Latest news with #Defendnot
Fox News
29-05-2025
- Business
- Fox News
Windows PCs at risk as new tool disarms built-in security
All modern Windows PCs come with Microsoft Defender built in. For the unaware, this tool is Windows' native antivirus. Over time, it has matured into a reliable security tool capable of blocking a wide range of threats. However, a tool called Defendnot can shut down Microsoft Defender completely, without exploiting a bug or using malware. It simply convinces Windows that another antivirus is already running. The implications are serious. This tool does not break into the system or use advanced code injection. It uses Windows features the way they were designed to be used. And that makes the problem harder to detect and harder to fix. Windows is built to avoid running multiple antivirus products at once. When a third-party antivirus registers itself, Windows disables Microsoft Defender to prevent conflicts. Defendnot exploits this system using an undocumented API that security software uses to communicate with the Windows Security Center. The tool registers a fake antivirus that appears legitimate to the system. It uses a dummy DLL and injects it into Task Manager, a trusted Windows process. By operating inside this signed process, Defendnot avoids signature checks and permission blocks. Once the fake antivirus is registered, Windows disables Microsoft Defender without warning or confirmation. No security alert is shown to the user. No visible changes are made to indicate that the system is unprotected. Unless someone checks manually, the machine remains open to attacks with no real-time protection running. The tool also includes options to set a custom antivirus name, enable logging and configure automatic startup. It achieves persistence by creating a scheduled task that runs whenever the user logs in. Defendnot is based on an earlier project called No-Defender. That project used code from an actual antivirus product to fake registration. It gained attention quickly and was removed after a copyright complaint from the vendor whose code had been reused. The developer took the project down and walked away from it. With Defendnot, the creator rebuilt the core features using original code. This version avoids copyright issues and uses a new method to achieve the same effect. It does not rely on another antivirus or third-party binaries. It was written from scratch to demonstrate how simple it is to manipulate Windows security from inside the system. Microsoft Defender currently flags the tool as a threat. It detects and quarantines it under the name Win32/ However, the fact that it works at all points to a weakness in how Windows handles antivirus registration and trust. While Defendnot is a research project, there's a chance that similar tools are already out there and could be used to compromise your PC. Here are a few tips to help you stay safe: 1. Use strong antivirus software: Even with regular updates, Windows systems can be left exposed by tools like Defendnot that silently disable built-in defenses. A strong third-party antivirus with real-time protection and frequent updates provides essential backup security. Look for solutions with real-time protection and frequent updates to tackle emerging threats. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices. 2. Limit exposure: Many exploits rely on user interaction, such as clicking a shady link, downloading a compromised file or mounting an untrusted virtual disk. Stick to reputable websites, avoid opening unsolicited email attachments and use a browser with built-in security features (like Microsoft Edge or Chrome with Safe Browsing enabled). 3. Avoid running unexpected commands: Never paste or run commands (like PowerShell scripts) you don't understand or that were copied from random websites. Attackers often trick users into unknowingly running malware this way. 4. Keep your software updated: Regularly update your operating system, browsers and all software applications. Updates often include patches for security vulnerabilities that malware can exploit. 5. Use two-factor authentication (2FA): Enable 2FA on all your accounts. This adds an extra layer of security by requiring a second form of verification, making it harder for attackers to gain access even if they have your password. 6. Invest in personal data removal services: Even with strong device security, your personal information may still be exposed online through data brokers and people-finder sites. These services collect and publish details like your name, address and phone number, making you an easier target for identity theft or phishing. Automated data removal services track down these sites and submit removal requests on your behalf, helping to reduce your digital footprint and increase your online anonymity. While they can't erase every trace of your information, they make it significantly harder for attackers to find and exploit your personal data, which saves you time and reduces unwanted spam in the process. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here. Get a free scan to find out if your personal information is already out on the web. Defendnot points to a bigger issue with how Windows handles security. It takes a feature meant to prevent software conflicts and turns it into a way to completely disable protection. The system assumes any registered antivirus is legitimate, so if attackers can fake that, they get in without much resistance. We often think of security as blocking the bad and trusting the good. But this case shows what happens when that trust is misplaced. Defendnot doesn't sneak past Windows defenses. It walks right in using valid credentials. The solution isn't just more patches or stronger malware signatures. What we need is a smarter way for systems to tell what is actually safe. Do you think companies like Microsoft need to rethink how Windows handles antivirus registration and trust, given that tools like Defendnot can so easily disable built-in protections without using malware or exploiting a bug? Let us know by writing us at For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Follow Kurt on his social channels: Answers to the most-asked CyberGuy questions: New from Kurt: Copyright 2025 All rights reserved.
