Can you DISABLE Windows Defender Antivirus?
Vložit
- čas přidán 20. 08. 2024
- Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeac...
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
🐜Zero2Automated ➡ Ultimate Malware Reverse Engineering j-h.io/zero2auto
🐜Zero2Automated ➡ MISP & Malware Sandbox j-h.io/zero2au...
⛳Point3 ESCALATE ➡ Top-Notch Capture the Flag Training j-h.io/escalate
👨🏻💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humbleb...
🐶Snyk ➡ j-h.io/snyk
🤹♀️SkillShare ➡ j-h.io/skillshare
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsor...
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc
For an influencer who teaches tech, you lack basic experience with the registry and other stuff. 🤦🏼
Make your videos better organised.
Would you mind filling me in on what you are referring to by "other stuff" and "basic experience with the registry?" And how I could make my videos better organized?
@@_JohnHammond It might be better to explain that certain commands will fail, because they require admin. After some programs were blocked, I did not see any attempts to allow the thread as a limited user. I would assume it requires admin.
For the registry, if you export a key, you will notice that there is a header on the first line, which you did not add. Take a moment to read the errors and think how to overcome them, then do so. You pretty must left the entire video with no results: what does each script or tool do? Does it change any registry settings, which? What is the end result?
I had disabled Defender manually, I mean the protected service. It didn’t give up easily. I had to do it offline, then there are two more services that watch it's back and will re-enable it. There's a big difference on performance, especially when you compile large projects, though I have a hunch there is more work to get rid of any low-level file-system filters and drivers.
I wouldn’t trust running random executables on a development machine. Scripts and registry changes are more trustworthy.
Deleting Defender program files: I would assume the Defender needs to be stopped; any shell-extensions unregistered and not in use; trusted installer credentials: admin may not be enough. There's not much point in that anyway, so long as it is disabled. I can tell the video is dedicated to actually bypassing the security rather than running with Defender disabled, hence either the title is not suitable or it needs more material to fully cover the topic.
Also I remember on the previous video I watched about reverse shell, once the base64 was detected by cloud protection, you said you still have a working shell, but did not try running a command to confirm. A remote shell does not have a concept about terminal window size. It's plain text.
You do seem to have good experience with PowerShell. I personally find it hard to remember any commands, so I'd rather switch to a UNIX machine or save them to a text file. A good habit of your indeed. Good luck, John!
Oh, and since you are into security, I can point you to a web server that I think is pretty had to exploit. Let m know if you want to give it a go.
@@GeorgeValkov Hi. I need more information to reproduce disabling defender.
Lol who even are you
@@AKU666 Disable the following services: SgrmAgent SgrmBroker WinDefend wscsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet???\Services
Start = 4
You must modify the registry offline, from another installation of Windows.
I've got to say, Defender has definitely been way more secure than I even expected.
Even just trying to do labs as I work through my PEH course, I've run into a handful of times where I'm using something like Metasploit and have the shell broken when Defender catches the payload and isolates it, causing me to need to pull the Windows machine up to try and allow it all so I can keep learning.
You need to make a custom loader for metasploit shellcode to use it undetected.
@@tb-mn3po Oh yeah, I'm sure there's good ways around it, but trying to follow along with whatever guide I'm going through that's focused on a different aspect, it's nice to not have to worry about that aspect.
@@tb-mn3po link us something on this please
So why not use Linux ?
Chris Titus Tech made this article, because windows defender is not that easy to disable, even as an administrator. Just disabling real time protection isn't enough, as after a reboot it comes back up. That is why the article was made, to show people all the different ways to fully disable defender and (or) even uninstall it.
I love Chris and John for diffrent reasons. All of you should too!
Uninstalling it may be hard but disabling it is easy so idk what people are talking about
just do gpedit to nerf real time protection, then disable fraud (?) protection check mark in defender settings.
But ngl, i am not sure how to disable defender completely, as i only needed to nerf real-time invasive deletion of files. Maybe if i had purpose
@Joshua F Me too, how could you have guessed it?
