microman said:
Stu,
Thanks for your input. I'm running the Free version of ZA, the 6.1 version.
I've been using it for what seems like years and have never really had a
problem with it till now, with this Windows Defender process. There are
probably some differences in the way that ZA Pro treats and presents
server/access in Program Control.
Note that ZA Free lists two Defender processes in Program Control - WD
Command Line Utility and WD USer Interface. The Interface seems to work fine,
it's the CL Utility (MpCmdRun.exe) that's giving the problem.
Why, in any event, should a process that, by its very name and which would
normally be user-driven at a command-line prompt, be always trying to connect
to a website or other URL?
According to what I see in Alerts & Logs in ZA, MpCmdRun definitely makes
attempts to connect with websites, mostly non-Microsoft websites. As far as I
can tell, they're genuine websites - like, I see that a few minutes ago it
tried to connect with the website of my electricity supplier, which a moment
before I'd visited.
One thing I'm going to try is to put all the settings for WD CL Utility in
Program Control to question-mark status. At present, I set them all initially
to blocked (crosses). Then, when a pop-up occurs, respond by Denying access
and asking it to remember that setting. Maybe ZA Free doesn't register the
settings unless you go through the Deny/Allow pop-up process. I've already
dealt with it just now, asking for Internet Access.
Perhaps my denying WD CL Utility any access to the Internet is wrong.
Perhaps it is quite necessary for WD to occasionally connect with Microsoft
behind the scenes but, given that it's instead trying to connect with many of
the websites I visit, I think it's best that I block all such access.
Bill, Stu and others,
I think I've finally found a solution to this problem, though I still can't
vouch for Windows Defender attempting to make those connections.
My little test, mentioned above, seems to have done the trick. It seems that
you can't simply rely on just plonking crosses (blocks to the outward
connections) in the Program Control table of ZA, you have to do it by
inserting question-marks in all four categories in the table and then waiting
for a Windows Defender pop-up to occur. If you then Deny the connection, the
cross will then get automatically put into the table (something I already
appreciated) but, more importantly, ZA does not then flag the attempted
outward connection and put it into its Alerts & Logs list. With most
programs, you can just insert crosses manually into the table but it seems
that, with a few, that's not good enough. The connections will still be
blocked but ZA will continually flag them and insert them into Alerts & Logs.
Anyway, I use the question-mark method and, sure enough, WD CL Utility very
soon attempted to make an Internet connection. In the pop-up, I denied it and
asked it to remember that. Since then, I've cleared the list in Alerts & Logs
and no further alerts have appeared there. Well, so far, anyway!
This doesn't mean that WD CL Utility is no longer making those attempts,
though; it just means that ZA is not flagging them up. In Program Control,
Trusted Access is still left question-marked, as is Trusted Server, and so
I'll also deal with those in a similar manner if WD CL Utility also causes a
pop-up alert for those.
It's still a complete mystery, though, as to why WD CL Utility (MpCmdRun)
should be making those outward attempted connections at all ...... whoops,
there's the pop-up for WD CL Utility again, this time asking for permission
to access my Trusted Zone.
As far as I'm aware, WD (as an overall program) should not be constantly
trying to connect with any Microsoft sites and especially not other sites.
I've got automatic scheduling of scanning disabled and I do all WD scanning
manually. I also check for updated definitions manually (that uses the WD
User Interface, with which there's no problem).
So, Bill, I'm inclined to think there's a quite serious bug in WD, in the CL
part of it, that causes constant and unwarranted outward connections.
As an aside, in WD, there's no explanation whatever of WD CL Utility - what
it is exactly, what it does, and how to use it. As I say, I've always assumed
that it's a non-GUI function, something that the user would instigate via a
command prompt.