Tom's Guide
19-05-2025
- Tom's Guide
This new Defendnot trojan can get Windows to disable its own antivirus software
A researcher referred to as es3n1n has developed a tool called Defendnot that is capable of tricking a Windows computer into disabling Microsoft Defender, leaving the device completely unprotected against malware. By registering a fake antivirus product, Defendnot convinces Microsoft to turn off its built-in antivirus software to keep any conflicts from happening between the two security programs. As reported by Bleeping Computer, Defendnot can do this even when there is no actual antivirus software installed on the machine by using an undocumented API in the Windows Security Center (WSC) – the same one used by legitimate antivirus software – to inform Windows that it's properly installed and handling the real-time protection for the system. Then, after a few weeks after the release, the project blew up quite a bit and gained ~1.5k stars, after that the developers of the antivirus I was using filed a DMCA takedown request and I didn't really want to do anything with that so just erased everything and called it a day. Once the registration step is complete, Defender will immediately shut itself off to prevent any issues, leaving the computer without active antivirus protection. The Defendnot tool also includes a loader that passes configuration data through a file, allowing users to set the name of the fake antivirus software to anything they like. Defendnot will create an autorun through the Task Schedule, so it starts when you log in to Windows. It's based on a previous project, the researcher called 'no-defender,' which laid the groundwork by using code from third-party antivirus software to spoof Windows Security Center registration. However, the vendor of that software filed a DMCA takedown request, which resulted in it being pulled from GitHub. Defendnot, on the other hand, learned from this and built the anti-virus functionality from scratch through a dummy DLL, which causes no copyright infringement. It injects a DLL into a Microsoft system process, which is signed and already trusted. Within this process, it can register the dummy antivirus with any spoofed display name. Though it is a research project, Defendnot demonstrates how easy it can be to turn trusted system features into security issues; currently, Microsoft Defender is detecting and quarantining Defendnot as a trojan based on its own machine learning algorithm. Get instant access to breaking news, the hottest reviews, great deals and helpful tips. Because Defendnot is a research project — and has already been quarantined by Defender — it is not putting any particular systems at risk currently. There are also no details about how Defendnot may operate on a computer that is running a third-party antivirus software in addition to Windows Defender. That being said, users who want the best level of protection for their Windows PCs should always use one of the best antivirus software programs and the built-in protection provided by Windows Defender. These security suites usually provide excellent malware protection and added features like parental controls, a VPN, and a password manager that can help keep you safe while online.
Forbes
12-05-2025
- Forbes
Warning — Microsoft Windows Defender Can Be Disabled By Hackers
Defendnot tool disables Windows Defender. There have been some concerning news headlines for Microsoft users over the last few weeks. From the confirmation of a 10/10 cloud security vulnerability, to Windows denial of service attack methods that have yet to be fixed, and the inevitable password-stealing warnings impacting Windows users. Today, however, might be the most alarming news of all: hackers can now disable Windows Defender using a newly released security tool. Here's everything you need to know about Defendnot. There are a number of antivirus, anti-malware, and internet security solutions available in today's crowded marketplace. Most will charge you a hefty annual subscription fee, but some of the best ones are free. One of the latter, and widely regarded as one of the best, is Windows Defender, which comes as a default offering with the Windows operating system. Whereas Windows Defender used to be seen as 'better than nothing at all' in the eyes of those who test such solutions, it has quickly risen in the ranks to become a security bulwark that competes with the best of them in protecting users from threats. That assessment might need to change following the release of a new tool that can directly disable Windows Defender and its associated protections on Windows. While not the first method to successfully bypass Windows Defender, Defendnot is undoubtedly the most straightforward: it works by getting Windows Defender to disable itself. A security researcher and reverse engineer known as 'es3n1n' has confirmed that Defendnot, an update to an earlier project called No-Defender, could disable Windows Defender by convincing the operating system that an alternative antivirus solution was already installed. Defendnot came about when some friends asked if it was possible to create a No-Defender tool that used a clean implementation without relying on any antivirus software at all. Or, rather, no third-party antivirus code to insert itself in the process. 'The part of the system that manages all this mess is called Windows Security Center - WSC for short,' es3n1n said. By using undocumented application programming interfaces that are only shared with certified antivirus vendors, and under a strict non-disclosure agreement, es3n1n has managed to convince Windows Defender that such an alternative solution is already installed without any third-party AV code being required. Defendnot has now been published, which means it could soon be in the hacker armory of anyone who looks for it. I have reached out to Microsoft for a statement about this concerning Windows Defender bypass development.
