Two antivirus programs on one PC will eventually point their guns at each other

Raymond Chen has been at Microsoft for three decades and spends most of his writing explaining why Windows behaves the way it does. On 8 October he took on a question that resurfaces every time somebody gets nervous about their PC: if one antivirus is good, are two better?

His answer came with a real support case. Two anti-malware products were installed on the same machine. Call them Contoso and Fabrikam, as Chen does. Fabrikam called a system function that Contoso had quietly rerouted through its own code. Contoso looked at that call, decided it was suspicious, and tried to quarantine the Fabrikam process. Fabrikam, meanwhile, had rerouted a function Contoso depended on. The machine tied itself in knots and no setting in either product could untangle it. Chen's comparison: hiring two security companies to patrol your building without telling either one about the other. Both are armed, neither recognises the other, and you end up with your own guards aiming at each other.

The part worth holding onto is why it happens. Security software watches your PC by intercepting system calls, a technique Windows has never officially supported. It works when one product does it. Two is a coin toss, and the symptoms are hangs, programs that refuse to start and a machine running like treacle, none of which look like a security problem. People spend weeks blaming the hardware.

Windows 11 already has Defender, which steps aside on its own when you install a genuine third-party scanner. The mess is usually leftovers: a trial that shipped with the laptop, a security add-on that arrived with something else, a product installed in a panic years ago and never removed. Tendvane's safety check lists what is actually sitting on the machine and flags the leftovers worth clearing out, which is often the whole fix.