Microsoft Engineer Analyzes Windows 11 Conflicts Between Two Antivirus Programs

Raymond Chen, a senior engineer at Microsoft, has detailed potential compatibility issues arising from the simultaneous installation of two antivirus programs on Windows 11 and other systems.

In a blog post, Chen described a scenario using hypothetical software names Contoso and Fabrikam. Fabrikam attempted to use a function that Contoso had already intercepted. Contoso then flagged Fabrikam's action as suspicious and tried to isolate its process. Concurrently, Fabrikam intercepted a function Contoso was using, leading Contoso to call the very process it was trying to isolate.

Chen likened this to two security firms patrolling the same building without knowledge of each other, potentially mistaking each other for intruders if they both employ forceful measures. He noted that anti-malware software often uses unofficial methods, such as intercepting system functions. When a program calls an intercepted function, control might pass to the security software, which then decides on the next action. This deviation from the original intent can trigger other problems.

These conflicts can result in applications freezing and system instability. Chen pointed out that debugging such issues is typically difficult, as the root cause is often interference between anti-malware programs. Even when a conflict is identified, delineating the operational boundaries between the software can be challenging.