DisableAntiSpyware vs DisableAntiVirus Values??

MisterX · 21 Oct 2016

Does anyone know what the difference is between the DisableAntiSpyware vs DisableAntiVirus values for Windows 10 Defender? I know that in the past you only needed to set the "DisableAntiSpyware = 1" value in order to disable Windows Defender. But now I'm seeing this "DisableAntiVirus" value as well but I can't seem to figure out what the difference is between the two. I've tried using each value one at a time but they both seem to disable Win10 Defender but knowing all the bullshit M$ has been up to these days, I'm sure there is a reason why there are two separate values. So just looking for a little clarification.

Just to be clear, these value are located in [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

Thanks in advance!

Neemobeer · 21 Oct 2016

While spyware and virus are both malware the line between them have been somewhat blurred. Spyware is more concerned with staying hidden and Viruses are more interested in propagating between systems, so I would image that one switch disables some detection logic and the other the same but for Viruses. If you want to disable WD you can simply go into services.ms and disable the service. If however you have no other malware protection I'd suggest leaving WD enabled.

TairikuOkami · 21 Oct 2016

Previously AV and AS engines were separate as you can see here: Policy settings and registry keys.

Over the time, we started to call all nasties malware, that is why when you install AV, you also have Antispyware protection enabled, it is not separate. In a few years, all products will be properly named antimalware.

DisableAntiSpyware is used by default, when you disable WD through its interface, DisableAntiVirus is being kept for legacy purposes. Windows security center is slowly shifting the name of spyware protection to PUP only.

MisterX · 21 Oct 2016

TairikuOkami said:

Previously AV and AS engines were separate as you can see here: Policy settings and registry keys.

Over the time, we started to call all nasties malware, that is why when you install AV, you also have Antispyware protection enabled, it is not separate. In a few years, all products will be properly named antimalware.

DisableAntiSpyware is used by default, when you disable WD through its interface, DisableAntiVirus is being kept for legacy purposes. Windows security center is slowly shifting the name of spyware protection to PUP only.

Interesting, Thanks for that link and reply.

Upon further testing, I can't find that the DisableAntiVirus key does anything at all! DisableAntiSpyware=1 definitely disables WD, but as far as the DisableAntiVirus key goes, I cannot figure out what it's purpose is for. I know you said something about it being used for "legacy purposes" but I can't ever recall a time when DisableAntiVirus was used in the past. Do you have any specific situations when that key is used?