Raymond Chen, a Microsoft engineer, reported an incident where two antivirus programs conflicted within the Windows operating system. Under these conditions, one of the software could interpret the functions of the other as suspicious, generating a state of 'chaos' in Windows.
The standard guidance is to keep only one security program active at a time. Chen, known for sharing internal stories from Microsoft, emphasizes that while using an antivirus is beneficial, relying on two is not necessarily better. He mentioned that Microsoft Defender tends to automatically disable itself upon detecting the installation of another antivirus.
Although the common practice is to remove the previous solution before installing a new one, Chen described a specific case involving a company client. A colleague from his corporate support team investigated a complex failure on the client's computer and discovered that the problem was caused by the simultaneous execution of two anti-malware software from different vendors.
To preserve trade names, Chen nicknamed the two programs Fabrikam and Contoso. According to the engineer, Fabrikam activated a function that had been intercepted by Contoso. The latter classified this behavior as suspicious and attempted to quarantine the Fabrikam process.
This cycle of mutual interference caused instability in Windows. The situation worsened because Fabrikam had also intercepted a function used by Contoso itself; when trying to isolate Fabrikam, Contoso ended up invoking the function modified by the software it intended to isolate, resulting in chaos.
Theoretically, the creating companies of these security solutions would need to collaborate to develop a mutual recognition mechanism or rely on Microsoft to guide this development. However, no security company wants its solution to be complemented by a competitor, allowing tolerance only if the software has different purposes.
Chen also pointed out inherent technical challenges, given that security solutions often execute actions not officially supported by Windows, such as certain forms of system function interception. For this reason, an antivirus may flag any activity as suspicious, even if it comes from another security software, because it does not know the nature of the other program.
Chen summarized the situation by comparing the installation of two anti-malware programs on the same system to hiring two different security firms to monitor a building. If these firms are unaware of each other's existence, both will assume the other is an intruder. He added that, at best, their instructions will be limited to reporting suspicious activities.
Therefore, the final recommendation is clear: keeping two antiviruses on the same computer is not advisable. If one software is not meeting the needs, it is preferable to replace it rather than supplement it with a competing alternative. A notable exception is Microsoft Defender, which usually disables itself automatically upon identifying the presence of another company's antivirus on Windows.
