Malwarebytes EP not available as Security Providers on Windows Security

[CTP_Carlo]

Hi Team,

Just want to verify my concern? Already disabled windows defender but when i want to prioritize Malwarebytes EP its not in the option.

[AndrewPP]

Malwarebytes by default will not register as primary unless Defender is stopped.  Your display above shows that Defender is still running.

You can check security registration and status with Windows command.

 

wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List

displayName=Windows Defender
instanceGuid={D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
pathToSignedProductExe=windowsdefender://
pathToSignedReportingExe=%ProgramFiles%\Windows Defender\MsMpeng.exe
productState=397568
timestamp=Tue, 27 Apr 2021 11:09:24 GMT

displayName=Malwarebytes
instanceGuid={23007AD3-69FE-687C-2629-D584AFFAF72B}
pathToSignedProductExe=C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
pathToSignedReportingExe=C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
productState=397312
timestamp=Mon, 04 Jan 2021 01:28:55 GMT

 

 

If Defender is stopped, Malwarebytes should become visible in security centre.  Note: Defender will very persistently try to start/restart itself, unless you use GPO to stop it.

 

You can use the Malwarebytes policy setting to force behavior - Always Register Malwarebytes in the Windows Action Center

 

[AndrewPP]

Additionally, you have posted this topic in Incident Response.
As Incident Response does not have a real-time protection component, I think it does not register as a provider at all.
 

[CTP_Carlo]

Thank you AndrewPP for answering my inquiry. Do you have a guide on i could disable it? I tried doing steps in found in the internet but after rebooting my PC i activates again.

[AndrewPP]

Correcting my prior statement about GPO.  It is no longer possible to disable Defender by GPO - https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware   Defender should detect Malwarebytes registering and turn itself off, for Endpoint Protection.