The Windows antivirus can be silently disabled, leaving the computer with protection that is only apparent—a direct risk for companies that rely exclusively on the free protection provided by Windows.
A security researcher has released a new proof-of-concept program called BigDiskBuster. As long as it runs in the background, it prevents Microsoft Defender from updating its definitions and protection engine, locking it at the current version. The author says it works on all supported versions of Windows.
This is not an isolated case. The same researcher has released a whole series of such tools: some block updates, others disable or completely bypass Defender, and a few even grant full privileges on the system. Microsoft has fixed some of them, but not all—for a few, there is still no official fix, the exploit code is public, and older variants from the same series have already been used in real attacks.
The challenge for a small business is simple. Many businesses rely exclusively on the free antivirus program that comes with Windows and never check it again. These tools need to be running on the computer to cause harm, so the problem arises when a malicious program has already made its way onto a workstation. At that point, it can silently freeze or disable Defender: the computer appears to be protected, but it no longer receives updates and can no longer detect new threats.
That’s why antivirus software can’t be treated as a “set it and forget it” solution. Just because an antivirus program is running doesn’t automatically mean it’s protecting your system, and the difference between the two is only apparent if someone actually checks.
What you need to do:
- Check periodically to make sure your antivirus software is active and that the definitions are up to date (in Windows: Security → Virus & Threat Protection → Last updated).
- Keep Windows fully up to date, as Microsoft has already patched several of these vulnerabilities.
- If the protection turns itself off or stops updating, treat the situation as a possible sign of infection, not as a simple system error.
- In a company without its own IT department, designate someone to monitor the security status on the computers—the assumption that “it runs on its own” is exactly the gap that a maintenance and monitoring service fills.
A quick check of your antivirus status will tell you right away whether the protection you're relying on is real or just an illusion.
This article was generated with AI assistance.