Allowed items do not show up

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Running Windows Defender v 1.1.1347.0

I ran XoftspySE spyware detector on my system and it showed a list of
dangerous or potentially dangerous spyware on my computer.

These items show up in WD history as "allowed", but do not show up in the
LIST of allowed" items so I can edit their setting. The list has NO items
listed. Also, there are no items listed in my "Quarantined" list.

Something is wrong, but I have no idea how to get this fixed. Any one know
anything about this problem?
 
You basically have two categories of WD spyware detection - scans and real
time protectiion. Potential malware detected by a scan will show up in
allowed items when you always allow the item. Items detected by real time
protection will not go in allowed items even if you specify permit. The
reason you are seeing in History the real time protection items as allowed
(without having the opportunity to act upon the detection) is because of the
default options of WD. You can easily change this behavior. Click
Tools->Options and scroll down to real time protection options. Under real
time protection options goto choose if Windows Defender should notify you
about. You will see two boxes. Check the boxes (cliick Save) and you will
now be notified by the real time protection agents.
 
Hi Magsowner,

XoftSpy Hhhuummm?

This could well be a false positive.

One way to get further information is to find the exe file on your system,
and submit the file at one or more of the following sites:

http://www.virustotal.com

http://virusscan.jotti.org

Each has a browse window in the upper right to do the submission, and will
check out your file with 10 or so antivirus vendors with one submission.

A clean reading at these sites is not proof that a file is safe, but I'd say
in this case that it is likely to be a good indicator that, in fact, the
file is safe, and you are seeing a false positive.

Submit it via the process noted in Windows Defender Help, or here:
Report a possible spyware problem to Microsoft
http://www.microsoft.com/athome/security/spyware/software/support/reportspyware.mspx


Windows Live Safety Center scan,
http://safety.live.com/site/en-US/default.htm
Ewido
http://www.ewido.net/en
Kaspersky
http://www.kaspersky.com/virusscanner

For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
 
Mr Cat said:
You basically have two categories of WD spyware detection - scans and real
time protectiion. Potential malware detected by a scan will show up in
allowed items when you always allow the item. Items detected by real time
protection will not go in allowed items even if you specify permit. The
reason you are seeing in History the real time protection items as allowed
(without having the opportunity to act upon the detection) is because of the
default options of WD. You can easily change this behavior. Click
Tools->Options and scroll down to real time protection options. Under real
time protection options goto choose if Windows Defender should notify you
about. You will see two boxes. Check the boxes (cliick Save) and you will
now be notified by the real time protection agents.
Click to expand...
 
Those two items were already checked. I am rather new to all this security
stuff so please be patient with me. If I am understanding this correctly
(and that's a big IF), these items I am seeing in my history may have been
items that were detected during real time, and I may have been notified at
the time, and I may have said it was ok to allow them, without realizing that
they could be harmful. Once you do that, is there any way to stop allowing
them??
 
I think you do have a feel for what's happening. Mr Engel's posts may be
very relevant because later versions of Windows Defender use the terminology
Permit and Deny instead of Allow or Block for real time protection. However,
I can still make sense of what is going on. If you allowed something after
doing a scan (either manual or automatic scan), then it would show up in
allowed items. Since you say nothing is in allowed items, then the item must
have been detected by real time protection and you replied allow. This would
be consistent with what shows up in History. There is nothing to undo
because real time protection alerts that are allowed or permitted will keep
showing up. In the case of a scan, items that are always allowed will show
up in allowed items and you can undo this by removing the entries from the
allowed items list. You should check your Windows Defender Version (About
Windows Defender under the drop down arrow for Help ?). It should be Version
1.1.1593.0 If not, please follow Engel's first post. Engel's second post
addresses the issue that Xoftspy has a reputation for false positives. I
have observed this behavior, but I still use the free version of Xoftspy with
caution.
 
Back
Top