How fast is Microsoft Defender real-time protection at stopping a threat?

Into_Oblivion1 · Sep 27, 2024

Dear all

If a malicious file / threat gets inside my system.

1.
How fast will Microsoft Defender real-time protection detect it?
Instantly?
After a couple of seconds?

2.
Will Microsoft Defender real-time protection scan it immediately?
Or first when the malicious file is ran / activated?

3.
Does Microsoft Defender real-time protection use the online / cloud scanner or offline scanner first?

Thank you

antspants · Sep 27, 2024

You already researched this program and made 2 or 3 threads about it. Are you saying you learned nothing?
Impossible to ascertain really but one would expect fast enough to stop anything malicious when it’s supposed to and “if” it’s able to identify the malicious threat.
…That’s the whole point of the program.

WAI · Sep 27, 2024

Defender is really all you need. Most other AV have added bloat and useless features that hog resources Hince slow your computer down. I have removed Defender bc of my rig as Defender does... Slow a computer down but I'd say don't unless you are smart about the web

I removed Defender bc my computer is not up to par but I just can't afford a new system right now

Ghot · Sep 27, 2024

Into_Oblivion1 said:
How fast will Microsoft Defender real-time protection detect it?

Defender runs on your CPU.
Today's CPUs run at a few BILLION operations per second.

Infections have to convince the CPU to do what it wants.

Defender on the other hand, has instant access...

abactuon · Sep 27, 2024

You can see how this works in Event Viewer. Maybe.

Microsoft Defender Antivirus event IDs and error codes - Microsoft Defender for Endpoint

Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors.

learn.microsoft.com

Steve C · Sep 28, 2024

abactuon said:
You can see how this works in Event Viewer. Maybe.

Microsoft Defender Antivirus event IDs and error codes - Microsoft Defender for Endpoint

Look up the causes and solutions for Microsoft Defender Antivirus event IDs and errors.

learn.microsoft.com

Interesting. I have lots of 5007 entries like this which I assume is normal?

Into_Oblivion1 · Sep 30, 2024

antspants said:
You already researched this program and made 2 or 3 threads about it. Are you saying you learned nothing?
Impossible to ascertain really but one would expect fast enough to stop anything malicious when it’s supposed to and “if” it’s able to identify the malicious threat.
…That’s the whole point of the program.

I have learned alot, thanks to you all!

These questions are withtin the subject, yes - but I believe, that they deserved their own thread.

jimbo45 · Sep 30, 2024

Into_Oblivion1 said:
I have learned alot, thanks to you all!

These questions are withtin the subject, yes - but I believe, that they deserved their own thread.

@Into_Oblivion1

The only thing you can say is NEVER RELY on PAST performance comparisons in magazines or articles -- those are usually at least a few weeks out of date and a new threat could appear at ANY TIME. I'm amazed at how often people use past data for comparisons. Using that is about as valid as using past Horse racing results or Stock trades to predict future trends.

The only thing you can do is to use months of "back tracking" to see if any one product is consistently better than another - but that in no way guarantees you current protection -- and Windows defender is usually updated pretty quickly by Ms.

For several years now I've found WD the only A/V software I've needed and its fine. Thngs like Malwarebytes etc were fine a few years ago when Windows "Security" -if you could call it that - was as leaky as a sieve - but its fine now - at least for domestic users. If you want to use other products --fine if it makes you feel more secure - but there's no technical reason why you should use them -- very much products (at the domestic level - corporates is another issue) of C20 (Last century's) requirement and vintage.

cheers
jimbo

trevo · Sep 30, 2024

jimbo45 said:
I'm amazed at how often people use past data for comparisons. Using that is about as valid as using past Horse racing results...

How else would a punter determine a horse's chances in a particular race?

It's called "Form".

Almighty1 · Sep 30, 2024

The only way to know the real answer is when it actually happens because just like investments, past performance is no indication of future results. It detects in real time but how fast or if it can stop whatever it is another matter altogether.

jimbo45 · Sep 30, 2024

trevo said:
How else would a punter determine a horse's chances in a particular race?

It's called "Form".

But Form won't usually give you a decent gain whether on horse racing, the Stock exchange or even things like Economics. Usually even "Reserve Banks" - whether Bank of England, European central bank, USA Federal reserve bank etc have poorer and more inaccurate forecasts than even a modest Horse Racing tipster in the daily press (and they aren't all that good themselves). Decent back testing can only ensure that you lose money less quickly !!.

As for A/V software - it's best to go on decent technical evaluations and user experiences.

If I knew the answer for Horse Racing and Stock trading I probably wouldn't be posting on the web on a cold damp autumnal night but enjoying myself surrounded by lovely ladies near a mega warm beach somewhere being waited on hand and foot.

As they say -- "If you want to make a small fortune ---- Start off with a Large one " !!!.

Cheers
jimbo

Into_Oblivion1 · Oct 4, 2024

jimbo45 said:
@Into_Oblivion1

The only thing you can say is NEVER RELY on PAST performance comparisons in magazines or articles -- those are usually at least a few weeks out of date and a new threat could appear at ANY TIME. I'm amazed at how often people use past data for comparisons. Using that is about as valid as using past Horse racing results or Stock trades to predict future trends.