I'm also a subscriber to the channel this video is talking about, saw the video that inspired this video, and while i no longer use windows day to day, i was fairly confident that it would not work quite as easily as that video suggested, good to see i was right, and this video is yet another great example of why i subscribed to you, you do the technical stuff, but also show things from the perspective of an attacker or end user. As opposed to simply reading off some article somewhere.
Awesome content. Love your way of teaching and it goes many many miles with the IT teams that want to learn and do!
I think what's important here, is that if the victim was just an average Windows user, then he's most likely using his main account on his windows machine, which will have admin privileges. So if the payload were to execute, it could have something as UAC bypass implemented, so it would run with admin privs without ever asking the user to grant those permissions and do everything in the background.
The Set-MpPreference long command that you executed doesn't actually do anything as long as Tamper protection is enabled. Neither does the .reg file. It will show up as successful without throwing any error if you run it as Admin, but if you actually verify the Protection status, you will see everything is still enabled (Tamper protection reverts it).
You didn't wanna mock the author of the article, but I will do it for you. What he showcased is literally useless. Mainly because the tools he was referring to are all signatured by defender (as you showed us) and the reg tricks and powershell commands simply don't work because of Tamper protection.
However, what tamper protection doesn't catch, are the Exclusions for some reason. So ideally you would do: Add-MpPreference -ExclusionPath C:\ and Add-MpPreference -ExclusionProcess C:\*
this will literally exclude everything and even though protection is enabled, it's not scanning anything.
Yes, you do need admin privs to execute those commands, however like I mentioned before, the payload can utilize UAC Bypass where it won't alert the user to grant the process Admin privs. (the user still needs to be in Administrators group in order for it to work)
While this is bad, you could literally still do the same thing with other AV Solutions, not just defender. Of course, those exclusion commands wouldn't work, but once you elevate yourself to admin, you can actually elevate yourself to TrustedInstaller if you know how to, and for example change the binpath of the AV service so it can't execute. This is just one of many other possibilities of what you can do.
You can still prevent all of this from happening if you use your computer as a low privileged user and you have a backup admin account, with password set (which you don't log into). So everytime you want to install something, it will ask you for that Admin user password, instead of just choosing between "Yes" or "No" in the UAC prompt, which can very easily be bypassed.
So to summarize, the windows defender is not worse by any means than other AV solutions. I use it myself personally. But if the attacker knows, what to look for then he can disable them, as long as he can escalate privileges.
I wanted to add that uac bypasses, at least the majority, can be stopped by setting your uac settings to be as strict as possible, rather than the default level.
This is cool but some AVs have also tamper protection technology such as self defense in Kaspersky Cloud security !
So the exclusions technique that you are talking about won't work even with admin privs except on Windows defender + some UAC bypass + some 0day in order for it to work in real life..
But the main problem is the admin priv as what john said in the video
@@jamieeccleston2988 using reg tweaks ? Or group policies ?
So it can prompt you to enter the password each time ?
@@_AN203 On windows defender the exclusion technique does work, and you don't need any 0day. I did mention that the exclusion technique wouldn't work on other AV products, but you can do other things there, like I said.
You still have bigger issues than defender.
I was amazed to see that windows defender actually works because I've been sceptical of pretty much all antivirus software. This is awesome
at 06:06 - I think it was missing the "Windows Registry Editor Version 5.00" header so it threw that error. If you export a .reg key you'll see that it always starts with "Windows Registry Editor Version 5.00", followed by a blank line, and then the exported keys and key value pairs.
Personally, I don't use an antivirus because I know what I'm doing and I don't usually browse through shady stuff. If I'm forced to browse through shady stuff I usually do it through a VM or with the help of something like sandboxie.
DOH, I am an idiot. Super sorry and thanks for the great catch. To add to the test I reverted to my snapshot, added those lines, and had the new error "Cannot import C:\Users\lowpriv\Desktop\windefender_disable.reg: Error accessing the registry." :)
@@_JohnHammond Nice and you're not an idiot! Sometimes the obvious things slip our minds. I had doubts it would work too. Giving access to registry to a low privileged user would be like handing a gun to a child. Microsoft's security has improved a lot over the years.
Wdym exactly by not using an antivirus. did you disable defender or do you just dont have a third party one
@@kaaaxcreators I disable real time and cloud delivered protection.
@@TurntableTV May I ask why
It is fairly easy to bypass UAC undetected with some methods, after that defender can be disabled or a exclusion can be added and the malicious downloader can download its payload and execute it. It is a method many attackers use these days and it is discussed a lot on hacking forums.
If whatever is "targeting you" can pass through windows defender, any other antivirus-for-everdayUser would be the same. Most of this bashing against windows defender is from the old antitrust sentiment for windows. "Im a cool kid, i know better than the engineers at windows"
10:22
i laughed so hard here what a great day :D
Honestly i am learning alot from you these days , dunno how i discovered your channel but i am really glad that i found it somehow .
i will keep following you to learn more how to protect myself . thank you for all your work.
5:10 - Ah yes, the hacker's intuition hahah :D
Hello John, I use Windows Defender since the beginning. I find the integrated antivirus good enough for my usage.
We are developing industrial application in my company, and as part of distributed application (in local network), we have 'manager' apps that stop and start processes on clusters (with user privilege always).
As far as I know, we never had any problem with Windows Defender, it does the job without being too intrusive and denying any of our framework actions.
We cannot say the same for other Antivirus we tested, more intrusive, and putting our apps to quarantine all the time because it contains start and stop process (at user level privilege !!) and that breaks our entire system.
Therefore we stick to it, and I also stick to it on my daily dev laptop. If you add common sense to that (listening to the warnings), you should be safe (it's been the case for the past 12 years).
Christophe.
This whole video is such a troll John haha
What do you think? Am I totally wrong here? What do you think of Defender as an antivirus? Do you use Defender, or something else?
I wonder if it works differently between Windows 10 and 11 maybe?
I've been really happy with Defender at home, and seeing how well it works as a Security Analyst at work. I remember running Responder on my VM network in my home lab and forgetting to isolate the network from my home network with my work laptop on it.
Sure enough, we got a bunch of alerts in Sentinel that logged and alerted us to the Responder traffic that hit my machine.
My co-worker pinged me and said "What the heck are you doing at home!? :D"
It definitely seems like a bit of a silly article if the crux of the argument is "well if you have Admin permissions" since that opens up most anything to attack, which is why it's something to be so wary of.
I used windows defender and I didn't used any antivirus from the first time I got my PC(5-6 years ago) and will not use anything else. From my opinion Microsoft does everything as soon as possible to keep the defender and windows up to date
i use kaspersky :)
@@nissanswain431 You know this video is about Microsoft/Windows Defender eh? Not Bitdefender.
But in task manager see the resource usage man yes i want security but it uses alot of power & memory
I saw that same video you're talking about the other day and immediately thought wtf is he talking about.
As bad as people say it is I think it's improving quite a bit, and a lot of viruses you encounter are more of social engineering then your pc randomly contracting one, so I feel as though as long as your not installing a bunch of sketch stuff you don't really need the best AV available since it's essentially saving you from yourself.
Windows Defender is adequate for most users. It's quite frustrating to see the average Joe using one of those bloaty subscription antiviruses because it was preinstalled with their pc and they don''t know any better.
The free Windows Defender is quite good. Smart Screen is worth leaving enabled even with high end EDR solutions. Though with how little overhead current anti malware applications have why not just leave Defender on? An attacker having to disable it is one more chance to catch them.
curl.exe doesn't follow redirects by default. You need -L or --location
time stamp 10:39
I'm going to comment on the first qualification that John made that he's not talking about the MS Defender for Endpoint product, but just the Defender AV that comes with MS Windows. Defender for Endpoint does use that MS Defender AV (although it can also work with other AV products), but the critical component of Defender for Endpoint is the MS EDR component. The EDR component can use Defender AV component, but any bypasses for Defender Av that would work without MDE, could (in theory) apply to the AV component of MDE too. (The catch is that EDR could detect it, and it also can block on it's own -- at least that's the case when other AV products are used with it). So potentially, any bypasses for stock Defender AV are still noteworthy even for MDE.
