0

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks?

Windows defender is the only antivirus allowing exclusions to be added in such a simple way through powershell and i see it as a big issue. If it removes the viruses startup methods it would be a way to minimize this issue at least partly.

Edit: I know it CAN remove the entries but i am wondering how is it handling this issue currently

Improve this question

1 Answer 1

Reset to default
0

There's a setting called tamper protection or so that closes this bypassing method. Its activated by default. I don't know how exactly it works tho.

Improve this answer
4
  • 1
    Also about nobody's answer: "Secondly, most AVs have real time protection. That means it doesn't really matter whether malware can add itself to exclusions because the AV will either catch the malware before it gets a chance to execute, or it will miss it, in which case you've been pwned." That isnt always true, sometimes Windows Defender doesnt detect viruses directly and finds them while they are running. Also the real time protection is useless against attacks with a Rubber Ducky
    – UndercoverDog
    Commented Apr 9, 2022 at 20:48
  • My point was that if malware has already managed to execute itself, even if the AV catches it later on, you had best consider yourself compromised because you don't know what the malware has done. Nice catch on the Rubber Ducky though, I hadn't thought of that vector.
    – nobody
    Commented Apr 9, 2022 at 23:55
  • I couldn't find anything about 'manipulation protection', do you mean tamper protection?
    – nobody
    Commented Apr 9, 2022 at 23:56
  • Yep, I meant tamper protection, only remembered the German word
    – UndercoverDog
    Commented Apr 9, 2022 at 23:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .