- A security researcher built a program that us see as an antivirus
- Since two AV programs are unable to run at the same time, Windows is turning off
- Previous iteration was removed for copyright infringement
Hackers can now easily turn off your Windows Defender program by detecting a fake antivirus on your computer. To do so, they use a new tool called DefentNot, recently released by a security researcher with the alias ES3N1N.
As they explained, DefentNot exploits a previously undocumented Windows Security Center (WSC) API that third -party antivirus programs use to tell the operating system whether they run on the device or not.
Usually, two or more antivirus programs cannot run on a single device at the same time due to different conflicts. As a result, Windows Defender automatically disables when it is told that another antivirus has been installed.
Stained by defender
According to Bleeping computerThis is the researcher’s second attempt to build this type of solution. The original program that “blasted” and was viral shortly after its release was taken down following a request for digital millennium copyright. It turns out that ES3N1N used code from a third-party antivirus product to forged registration with WSC for a program they named no-defender.
This apparently did not sit well with the developers of the third -party solution, which subsequently demanded that ES3N1N take the program down.
After the dismantling, the researcher built defendnot with a dummy antivirus dll from the bottom. It also comes with an Authorun function so it can start automatically as soon as the user logs in in Windows.
Obviously, the tool was not designed to be used in a malicious way, but it is safe to assume it will be abused (or threat players could simply create their own versions). Previously, threat actors were seen in implementing various tactics to turn off people’s antivirus programs, such as misuse of administrator privileges, registry manipulation, blocking updates, installation of fake antivirus software or utilization of various deficiencies in third-party solutions.
Fortunately, Microsoft Defender can now detect and quarantine defender as a ‘win32/sabsik.fl.! Ml;.
Via Bleeping computer