I saw the original video, and I'm not sure I understood it the way it is presented here.
The issue I've had with defender is that there are circumstances where I need it off and to stay off and that's nearly impossible without going to that settings and disabling real time monitor every time.
I have a few machines that are kept disconnected from the Internet and need to run performance operations and defender insists on consuming at least 40% to 60% of CPU.
And for these occasions the video was a great resource.
The angle CTT was presenting was that of having a dedicated gaming machine that isn't really used online.
In my case I have a client in a manufacturing place where these machines crunch high intensity operations and are physically disconnected from the Internet.
However that being said, I think the video does a good job illustrating how effective defender can be at it's job
Here you go I found windows powershell or cmd don,t like you copy and pasting. Look at this.
1. Run PowerShell with administrative privileges (Windows key + X + A)
2. To disable real-time monitoring for Windows Defender, run the following command:
Set-MpPreference -DisableRealtimeMonitoring $true
3. To enable real-time monitoring, run the following command:
Set-MpPreference -DisableRealtimeMonitoring $false
To switch to Admin rights
Start-Process powershell -Verb runAs
If an attacker is in the position to even disable defender, they are probably also in a position to uninstall any other third party anti-virus, right?
Basically, yes. However the industry is moving towards EDR, at least in a business setting (requirement for cybersecurity insurance). Pretty much all of those offer uninstall protections and kill off anything that attempts to disable.
13:40 Even being administrator hacker may need to disable defender or able to disable defender if he wants his malware or virus to be future proof on that system
1. hacker may wants to use the system in future for example as a bot net
2. or wants to keep his access of the system for any number of reasons.
3. one more reason to disable defender can be to keep his malware/virus undetected (if it is undetected right now by defender) from the future security update of defender.
4. 25:27 the last one "disable defender" can be useful in a case when user tries to install a cracked software and manually turns off the defender (as cracked software usually are flagged as virus) hacker can attach this file with the cracked software and after that he won't be able to turn defender on.
although these are not the best case scenarios but again it depends from situation to situation and user to user whom you need to attack and how much access you already have or can have (physically/remotely) on his system.
"I just wants to say you have endless possibilities once you start thinking" or may be I am just too optimistic...
Great content and showing that we need to test the accuracy of the various write-ups that we see. Many times I ha e seen write-ups in this industry that only work with privileged access and not as a standard user. As you mentioned, if you are an admin you can already change anything so those write-ups are moot. The real concerns are when changes can be made or an exploitation as a regular user.
Again, thank you for this content and making that statement without actually saying it. This industry needs to learn to test and not just take the write-up as 100%. There is too much of that which is just misinformation.
at 7:36 you where typing everything in on the picture there is this program called Cap2text that can take a screenshot and turn an image into the text it consists on
currently setting up a new AD and GPO's and this was an interesting watch. Thank you for the great content!
As someone who has done this on a w10 pc. You need to be admin and I would opt for the regedit or gpedit way. However you're not going to get around needing to be admin unless someone has come up with a way to push payloads to do it.
Great running into you at DC!!
Thumbnail was great
my face does that too sometimes
when dealing with Defender
Not all EPP platforms are able to be disabled with an admin account. DeepInstinct hasadd layers of protection for their agent, services, and reg keys.
Windows Defender has definitely come along way. I would say today its very good. especially the ransomware protection that's provided. I still have windows prejudices built into me though from years of poor experience. so I prefer to use open source solutions
Totally agree! There isn't one size fits all solution for how many layers of security needed, but I'm pretty sure that any form of anti-virus software is required almost all the time.
If his argument was "Windows Defender Bad for Performance, here is lightweight anti-virus software you can use today", then I would have understood the suggestion.
