Microsoft really needs to make this easier to turn off too. Right now, I have to use an undisclosed privilege escalation hack-around to force things my way.

Perhaps one ought to have live scanning enabled when updating packages, then disabled when not.

I look forward to seeing other replies.

What we really need is the ability to disable real-time scanning on one set of folders/extensions, while still including them with scheduled system-wide scans.

https://docs.microsoft.com/en-us/powershell/module/defender/...

https://docs.microsoft.com/en-us/powershell/module/defender/...

Or, even just run said folders as a custom scan!

`Start-MpScan -ScanType CustomScan -ScanPath PATH\TO\FOLDER-FILES`

Would you mind naming it? AFAIK most third party anti-malware solutions act like rootkits, possibly introducing new attack vectors, or have become basically ad-ware and malware themselves trying yo bait you in various subscriptions.

All AV somehow have to hook into low level system calls so can’t really avoid the kernel driver. Nonetheless, nod32 has been an install and forget AV with no interruption nor bait/nag screen at all. It’s a no bullshit AV and it does well.

I supposedly get the same protection as Defender (according to various AV tests review) and most importantly I get the IO performance back.

While I don’t doubt this true for Windows, on macOS Apple is phasing out kernel modules with APIs that allow software to hook into those low level calls without actually running in the kernel. For AV vendors there’s the Endpoint Security System Extension: https://developer.apple.com/documentation/endpointsecurity

All the AV/endpoint security solutions I’ve seen have switched to this.

It overall seems like a more complex solution that has more chances of being wrong. I would bet the core reason Apple did it was control to lock down their own control of your OS, not any security reason. Perhaps it also simplifies their development somewhat, if they can rid of some stability guarantees for some in-kernel APIs that AV would have needed.

I don't know much about the Endpoint Security extension, but for Apple's network filtering extension they actually DO address this!

The code that runs on every network call is heavily sandboxed and can't communicate at all with the outside. Its only action is emitting some basic signal like "block" or "accept". This means that while the system extension can evaluate all your network communication, and block what it chooses, it can't exfiltrate the specific content. I might have the details wrong, but that's the general intention.

But the security benefits aside, I think the real reason for preventing code from running in the kernel is about stability and not security. Buggy code won't crash the system anymore. They can also enforce stricter performance requirements.

(And at the moment, you can still run kernel extensions on your own system if you really want by disabling SIP and other things, it's just infeasible for any AV vendor to have their customers step through that very onerous process.)

McAfee is by far the worst offender IMO when it comes to file IO. We eventually dropped it in part to it's insistence on locking files in App Data which is a common scratch space for almost every Windows App.

These facts together mean that it should be really rare that any application needs to be waiting for any scanning - since scanning can happen anytime between a data write and a read of the same data.

Something like ZFS where hashing is baked into the cost of the FS operation could optimise this.

I know this because I did a bunch of reading on the topic after encountering catastrophic halts inside of CloseHandle, deep inside the kernel. And even with administrator privileges I could not kill the process, or the attached debugger, and the machine was unable to shutdown because even it could not kill the stuck process. I had to hard power cycle to get back to a usable system. Near as I can tell this was because of the AV product the company was using that crashed or deadlocked or something.

Note this product was not Windows Defender.

https://www.bleepingcomputer.com/news/microsoft/malicious-np...