A colleague on the enterprise support team was investigating a complex failure from a customer, and after much analysis, it appeared that the problem was that the system had two different anti-malware programs installed. Let’s call then Contoso and Fabrikam. Fabrikam called a function that Contoso had detoured. Contoso’s detour thought this was suspicious, so it tried to quarantine the Fabrikam process. Unfortunately, Fabrikam had also detoured a function that Contoso was using. The result was mass confusion as the Contoso ended up calling into something that it was trying to quarantine.
Installing two anti-malware programs on the same system is like hiring two different security companies to patrol your building. If they don’t know about each other, each is going to think the other one is an intruder. If you’re lucky, their instructions are merely to report on suspicious activity.
But if you give them weapons and the authority to use them, you may end up with your two security companies pointing their weapons at each other.
In real life, you would introduce the two security companies to each other, or at least make sure they don’t patrol the same floor.
In software, this is harder to do. It’s not like you can invite two programs to lunch and have them get to know each other.
Anti-malware software typically does things that aren’t officially supported, like detouring system functions. And these detours mean that calling a system function no longer does the system thing; instead, it calls into the anti-malware software, and it might decide to do something unrelated to the system function you thought were calling, and that unrelated thing may itself start causing problems, say, by hanging. Not only is there no easy way to identify that this has happened, short of debugging an actual malfunctioning system, but even after you figure out the conflict, there’s usually no way to tell each anti-malware software to “stay on its floor.”
> there’s usually no way to tell each anti-malware software to “stay on its floor.”
Yes, yes there is. Essentially all anti-malware has a way to set false positive. However, the problem with that is twofold.
1) Trying to set this due to dueling anti-malware means trying to set this on an unstable system.
2) If one of them is a corporate managed anti-malware the local system administrator may have a hard time setting the necessary. And getting corporate to fix the policy is very difficult.
I have experience with a particular corporate anti-malware known as Carbon Black. It does in fact cause conflicts;...
AFAIK it has always been recommended that you do not install 2 AV programs at the same time because they can collide in the middle. The problem is that an average user probably doesn't know what AV program they have. Historically any OEM computer you buy will ship with a free "trial" of McAfee or similar AV program. This is a deal that the OEM made with the AV company to help sell more copies of the software. The average user is going to start using their new OEM computer for a month or so, get a prompt to buy...
This is one of the many reasons I always do a fresh install of Windows using Microsoft-provided media instead of the vendor-provided media. Of course that would be impossible for the normal user.
It would be nice if AV program developers would react to that in a sane, respectful way, and not immediately start screaming about how Microsoft is being anti-competitive and just wants to promote Forefront and Defender and needs sued for libel and slander and tortious interference and puppy-kicking…
Defender does have an unfair advantage. If it needs a new hook to do its job, that can be coordinated with Windows development. A third party may have no choice but to do something unsupported in order to mitigate specific types of attacks. And then Windows may need extra development effort to maintain compatibility with this third party software when internals change.
> Anti-malware software typically does things that … … may itself start causing problems, …
Nuff said, I guess.
Very true. When I did IT support for a company using the corporate version of a well-known AV it did cause some “interesting “ problems. Like you cannot uninstall it or repair it using the entry in add/remove programs; one version continually looped through the entire registry causing PCs to almost stop; and another version quarantined some system files which caused some PCs to fail to boot. The vendor’s support people assured us that all the problems were entirely our fault.
We used to say that a virus would cause fewer problems than the AV 🙂