Windows defender is probably the best performing AV given its capabilities, I wouldn’t trust anything that has “lighter performance”
I think if they "simply" put in a password lock prompt before it can be modified / disabled / unload, it won't have much difference to other products.
Both are just false sense of security, by having admin, you can always unload EDR / EPP if you are determined.
Loved the video, I need to learn more about how AV / EDR is defeated in general
There are some AVs that can't be disabled with admin. One of them I encountered was Cloudstrike Falcon. That one requires a key to uninstall, and runs on the kernel level. Even with physical access to the system, removing the registry keys and files for it did not kill it.
Call me closed minded or ignorant, but why would anybody want to outright remove defender? I've see this topic come up every now and then and never understood it. It works very well and if needed, just add exclusions or disable temporarily. Now a days, using a Windows computer with zero protection is not worth the risk and most free alternatives are similar or worse.
I can't think of a reason I would want to in everyday life, but it is useful to disable it for studying Pen Testing things when you're trying to just get the fundamentals down.
I've been working on Windows Pen Testing study lately, and while it's not "realistic" it is nice to disable Defender so that there isn't something to potentially catch the exploit and cause it to fail, while you're stuck sitting there thinking you did something wrong or the exploit itself is broken.
It makes it a lot easier to learn the fundamentals of how things work after which you can graduate to working on evading things like Defender once you understand the how and why of an exploit.
I have done a dissertation in cybersecurity, in that dissertation I wanted to show and monitor the system AFTER the execution of the malware. Therefore since my focus was not on how a malware can trick the AV I just disable the AV an execute it. I think those are the situation where you want your AV off , even though ,those experiments are done in a sandbox environment. Other reasons why would you like your AV off on your main computer is to execute different false positive files.
The perspective is from the attackers pov. Phished user runs the malware that stomps MS Defender and the malware is free to connect back.
My issue with it is that my cpu usage I idle at 70 degrees. Antimalware won't stop I'm guessing scanning. Haven't found a fix without disabling it
once upon a time, there was a cyberSec kid who didnt care about windows defender, until he needed to reverse a virus in a CTF. He surprisingly found that he couldn't unpack the attachment correctly... then...
15:32
you can delete windows defender in recovery mode (command prompt) without restrictions because the user is NT AUTHORITY\SYSTEM
(no need "getting permission" from TrustedInstaller)
Paths:
rmdir /s (driveletter):\Program Files\Windows Defender
rmdir /s (driveletter):\Program Files (x86)\Windows Defender
rmdir /s (driveletter):\ProgramData\Microsoft\Windows Defender (maybe incorrect path)
[ for windows 10 - 11 ] rmdir /s (driveletter):\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy (windows security/defender frontend gui)
Command prompt un recovery mode is password protected by Admin
@@Kingdd1os no?
what do you mean by "protected by admin"? as far as i know, it only happens if you delete something in system32 while on normal mode
It's great at finding old key-gens and getting rid of them for me. What a service!
Thanks John. I haven't used Windows for a while, but it was a great video.
I'm on my way to work so I can't watch this whole video, but I am currently the number one ranked payload contributor on hak5 and have written a few payloads to get around defender.
Sure disabling real time protection goes away after resetting the computer but adding a file type or folder to the exclusion list is easy and persistent
Do you have to have admin permissions to adding to the exclusion list? (I'd imagine you'd have to). If so, I don't see too big of a vulnerability, but anyone with a little bit of knowledge once they have admin rights could destroy, or atleast temporarily disable, almost any antimalware in the consumer sector
@@kadragon3764 yes you do and I didn't get to watch more of the video till my break so didn't realize he was using a non elevated account. For that you would def need to escalate your privledges first.
Home user 99% of the time run thier windows as admins. Wich makes it "easier" to get around, but if you run as non admin it almost need physical access to the Pc to get around (unless you find som escalation 0day thing). Wich is why TPM and Secure boot and stuff makes no real sense more that to cement that Windows is the only OS capable of running on that PC (at least they want it that way, But physical acess and the option to disable is there) Same with Anti-Cheats that runs as root (valorants rat for ex.) If you have physical access to the PC the Ring0 anti-cheat is nothing for the creators of the cheats to get around, since physical access is king, always.
