Windows 10: Windows Defender wants to run at startup

Since a very recent reinstall of Windows 10, Windows Defender now keeps wanting to be part of Start-up..In the past it seems to me that it was only activated if your anti-virus protection was off or if none was installed. Now it seems as if the intention of Windows Defender has changed to be actively running when windows starts.

Can I allow it to run along with my antivirus & anti-malware programs?

:)

 

Does Windows Defender autorun on startup in Windows 10...

The core of Windows Defender is its Antimalware Service Executable, aka the Antimalware Engine (MsMpEng.exe), and this file runs automatically at startup – but the Windows Defender user interface (MSASCui.exe)
doesn’t run automatically. So in order to get the icon at startup, you have to run the user interface at startup. Windows includes a
Startup folder just so users can run programs automatically at startup (without editing the registry), so you can get your Defender icon by just dropping a shortcut for
MSASCui.exe into the
Startup folder:

Is Windows Defender Icon Supposed to be in System Tray?

The Startup shortcut method also gives you the option for an automatic update and/or Quick Scan along with your icon.
You just enter the run line for the desired option as the location (target)
of the shortcut:

"C:\Program Files\Windows Defender\MSASCui.exe" -hide

"C:\Program Files\Windows Defender\MSASCui.exe" -Update -hide

"C:\Program Files\Windows Defender\MSASCui.exe" -QuickScan -hide

"C:\Program Files\Windows Defender\MSASCui.exe" -UpdateandQuickScan -hide

We can use these predefined startup lines to make the icon/task setup a piece of cake:

1.) Select and copy the line for the option you want.

2.) Right-click on the desktop and select
New > Shortcut and then paste the run line as the location (target), and name the shortcut.

3.) Open File Explorer:
Start Menu > File Explorer; and type (or copy and paste)
shell:startup (user Startup folder) or
shell:common startup (common Startup folder) into the
Quick access box to open the Startup folder.

4.) Then drag and drop the shortcut into the Startup folder. All done!

In case anyone was wondering how Brink’s reg file works, it actually just starts the Windows Defender user interface by adding exactly the same startup line to the Run key for the current user. Here’s the entire contents of the file:

Windows Registry Editor Version 5.00

; Created by: Shawn Brink

; Windows 10 Help Forums

; Tutorial: Hide or Show Windows Defender Notification Area Icon in Windows 10

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"

 

Defender wants to run a scan too often.

Almost every time I turn on my computer, Defender needs to run a scan, even if has only been a couple of hours, this is very annoying, what can I do to rectify this?

 

You can have only one Anti-Virus program running on your computer or they will conflict. When you install a 3rd party AV product, Windows Defender automatically disables. You can run Malware programs like Malwarebytes along with Windows Defender.
What is your 3rd party AV Software?

 

-- I know that Windows Defender always used to disable when you have a 3rd. party AV product. But after my recent reinstall of Windows 10, it has put itself into the list of startup programs. I removed it several times and it keeps coming back.

-- I have Kaspersky Total Security 2017 and also running real-time, Reason Core Security (Free).

 

Upon further investigation, I notice that what's in the startup is the Windows Defender Notification Icon (MSASCuil.exe).

What I'm still not clear on is what's stated within the highlighted bit on the top image below.

The bottom image shows the Windows Defender Notification Icon (MSASCuil.exe) within the Startup.

 

It is safe to let Defender run as an on-demand file scanner (or periodically scheduled) even with another AV providing real-time protection. Scanning files won't load Defender's memory-resident AV protection, so there should be no conflict.

MSASCuiL is the user interface and puts the icon in the notification area. This has been a startup item since 1607 was released. On its own, MSASCuiL does not load the memory-resident AV either.

Are you sure you actually had 1607 before your recent repair-install? If you had in fact upgraded from 1511 to 1607 then this would be the first time you would have seen this behaviour.

Defender's memory-resident AV services (if running) are shown in Task Manager on the Services tab as WinDefend and on the Details tab as MsMpEng.exe. With your other AV running this should be shown as 'Disabled' in Services. If not, try reinstalling your other AV.

You can make the icon disappear from the notification area by killing MSASCuiL in Task Manager. You cannot remove it from start up (well, you can, but Defender puts it back again at reboot). If you want to make the icon go away...

Cannot remove Windows Defender Tray Icon

The icon will reappear (and stay there until you kill it) if you ever open Defender (because doing so runs MSASCuiL).

 

I didn't read all of the threads but you can just disable the Defender notifications in the startup tab. That will try to start even if you have a 3rd party AV running in the active mode. Also, I am sure you are aware that you can have some of the AVs running in a passive mode along side of Defender. Avast is one that offers that option but I chose not to use it and now Avast is the exclusive protector of my PC.

 

Thanks for the info Bree. In the Services tab within Task Manager, WinDefend is shown as stopped (see top image). In the Details tab there is no indication of MsMpEng.exe (see bottom image).

 

Then Defender is set up as it should be when another AV is installed. The optional 'limited periodic scan' is a safe 'second opinion' - up to you whether you leave it turned on.

 

That will only work while Defender's real-time protection is turned off (as it is when you have another AV). The first thing MsMpEng.exe does when run is to check all it's registry keys and reset them if they've been modified - including that startup one.