A colleague on the enterprise support team was investigating a complex failure from a customer, and after much analysis, it appeared that the problem was that the system had two different anti-malware programs installed. Let’s call then Contoso and Fabrikam. Fabrikam called a function that Contoso had detoured. Contoso’s detour thought this was suspicious, so it tried to quarantine the Fabrikam process. Unfortunately, Fabrikam had also detoured a function that Contoso was using. The result was mass confusion as the Contoso ended up calling into something that it was trying to quarantine.
Installing two anti-malware programs on the same system is like hiring two different security companies to patrol your building. If they don’t know about each other, each is going to think the other one is an intruder. If you’re lucky, their instructions are merely to report on suspicious activity.
But if you give them weapons and the authority to use them, you may end up with your two security companies pointing their weapons at each other.
In real life, you would introduce the two security companies to each other, or at least make sure they don’t patrol the same floor.
In software, this is harder to do. It’s not like you can invite two programs to lunch and have them get to know each other.
Anti-malware software typically does things that aren’t officially supported, like detouring system functions. And these detours mean that calling a system function no longer does the system thing; instead, it calls into the anti-malware software, and it might decide to do something unrelated to the system function you thought were calling, and that unrelated thing may itself start causing problems, say, by hanging. Not only is there no easy way to identify that this has happened, short of debugging an actual malfunctioning system, but even after you figure out the conflict, there’s usually no way to tell each anti-malware software to “stay on its floor.”
Meanwhile, users downloading unsigned binaries that end up doing keystroke logging or ransomware attacks, which don’t need UAC elevation and don’t trigger AV.. and the 20 GB game they downloaded, which is (probably) perfectly safe, throws false positives, gets quarantined, and fails to start.
AV has been in a terrible state, for many years.. seems like nothing but false-positives and false-negatives.. heaven help anyone running two of these things stacked.
I don’t know who’s job it is to untangle this mess in the Windows ecosystem — but this seems like high on the list of reasons people migrate to other platforms.
Windows is already available on several devices that don't have antivirus services, such as HoloLens, Windows 10 Mobile, and the high-stakes Xbox console where it is critical to combat threats such as cheating and tampering and piracy. So it becomes a lifestyle decision to take notes on how those devices operate (AppContainer is recognized as a security boundary by the Microsoft Security Response Center) and voluntarily hold your computing experience to those same standards.
You can get some automated assistance by applying a Windows Defender Application Control policy that simulates Windows 10 in S mode, but you will want to...
Quite a few of us live in the world where signed binaries are more likely to carry malware than unsigned binaries.
Malware authors have adapted and manage to obtain signatures for their binaries now; while the legit unsigned binary sources are still legit and will not sign binaries.
i agree with him no need to run two anti virus.
> there’s usually no way to tell each anti-malware software to “stay on its floor.”
Yes, yes there is. Essentially all anti-malware has a way to set false positive. However, the problem with that is twofold.
1) Trying to set this due to dueling anti-malware means trying to set this on an unstable system.
2) If one of them is a corporate managed anti-malware the local system administrator may have a hard time setting the necessary. And getting corporate to fix the policy is very difficult.
I have experience with a particular corporate anti-malware known as Carbon Black. It does in fact cause conflicts;...
AFAIK it has always been recommended that you do not install 2 AV programs at the same time because they can collide in the middle. The problem is that an average user probably doesn't know what AV program they have. Historically any OEM computer you buy will ship with a free "trial" of McAfee or similar AV program. This is a deal that the OEM made with the AV company to help sell more copies of the software. The average user is going to start using their new OEM computer for a month or so, get a prompt to buy...
This is one of the many reasons I always do a fresh install of Windows using Microsoft-provided media instead of the vendor-provided media. Of course that would be impossible for the normal user.
It would be nice if AV program developers would react to that in a sane, respectful way, and not immediately start screaming about how Microsoft is being anti-competitive and just wants to promote Forefront and Defender and needs sued for libel and slander and tortious interference and puppy-kicking…
Defender does have an unfair advantage. If it needs a new hook to do its job, that can be coordinated with Windows development. A third party may have no choice but to do something unsupported in order to mitigate specific types of attacks. And then Windows may need extra development effort to maintain compatibility with this third party software when internals change.