Microsoft Defender auto-activates even though I am running MBAM Premium

Mark Phelps · Jun 4, 2022

I'm running MBAM Premium version 4.5.9.198 and have all the protections turned on.

So I was surprised when Defender popup happened for a file I was downloading.

I checked Windows Security and Defender runtime checking was enabled -- so I disabled it and used gpedit.msc to do the same.

But ... if you are running a commercial AV product, isn't Defender supposed to be automatically disabled?

ThrashZone · Jun 4, 2022

Hi,
If you have mbam set to register with ms security center it shouldn't popup unless you have periodic scanning enabled in defender.
Defender/ ms security is pestware.

WXC · Jun 5, 2022

ThrashZone said:
Hi,
If you have mbam set to register with ms security center it shouldn't popup unless you have periodic scanning enabled in defender.

@Mark Phelps

Hello, Mark.

@ThrashZone is correct in his reply to you (above).

Use limited periodic scanning in Microsoft Defender Antivirus

But interestingly, in Microsoft Community, the question was raised, and it was reported that it will still sometimes ask to run.

Microsoft Community

Just thought you might find the links interesting.

I can not personally verify the issue you described, as I have Windows Security set as primary AV, and do not have Malwarebytes Premium registered in the Security Center. This is what works best for me. Full benefit of real time protection, from both.

Take care.

ThrashZone · Jun 5, 2022

Hi,
Yeah updates or at least some might come up with mbam not compatible enough to stay as main av so ms will switch it's self to main av

I get tiered of seeing wd icon with yellow flags just because it doesn't like my personal preferences.
I personally just disable wd with cmd as admin with this string and wd icon disappears completely :look:

To turn off tamper protection leave mbam registering off though otherwise mbam hijacks the setting from being changed in wd.

Code:

rem Disable Windows Defender. For this to work you have to manually disable "Tamper protection"
powershell "if ((Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows Defender\Features').TamperProtection -eq 4) { exit 0; } ; Write-Output 'Windows Defender can not be disabled, Tamper Protection is still active' '' 'Disable Tamper Protection manually, then press OK' | msg /w *"
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled /t REG_SZ /d "Off" /f
reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRoutinelyTakingAction /t REG_DWORD /d 1 /f
reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealth /f

WXC · Jun 5, 2022

Thank you for the Info, @ThrashZone.

Hopefully the OP will get things resolved.

Mark Phelps · Jun 5, 2022

Thanks for the replies -- so I checked and MBAM is set to Always register in the Windows Security Center.

I did use instructions from here to disabled Defender using Group Policy and so far today, it has NOT re-enabled on its own. So, maybe that is the way to disable it.

UPDATE: I just got a popup that Defender detected something -- and I checked, and it HAS turned itself back on!!

I will try the registry entries noted above and see if that works.

glasskuter · Jun 5, 2022

I have always run Defender and MWB in parallel. They play nice with each other without there being any excess load on my system. Since it is not detriment to my system to run both in real time, I figure twice the protection can't be bad.

Something I discovered about Defender is the same thing that has been around since Windows 7. I noticed Defender using more CPU than I thought it should so I had to add an exclusion to C:\Programdata\Microsoft\Windows Defender\Platform\x.xx.xxxx.x-x\MsMpEng.exe (where the x's is version number.) I restarted and CPU dropped to normal. That little quirk of Defender scanning itself has been around for years and MS still hasn't dealt with it.

Mark Phelps · Jun 6, 2022

Update: Since using the registry entries from thread #4, Defender has NOT reactivated itself -- so maybe NOW, it is actually disabled for good.

The-Hive · Jun 6, 2022

Mark Phelps said:
Update: Since using the registry entries from thread #4, Defender has NOT reactivated itself -- so maybe NOW, it is actually disabled for good.

If you followed these guys advice you should be fine and shouldn't reactivate

Haydon · Jun 6, 2022

glasskuter said:
That little quirk of Defender scanning itself has been around for years and MS still hasn't dealt with it.

I thought it was a good thing that Defender makes sure that it is OK itself before it goes to work.

ThrashZone · Jun 16, 2022

Mark Phelps said:
Update: Since using the registry entries from thread #4, Defender has NOT reactivated itself -- so maybe NOW, it is actually disabled for good.

Hi,
10 days so far has the bugger man got you yet for disabling pretender oops I mean defender :look: