic Scanning still works correctly with the latest Norton 360.

Hi Dave-H:

I've had a few replies in my Norton forum thread Norton 360 and Windows Defender Limited Periodic Scanning and initial reports seem to confirm that you can enable Windows Defender's Limited Periodic Scanning when the latest Norton 360 v22.21.x is installed, and that Limited Periodic Scanning stays turned on after a re-boot. Norton 360 displays a pop-up alerting the user that "Defender Limited Periodic Scanning has been turned on" but the user can click "Don't Show Again" in the pop-up if they don't want to see that Norton warning again.

I'm not sure why Limited Periodic Scanning turns off after a re-boot on our machines when Malwarebytes Premium v4.3.x is configured as the primary real-time protection (i.e., when Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center is turned ON and there is no other third-party AV installed on our systems).  When I was testing with Security | Windows Security Center | Always Register Malwarebytes in the Windows Security Center turned ON, however, I did notice that it often took a few minutes  for my Windows Defender AV to be disabled at boot-up and for Malwarebytes Premium to be shown as the primary real-time protection in Win 10 at Settings | Update & Security | Windows Security | Virus & Threat Protection. I don't know if this time lag to fully activate Malwarebytes Premium protection at boot up is reason why Limited Periodic Scanning is automatically turned off after each re-boot or if it's because Malwarebytes Premium is an "antivirus replacement" rather than a true antivirus as stated <here> in the Malwarebytes 4 FAQ.
-------------
64-bit Win 10 Pro v2004 build 19041.867 * Firefox v87.0 * Microsoft Defender v4.18.2102.4 * Malwarebytes Premium v4.3.0.98-1.0.1236
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited March 31, 2021 by lmacri

[Dave-H]

Thanks, yes I've noticed that delay as well before WD recognises MB as being the primary security software and disables itself.
Whether that has anything to do with the periodic scanning setting problem I don't know, but it's possible that if the system was shut down with it enabled, any delay in MB registering itself on the next startup could cause WD to decide that there is no other security program installed, which would result in the periodic scan option switching off as WD thinks it's actually unavailable. When WD finally recognises MB, of course the option has already been switched off and doesn't turn back on again.
In fact the more I think about it, the more likely that seems to be the root cause of the problem!
🙂
 

[exile360]

You may be right.  I believe there's an executable that interfaces with Security Center called MBAMWsc, though I believe it just reports its status and to WSC and handles registering; I don't believe it makes any changes to Defender directly.

[Dave-H]

I guess it's just a bit slow to run, which doesn't tell WSC quickly enough that MB is installed and active, so WSC starts in its normal node with the periodic scanning option unavailable, and it doesn't reactivate it when Defender does detect MB and switches control of things like real-time scanning over to it.
I wonder if that actually is the problem for everyone with this issue, regardless of what security software they're using?
🙂