Does Windows Defender Antivirus and Windows Defender Firewall keep my laptop 100% secure?

Sheikh · Feb 17, 2025

Cromax said:
it does use 200 mb and more and i dont have nothing confidential on my pc i literally dont care just can nuke whole installation and restore..

Aw...
No airbag
We die like men

Cromax · Feb 17, 2025

Sheikh said:
Aw...
No airbag
We die like men

yes i learned in 30 years of using pcs av's are scam especially third party ones.. if you are scared use defender if you are not strip everything out

Sheikh · Feb 17, 2025

Cromax said:
yes i learned in 30 years of using pcs av's are scam especially third party ones.. if you are scared use defender if you are not strip everything out

As I'm working for a website in my country to provide latest windows apps, have to use some popular AVs on my virtual machine to ensure users won't get into any troubles during installation. but I agree with you. maybe we can say AV is a virus itself because it uses resources like a virus. and every time a new virus, trojan or ransomware released, all AVs acted like blind police :)

garlin · Feb 17, 2025

Into_Oblivion1 said:
If the fileless malware writes something to the disk, would MS Defender then detect that happening, and then scan the file?
Or when would MS Defender scan it and act upon it?

Modern security products are embedded as kernel filter drivers. They spy on system activity, and have heuristics to detect "suspicious" patterns of behavior related to system calls or file activity. In some cases, they can block a process from doing something.

Into_Oblivion1 said:
The offline laptop only has had internet connection for about 15 minutes in total.

It had internet connection for 5-10 minutes during the initial Windows setup (choose languge, create user etc) - but here it said it was searching for updates etc.
And then internet connection again for about 5 minutes after logged in and entered Windows for the first time.
After that, I turned of its Wifi in Windows and disabled its Networks adapters in Device Manager.

So I am not sure, that it managed to download all the latest updates for Windows and MS Defender, before I cut its internet connection.
Therefor I want to know, if it has more than just a basic version of Windows 11 MS Defender pre-installed?

There's always a base version of Defender in every install image, it's presumed that Windows Update will eventually catch up and prioritize downloading platform and signature updates as soon as possible.

The solution to better security is to install the latest Defender updates into the install image, so while it still may be out of date, is less outdated than having Defender files from a few months or a year ago. IT pros for large organizations will do this.

A PC purchased from a large vendor (ie. Dell, HP, Lenovo, etc.) will have a factory install image that's refreshed periodically. But sometimes there's a lag between when it's imaged and gets into your hands.

The bottom line: If you're concerned about security, then take concrete actions to manage it yourself. Speculating about this or that random security imperfection isn't going to change anything. Either learn how to make your own updated install images, or after your first desktop logon -- immediately don't do anything except to open Settings -> Windows Update and scan for new updates.

Into_Oblivion1 · Feb 18, 2025

Sheikh said:
copy everything on your main system with a good AV like Kaspersky or Bit defender or ESET or Norton or ...

use parted magic bootable version (Linux) to create a bootable USB drive.

Thank you for your input

If the fileless malware starts writing something to the disk, would MS Defender then detect that happening and stop it from writing to disk?

And what about the data the filess malware wrote to the disk? Will MS Defender take care of it?

Into_Oblivion1 · Feb 18, 2025

garlin said:
Modern security products are embedded as kernel filter drivers. They spy on system activity, and have heuristics to detect "suspicious" patterns of behavior related to system calls or file activity. In some cases, they can block a process from doing something.

So you would trust, that MS Defender protects against fileless malware?

Thank you

Sheikh · Feb 18, 2025

Into_Oblivion1 said:
fileless malware

what do you mean "fileless malware"?

Into_Oblivion1 · Feb 21, 2025

Sheikh said:
what do you mean "fileless malware"?

"Unlike traditional malware, which typically requires a file to be downloaded and installed, fileless malware operates in memory or manipulates native tools, making it harder to detect and remove."

"Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect and remove."

Microsoft Defender Antivirus protects against fileless malware through these capabilities:

Detecting script-based techniques by using AMSI, which provides the capability to inspect PowerShell and other script types, even with multiple layers of obfuscation
Detecting and remediating WMI persistence techniques by scanning the WMI repository, both periodically and whenever anomalous behavior is observed
Detecting reflective DLL injection through enhanced memory scanning techniques and behavioral monitoring

Anti-malware Scan Interface (AMSI) integration with Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Describes fileless malware and how Microsoft Defender Antivirus uses AMSI to protect against hidden threats.

learn.microsoft.com

I believe its good enough

Sheikh · Feb 21, 2025

Into_Oblivion1 said:
"Unlike traditional malware, which typically requires a file to be downloaded and installed, fileless malware operates in memory or manipulates native tools, making it harder to detect and remove."

"Fileless malware is a type of malicious software that uses legitimate programs to infect a computer. It does not rely on files and leaves no footprint, making it challenging to detect and remove."

