Windows 10: Windows 10 will allow apps to actively scan their content for malware

Source



:)

 

Microsoft Windows Malicious Software Removal tool - Nov. 2017 is stuck on powershell.exe

The MSRT seems to be misbehaving for lots of people lately, and the real question isn’t how to fix the bugs (we can’t) – it’s whether it really makes any sense to be scanning with this relic malware-removal tool. The MSRT was a stopgap solution for
people on older operating systems that might not be heeding the Security Center’s warning to install a real-time AV app – and this tool can only detect a small number of prevalent threats.

But now that we have Windows Defender Antivirus included in Windows 10, you should just be running occasional Full Scans with Windows Defender itself. Windows Defender uses the full set of Microsoft definitions, rather than just the small subset included
with the MSRT – and it’s available for all Windows 10 users. If you’re using a third-party AV solution for your real-time protection, then all you have to do is enable Windows Defender’s Limited Periodic Scanning mode, and this will allow you to run Full Scans
with Windows Defender (as well as with your third-party AV app). Limited Periodic Scanning also allows you to run scans with Windows Defender Offline, which runs outside of the Windows environment so that malware can’t hide by manipulating the Windows infrastructure.

Additionally, you should enable Potentially Unwanted Application protection for your Windows Defender scans: Right-click on the Start button and select Windows PowerShell (Admin), and then copy, paste, and enter this command:

Set-MpPreference -PUAProtection 1

Windows Defender not detecting known Adware

A manual Full Scan can potentially find any malware that your AV app can possibly detect (with signatures) – but since real-time protection (on-access) is always automatically scanning the files involved in file system read/write operations; on-access
scanning will generally find any active malware. And consequently, manual (or scheduled) scans will normally only find archived malware, or maybe some leftover malware fragments that were missed by real-time protection. The main reason for running manual scans
is that they take the time to unpack container files and scan the contents, while real-time protection doesn’t scan the contents of archived files. So manual or scheduled scans with the installed AV app really have a very low priority, and generally won’t
find any active malware.

But since no single AV app covers the entire spectrum of online threats, it’s entirely possible that your primary AV app might have missed some active malware – and that should always be your main concern. So the priority should always be on running
some manual scans with third-party malware-removal apps, since these often include definitions that aren’t included in your installed AV app – and these third-party apps will consequently have the potential for detecting active malware that’s running on the
system just because you primary AV app wasn’t able to detect it:

Kaspersky Virus Removal Tool:

Kaspersky Removal Tool 2015

Emsisoft Emergency Kit:

Emsisoft | Emergency Kit: Free Portable Malware Scan and Removal

Malwarebytes Anti-Malware (free version only):

Malwarebytes for Windows

Eset Online Scanner:

Free Virus Scan | Online Virus Scan from ESET

Some other trusted third-party malware-removal tools are listed here:

List of Malware Removal Tools

 

Do I need Norton since I have Windows Defender?

The Microsoft AV apps have been making some real gains in the file detection and
real-world protection test categories, to be sure; but most of these tests only measure the ability of AV products to detect malware, and don’t bother to follow up on the overall effectiveness of the app’s remediation procedures for both detected and
undetected malware (protection). That’s why I tend to use the AV-Comparatives
Malware Protection Test as a benchmark:

https://www.av-comparatives.org/wp-content/uploads/2017/04/avc_mpt_201703_en.pdf



Windows Defender still seems to be lagging in this category; so I generally use a third-party AV app for real-time protection on machines that I use for Internet research and/or shopping. But I also invariably enable Windows Defender’s
Limited Periodic Scanning mode on these PCs, so that Defender can serve as a second line of defense:

Turn On or Off Limited Periodic Scanning in Windows 10



The Limited Periodic Scanning feature doesn’t actually do a very good job of automatically scanning these PCs – but the important thing is that this feature actually activates all of Windows Defender’s
on-demand scanning options – and that allows me to do manual Full Scans or Context Menu Scans (on downloads); and it also makes it possible to schedule my own Defender Quick Scans.
Real-time protection is the only component that’s disabled in the
Limited Periodic Scanning mode of operation; and that component still appears to be better-handled by a good third-party AV app.