You can go into group policy editor and enable ”disable windows defender”. This will stop the service completely and then you can run your Defender Disabler to do the rest
If Defender is one of the best AVs out there, because it's the Auto Submission is on by default, plus Defender exists on almost every Windows machine, which makes the AV so much power, and gives Microsoft team opprtunity to view and patch potential vulnerabilties.
Like fodhelper.exe uac bypass which is still not patched since 2017?
The point is that, usually, people only have one user in their PCs, which is admin. In that case, if they download some malware, it would be easy to disable Windows Defender isn't it?
Most people don't have passwords to access their admin permissions...
As non-fan of Defender who has spent hours on top of hours of trying to remove it. Its not happening. I use a paid 3rd party AV software and still can't gain access to controlled folder access without having Defender active.
Hi please make an video crypting an malware to bypass defender
I like windows defender myself. I have just had to many issues with high system resource usage.
Did the registry file begin with [Registry Editor 5.0]?
Turning Defender ON as low priv user is not possible i think. Turning it OFF is surely off limits comeon....
There is still a concern. Defender has an AD policy tie ins. While getting the ability to set AD policy is a dire situation in itself, it accelerates the ability to shutdown AV domain wide. With most third party stuff, you can't even touch tamper protection from the domain side.
That's a pretty good guard dog, but it doesn't obey your command. It may protect your children and grandparents, but it doesn't obey you.
Really useful and informative. Thanks so much for sharing.
hey Johnny you cant disable defender completely in newer build of windows even with admin permission
Door locks are useless because a burglar can just go into my house and open the door from the inside.
Nice video. I can tell you why i want it disabled. It keeps deleting exceptions. Every 3 or 4 days when there is a update i have to go back and redo all the exceptions. Yeah i want it off. Just to much intrusions and blocking me. Not for me. If it was not for the ease of gaming i would never use windows. My linux distro is rocking and just keeps getting better.
I cant believe I solved a problem before John Hammond! My life is complete. referring the the header in the .reg. Thanks for the always Great videos John. Today you taught me windows 11 has curl. so we are even today
defender i found to be the best balance between protection and performance also a set and forget from a user standpoint
Thank you for your video! After I saw CTT's video I was worried about Windows Defender. I always told my family and friends that Defender is secure enough and they don't need any other antivirus software. I cannot imagine what it would be like if someone lost all of their data just because I told them not to install proper antivirus
It is actually not secure enough. I can give you a program, if you execute it, it won't be detected and in 10 minutes your windefender would not work anymore. After that I could do whatever I want. I would tell them to get bitdefender. As Kaspersky isn't really 100% secure anymore with the whole russia situation.
@@tb-mn3po corporatw shill.
Any AV can be defeated.
Smirks in Linux.
Unless you practice good security hygiene (and I know you do, ofcourse ;) you can easily be in a worse place on a Linux box then on a Windows box.
I've seen way too many folks on badly configured Linux boxes, installing binaries left and right and running all kinds of untrusted scripts as root.
@@B-a_s-H
TL;DR - That's definitely more of a user issue, not a Linux problem.
I do know what your saying, as I have seen things like this myself and was there at one point. It's most always due to newer users who are coming from Windows and expecting to just use the same methods to install software. It's a learning issue, one I have deemed "windows poisoning" (expecting to use a completely different OS and expect same results) -- true for MacOS as well. Not to say I am a hater of Windows, because it has it's place, but I would gamble to say the malicious area is 99% a Windows issue which is a very known targeted OS for scammers, viruses, etc. With Linux, most everything is open-source so if you don't trust a piece of software, it's quite easy to use the source code and compile it yourself, and no, you don't have to be a "super geek" to do that.
