Microsoft Defender issue protected and not protected!

scopio · 20 May 2023

My brother has a very strange issue with Microsoft Defender stating that his pc is protected but also that it is not protected!

Microsoft Defender issue protected and not protected!-2023-05-18_15-25-14.jpg

He also gets an email from mydefender@microsoft.com stating that real-time protection is off!

Microsoft Defender issue protected and not protected!-2023-05-18_15-24-32.jpg

This email has links one of which is for a .png of a shield and references Gibraltar for some reason!

Microsoft Defender issue protected and not protected!-2023-05-20_16-38-13.jpg

I suspect that this email has something to do with Microsoft Defender issue. He keeps getting the same email every few days.
I have now blocked the email to see if Microsoft Defender no longer states what looks like a false positive.
He has Malwarebytes Premium and Windows Defender plus Microsoft Defender as his only anti-virus/anti-malware software.
Malwarebytes shows all protection enabled.

Microsoft Defender issue protected and not protected!-2023-05-20_17-43-36.jpg

As does Windows defender.

Microsoft Defender issue protected and not protected!-2023-05-18_15-26-27.jpg

We have uninstalled Microsoft Defender and reinstalled it from the Microsoft Store and seems to rectify the protected/not protected issue for now.
Has anyone experienced the same issue with Microsoft Defender or is it malware/scam as he has also had a phone call from Microsoft saying some thing about his Microsoft license which I did advise him to not answer such calls as they are scammers from India.

WXC · 21 May 2023

Scopio,

From your last screenshot, it appears that Malwarebytes is registered as first-line defense. That would explain why the PC is showing as 'Protected', yet Windows Security 'Real Time Protection' is off.

On my PC, I also run Windows Security and Malwarebytes Premium, but... I run them in reverse order, to how yours is set.

If you wish to get the best of both, I suggest you open Malwarebytes > Settings > Security. In the 'Windows Security Center section, toggle 'OFF' 'Always register Malwarebytes in the Windows Security Center'. By doing so, this will place Windows Security as the primary line of defense, allowing for 'Real Time Protection', and Malwarebytes will still function in real time. Best of both worlds.

Below is where to toggle it off ...

Microsoft Defender issue protected and not protected!-screenshot-304-_li.jpg

@scopio

EDIT ~ Just wanted to bring to your attention, that your pictured Malwarebytes, is not at the latest update. The latest version is 4.5.29.268

Microsoft Defender issue protected and not protected!-screenshot-305-_li.jpg

You should ensure both Malwarebytes and Windows Security are up to date, and run a complete and comprehensive scan with both. Further, just a suggestion, I would ignore the emails and delete them. Advise your brother not to click on any links.

Best of luck

scopio · 21 May 2023

@WXC thanks I will do that.

Try3 · 21 May 2023

And do note that the extra Microsoft Defender you have by virtue of your MS365 subscription is additional to Windows security.
Microsoft Defender - Microsoft365

What we used to know as Windows Defender is now the AV part of Windows Security & can be referred to as Defender. It remains built-in to Windows.

Microsoft Defender is the name of an additional security app & it forms part of Office365.
- It is the only thing that is called an "app" so must be what you referred to having reinstalled.
- Your email & other dialogs also refer to Microsoft Defender.

All the best,
Denis

WXC · 21 May 2023

Scopio,

Check the edit I made to the bottom of my first post.

scopio · 21 May 2023

@WXC thanks for your edit, I have now updated Malwarebytes.

@Try3 thanks for your input, I am aware the Microsoft Defender comes with Office 365 and is what my brother has been having issues with.
As far as the email he received it is very strange that it contains a link "https://cdn-gibraltar-prod azzureedge.net/portal/*******/assets/defenderShield.png" why would this link refer to Gibraltar? Gibraltar websites are frequently visited by my brother! The link is not complete as not to have people clicking on it!

Try3 · 21 May 2023

I have no idea why Gibraltar is mentioned.
Whilst the rest of the email looks plausible, the site
WHOIS Search, Domain Name, Website, and IP Tools - Who.is
reports no data for that address so it remains a mystery.
- I tried to check both the full address and its https://cdn-gibraltar-prod azzureedge.net part but nothing was reported for either of them.
- I have not had nothing reported for an address before so I am at a loss concerning it.
- I also tried going to the partial address & the full address in my browser and even just the azzureedge.net part but they did not exist.

I do not have MS365 and the link I gave you represents my entire knowledge of Microsoft Defender.

All the best,
Denis

scopio · 21 May 2023

@Try3 I did put the whole address on Whois and nothing was reported for that address either.

garlin · 21 May 2023

MS runs a Content Distribution Network (CDN), on its own Azure cloud services besides providing hosting to other companies. Azure is a separate business group within MS, and it handles work for other divisions like Windows, Office and Xbox.

Therefore many Windows and Office sites have "edgenet" or "azure" in their hostnames.

When your company is the size of MS, Google or Facebook -- it basically becomes its own ISP and owns private networks to handle the massive traffic load.

scopio · 21 May 2023

@garlin thanks but it still does not explain the Gibraltar link and in any case it only displays a shield as a .png.