The only thing you can do is to use months of "back tracking" to see if any one product is consistently better than another - but that in no way guarantees you current protection -- and Windows defender is usually updated pretty quickly by Ms.

For several years now I've found WD the only A/V software I've needed and its fine. Thngs like Malwarebytes etc were fine a few years ago when Windows "Security" -if you could call it that - was as leaky as a sieve - but its fine now - at least for domestic users. If you want to use other products --fine if it makes you feel more secure - but there's no technical reason why you should use them -- very much products (at the domestic level - corporates is another issue) of C20 (Last century's) requirement and vintage.

cheers
jimbo

Would you still try to answer 1 2 3?
Or just your best qualified answer?

Thank you

antspants · Oct 4, 2024

I think people have exhausted themselves trying to help with your questions scattered around in more than similar threads you have started about the impossible task of 100% protecting your PC from intrusive mishaps.

There are only so many ways a question can be answered.

Theoretically and more than most likely in practice: Defender should pick up on a discrepancy immediately. That’s the one job Defender has, to protect your PC
1. If a malicious file was able to run, Defender would stop the process
Same answer as above because it’s the same question just worded differently
Obviously, Defender would use local before online, can you really believe Windows is expected to wait to find out if you have a workable network connection before it attempts to protect you? This is why definitions and security updates are downloaded to your PC

I personally don’t believe you’ll ever be satisfied with any answer you are given.

cereberus · Oct 4, 2024

antspants said:
I think people have exhausted themselves trying to help with your questions scattered around in more than similar threads you have started about the impossible task of 100% protecting your PC from intrusive mishaps.

There are only so many ways a question can be answered.

Theoretically and more than most likely in practice: Defender should pick up on a discrepancy immediately. That’s the one job Defender has, to protect your PC

If a malicious file was able to run, Defender would stop the process

Same answer as above because it’s the same question just worded differently

Obviously, Defender would use local before online, can you really believe Windows is expected to wait to find out if you have a workable network connection before it attempts to protect you? This is why definitions and security updates are downloaded to your PC

I personally don’t believe you’ll ever be satisfied with any answer you are given.

You can protect a pc 100% from mishaps - unplug it (and let batteries run down if a laptop) :ROFLMAO:

.

Actually, that is not strictly true - one could drop it, send it to the sun via a spaceship, drop an atom bomb on it, give it to your partner, let the cat wee on it, set it on fire, send it though a portal to never see it again, smash it with a giant hammer, install Linux etc.

bikemanI7 · Oct 4, 2024

Been using Defender steady since 2018. And not one infection or false positive detected since.

Of course I practice safer computing than I did years ago. Microsoft security product has improved alot in my opinion since first version in 2009

Sure I still run Malwarebytes Premium as additional security protection, but I am a bit old school and little paranoid to make sure systems 1000 percent secure

Relax Defender will catch threats fast, of course if practice safe computing it won't ever find anything in first place

kelper · Oct 4, 2024

WAI said:
Defender is really all you need. Most other AV have added bloat and useless features that hog resources Hince slow your computer down. I have removed Defender bc of my rig as Defender does... Slow a computer down but I'd say don't unless you are smart about the web

I removed Defender bc my computer is not up to par but I just can't afford a new system right now

You are welcome to your opinion but I disabled Defender and installed Webroot because it has a smaller footprint and does not affect performance as Defender does. I know you said most other AV, but I'm just pointing out that Defender is not the best AV out there even if it suits most people,

WAI · Oct 4, 2024

kelper said:
You are welcome to your opinion but I disabled Defender and installed Webroot because it has a smaller footprint and does not affect performance as Defender does. I know you said most other AV, but I'm just pointing out that Defender is not the best AV out there even if it suits most people,

I never said it was the Best just people don't get why they need to pay more when Defender is Free

kelper · Oct 4, 2024

Most cars have adequate safety features, but some of us are prepared to pay for cars with the very best crash safety ratings, that's all.

WAI · Oct 4, 2024

kelper said:
Most cars have adequate safety features, but some of us are prepared to pay for cars with the very best crash safety ratings, that's all.

yes I get that ah ha but sadly I'll never get a chance to drive due to the accident 6yrs ago. Well I'm just happy to be here and thank God my computer memory didn't fade away from the coma (3 months)

Into_Oblivion1 · Oct 12, 2024

antspants said:
Theoretically and more than most likely in practice: Defender should pick up on a discrepancy immediately. That’s the one job Defender has, to protect your PC

If a malicious file was able to run, Defender would stop the process

Same answer as above because it’s the same question just worded differently

Obviously, Defender would use local before online, can you really believe Windows is expected to wait to find out if you have a workable network connection before it attempts to protect you? This is why definitions and security updates are downloaded to your PC

I am learning alot through all your great answers.
It is much appreciated!

It is in no way my intention to annoy anyone, for that I am sorry.

1 and 2.
"Defender should pick up on a discrepancy immediately"
-
So when the file is transferedt to the system?
Or when the file is activated?

3.
"Obviously, Defender would use local before online"
-
My questions is related to an ONLINE system / system that has internet. Not an offline system.

Thank you

How fast is Microsoft Defender real-time protection at stopping a threat?

Member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Member

My Computer

Similar threads