Literally every Linux distro has repos for packages that are safe to install with builtin package management. Windows has no such thing afaik, everything is not approved by Microsoft. Every Linux OS an entire approval process. Then we add the fact that on Windows, you are expected to goto a 3rd party website to download an exe (binary) to install, many of which are malicious (installs extra software, etc). On Linux, this simply does not happen since everything is safely stored on approved distro repos with hash checks on all installed software prior to installing, and again, 99.99% of it is open-source which on Windows bases OS-es, that's almost completely opposite so you really have no idea what you are running when you launch software. I wont even get started with the security implications of even just merely using a modern Windows OS. The only way to be "unsafe" on Linux so to speak is to manually add repos/software from untrusted sources, or as you said, run random scripts without actually knowing how it impacts your system which is just plain stupid. True of any OS really. If you don't understand something and end up breaking your system, that's on you. Lazy approaches never have a good outcome right? Arch Linux has an AUR for example where something like that could happen, but I've yet to ever see it. Even when I was new to Linux, I had no problems with software maliciousness. I did break my own system quite a few times, but it's also because I was learning. I used to have the similar things happen on Windows years ago when I was new to that.
The takeaway here is to not use a new OS you are unfamiliar with as a daily driver until you actually learn it properly. If a user is depending on installing from unknown software sources in Linux and running random "magic" scripts, instead of using builtin package managers or properly configuring/installing, again that is more of a user issue than an OS issue. Just like Windows, if one takes the time to learn how to properly use Linux, it's really a lot more stable and user-friendly experience than what the stigma and bias says from Microsoft fans. Looking back and another viewpoint, if I could start all over between Linux/Windows, I would much prefer to take the time to learn Linux with all it's amazing capability, security, and stability that what Windows is turning into, an app, which will likely be a subscription service stored on a remove server in the future.
@@terminalvelocity4858 Based asf.
every time i turn off windows defender it auto turns back on pls help
My Organization run windows defender and have zero intreste in running anything eles...
Very good analysis 👍
That was great. I was eaiting for a wd hack, but even more glad there wasnt one. Well done microsoft.
hey john you did it all wrong. you need to have the same setting as the author. so you basicly need john mcaffes windows vista highend pc fully updated.
If the host is in corporate environment, can't domain admins control what changes local admins permitted to make? That's it's very much possible domain admins can prevent local admins from disabling windows defender. Maybe these methods were meant for that case: You're local admin but not permitted to disable defender by usual methods.
i dont think having uac perms is unreasonable, first of all, most payloads are delivered together with some kind of escalation, and second i click UAC allow atleast 20 times a day. some day one could slip by
Vulnerable machine was set up with default windows firewall policy I guess.
As a Administrator. When I install a clients AV of choice and leave defender intact, i get all sorts of load issues, despite Defender "claiming" it turns off. But looking at running processes after reboots and installs of other AV's. Defenders Anti Malware Executable, is still chugging along at 25% CPU at idle load.
I think you are looking at this through the wrong perspective as an attacker and not as a person who has to make sure the system is even usable.
Defender is actually a series of services and your other AV supposed to know which part of Defender services/protection to disable during the installation. Defender has the API for other AV to turn those off because of the lawsuits raised by other AV vendor in 2010s.
If your other AV doesn't disable Defender properly, it would suggested that your AV isn't doing a good job of setting your system correctly and I would personally not trusting that AV at all.
@@samic Sophos is the AV that was dictated to me to use from on High. It shows Defender as disabled in the GUI after installation, but the AntiMalware Executable service which is part of Defender still is enabled. as such I Rip out defender with this:
Uninstall-WindowsFeature -Name Windows-Defender
btw, The above command came from Sophos Support, General internet searches, POST 2010, and Avasts website, and Avira's documentation, so there is still something hanky going on with Defender.
@@markgilbert5856 That means Defender is on Passive Mode (it detected 3rd party AV) but Sophos were conflict with it. To be honest any 3rd party AVs I've used has no problem with with Passive Mode but I don't use Sophos so I couldn't comment on it. Completely rip out Defender is actually a bad advice because Defender is a comprehensive protections that 3rd party AV might not provide in their package and Defender will covers it.