Microsoft Defender Antivirus protects against fileless malware through these capabilities:

Detecting script-based techniques by using AMSI, which provides the capability to inspect PowerShell and other script types, even with multiple layers of obfuscation

Detecting and remediating WMI persistence techniques by scanning the WMI repository, both periodically and whenever anomalous behavior is observed

Detecting reflective DLL injection through enhanced memory scanning techniques and behavioral monitoring

Anti-malware Scan Interface (AMSI) integration with Microsoft Defender Antivirus - Microsoft Defender for Endpoint

Describes fileless malware and how Microsoft Defender Antivirus uses AMSI to protect against hidden threats.

learn.microsoft.com

I believe its good enough

Understood.
I think "Memory integrity" option in windows defender is for this kind of malwares. as I know it uses virtualization to prevent those "fileless" malwares. not sure sorry.

Into_Oblivion1 · Mar 10, 2025

garlin said:
Modern security products are embedded as kernel filter drivers. They spy on system activity, and have heuristics to detect "suspicious" patterns of behavior related to system calls or file activity. In some cases, they can block a process from doing something.

MS Defender and McAfee LiveSafe = Modern security products?

garlin · Mar 10, 2025

Yes. A modern security product is one which has a kernel driver which permits it to "spy" on other running processes. Older security products ran outside the kernel and could not inspect memory inside a running process. This limited their visibility to watch for suspicious activity.

To be allowed kernel access, implies MS trusts the 3rd-party company as being a legitimate software vendor. It doesn't mean MS agrees or approves of the 3rd-party product, but it can be trusted with a kernel driver. This puts other legitimate security companies on the same footing as Defender in having equal access to Windows resources.

Into_Oblivion1 · Mar 25, 2025

garlin said:
Modern security products are embedded as kernel filter drivers. They spy on system activity, and have heuristics to detect "suspicious" patterns of behavior related to system calls or file activity. In some cases, they can block a process from doing something.

And in that regard, you would trust, that modern security products protects well against fileless malware?

russ6100 · Mar 27, 2025

Into_Oblivion1 said:
And in that regard, you would trust, that modern security products protects well against fileless malware?

You're coming at this wrong.

You would be much better off working to modify your internet "hygiene", i.e. how you conduct yourself when dealing with the day-to-day links, emails etc.

The first line of defense has to be you - 9 times out of 10 devices become compromised due to an action their operators took.

Think about all the hospitals & enterprise environments that were compromised by ransomware - do you think any of them weren't protected by enterprise security solutions? They got hit because of an "accommodating" help-desk employee or a 0-day (all bets are off then).

Really - just put all that energy into modifying your online behavior.

oldschool · Mar 27, 2025

russ6100 said:
Really - just put all that energy into modifying your online behavior.

Your advice is great but pointless, since this OP is a spammer.

Jacee · Mar 27, 2025

oldschool said:
Your advice is great but pointless, since this OP is a spammer.

Ohh?

garlin · Mar 27, 2025

I would use the term "unconvinced".

Into_Oblivion1 · Apr 7, 2025

russ6100 said:
You would be much better off working to modify your internet "hygiene", i.e. how you conduct yourself when dealing with the day-to-day links, emails etc.

I am very good at this already / I have a very strict internet "hygiene"

I just want to make sure, that my system is clean in regard of my scenario:

New laptop
Windows 11 S
Windows S mode on
OOBE
MS Defender or McAfee LiveSafe selected as the antivirus - I believe MS Defender was the selected AV from the start
Internet connection for a couple of minutes during OOBE setup

In Windows, internet connection for a couple of minutes, just to turn S mode off
When S mode was turned off - turned off the internet connection
Did not open any internet browsers
Did not visit any websites
Did not open any emails

14 days later
Turned on internet connection
Download one software from Microsoft Store
Turned off internet connection
Did not open any internet browsers
Did not visit any websites
Did not open any emails

Internet connection has been permanent off since

30 days later of getting the laptop
Internet connection still turned off
Deep scan with MS Defender - clean

I feel confident my system is clean because of all your great answers

Into_Oblivion1 · Apr 22, 2025

Into_Oblivion1 said:
I just want to make sure, that my system is clean in regard of my scenario:

...

I feel confident my system is clean because of all your great answers

As for my above post, anyone agree or disagree?

Thank you

gunrunnerjohn · Apr 22, 2025

Into_Oblivion1 said:
As for my above post, anyone agree or disagree?

Thank you

Quite frankly there is NOTHING that will keep your computer totally secure short of leaving the power off.

Into_Oblivion1 · May 8, 2025

gunrunnerjohn said:
Quite frankly there is NOTHING that will keep your computer totally secure short of leaving the power off.

I agree

But in regard of the described proces / "I just want to make sure, that my system is clean in regard of my scenario:"

Do you believe its clean from malware?

Thank you

Does Windows Defender Antivirus and Windows Defender Firewall keep my laptop 100% secure?

Software Developer

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Software Developer

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Software Developer

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Software Developer

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Accroche-toi à ton rêve

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Active member

My Computer My Computer

At a glance

Similar threads

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers

My Computer

My Computer

My Computer

My Computers

My Computer