The reason why it is "EASY" for admin to disable Windows Defender because Kaspersky sued Microsoft for closing kernel hook for AV so Microsoft give them API to turns off Defender or running in Passive Mode. Clearly this video has failed to mention that.
@@samic if only the anti-malware executable, wasn't taking up between 25 and 50% of my CPU. Then i would never remove it. The fact that it eats up more resources than my users use is ridiculous
@@samic Thanks for the gaslighting @samic. The user should have full control of their software on their PC. That's not something Microsoft wants with their free OS.
so at the end. there is hard to disable AV or Windows Defender with low priviledge account, am I right?
I think Defender is great especially as an included AV in Windows. I use MBAM in conjunction with Defender
"Can I hack this computer using muons? Yes: by John Hammond"
You can try using a crypter to hide the github tools inside it as a jpeg and try?
Looking at private crypters it seems like WD is the first thing to go
UAC bypasses go crazy
Surely such tools are blocked pretty quick when they become public. But I bet there are 0days out there that we don’t know about which do work.
Maybe there are, maybe not. but where is the PROOF?
Good to know is difficult to turn the Windows Defender off, but that would happen with third-party antivirus, for example, Malwarebytes.
you do so complicate all prosses. i dont know so much but by just close defender, download the bat file from code (the green button)i run it and defender close and at the end i uninstall defender too
How do you know everything dude...you are going on writing commands which are not given.
it baffles me that windows doesn't have a default hidden admin account that you can't login to but you're forced to make a password for, and you call it from standard when needed.
unix has figured this out ages ago yet Microsoft is still giving full admin to any first user.
how can you say you can’t do that as a lowpriv user .. you don’t even need an account just use netcat 😐
I'm not sure if it's any better now but a few years ago I didn't get only 1, but 2 backdoors even with Windows Defender activated. That's why I don't use it, I'm a very paranoid person and I always need a decent antivirus on my pc.
decent is not good enough
I was wondering if notepad is saving the file in a different format (UTF vs something else)
John, can you show case go Garble?
I love the way android is hardened. NO admin until you want to root the phone. 😁
Where can you find the Windows 11 image?
Defender can be completely killed if you're admin? It's been a few years since I tried but I've never been able to do it. Deleted/changed all the reg keys, deleted prog files, deleted startup entries, changed local group policy... It might tell you it's disabled but unless you severely break the OS it will always be running in the background in some form or fashion. Either that or it will just turn itself back on the next time you reboot.
You are correct. He also mentioned the services and drivers, but these cannot be stopped by admin either. In terms of disabling it, the best i managed to do was place it in passive mode.
i turned it off as part of my security+ labs... so it can happen
In my opinion, disabling Windows Defender Antivirus makes sense when windows is running on a virtual machine as a "gaming console".
In this case, after disabling Windows Defender Antivirus, we will gain a few frames per second.
🤦♀️
How many frames will you lose when your machine gets popped, bruh?
Talk about a false economy...!
Its has become quite good the best method i found to disable it is using a HID like ducky or a pi pico and and download some malware on it. But who keep there machines on while going to lunch right?
The actual problem it, outside a organization, average person is running windows as admin ...
so it's actually a USER ERROR, but i hate to see Microsoft is not enforcing making of a separate user account when they go ahead and added requirements for Secure Boot and TPM 2.0, while forgot to add a prompt for making a separate user account
That itself make windows 200% secure for normal joe... and it is defenetly not about windows defender...
can you use obfuscstor/crypter on those bat files and try again?
What's the link to the disabler?
It's a terrible antivirus because you can only restore false positives from quarantine using the command line. And yes, it's possible to disable it, I have it disabled.
I recently created a ransomware with my own microframe work, and guess what? , I actually managed to bypass windows defender, also I had malware bytes turned on, and it showed some ai malware detected, but I'll appreciate that malware bytes had used some AI algorithms to detect it, so, it works better, now, again, it is just one scenario, just had to appreciate that thing! it's a decent antivirus, although there's a crack version available for those who need it for free.
I hate how windows defender detects py exes as virus when I legit built it myself