BUG - Windows Defender writes itself in registry every time?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Windows Defender says every time I start windows that a Windows Defender
component has written itself in the windows registry? Why WD writes every
time? is it a bug?
 
Is there a system event log entry for these messages? I'd like to see what
that says is happening--this isn't something I've seen.
 
I suspect that the individual is referring to a message that appears on
startup and is launched from the systray area that contains the text:

"application registration change"

I note that for example on a system reboot:

03/19/2006 06:29 AM - Again today on reboot I get a warning or notice that
MpCmdRun.exe [this for File Version; 1.1.1051.0] had an "application
registration change" - this is seen in the systray area. Message lasts for a
brief period of time and the Windows Defender Icon is also present at that
time.

Curiously, should an individual plug that text into a Windows Defender
search for "application registration change" - they will not get an
explantion what the system is actually doing or why.

Closest match is to the "Application Registration" monitoring the program
does but doubt that a program monitoring itself event is going on here.

Rather - I suspect that the event has to do with Signature Files and the
check for new signature files as per commentary at:

http://www.microsoft.com/athome/sec...D5649468C647&lang=en&cr=US&sloc=en-US&m=1&p=1

However, we again find that the message that is actually displayed does not
contain any reference to signature files and as noted above there is no
information contained in the "Help" or "Search" features for the program
which readily explains a "displayed event".

Again, appears to be part of their dilemma as to when or where to "tell them
nothing" or "tell them everything" and the enormous middle ground where this
falls - i.e. an event is being confirmed - but user cannot readily identify
what the process that is being confirmed via their display actually does or
is for.....

All displayed warnings and confirmation messages for a software program
should contain keywords or event ID that can readily be searched to locate an
explanation of the process.

As such -- If you know what you are doing you should be able to explain it -
if you can't explain it - maybe you are not sure what you are actually
doing!!!
 
I'm seeing that balloon message myself, for the past few days, and can't
explain it--so its clear I don't know what I (or maybe it) is/am doing.

--

mpdooley said:
I suspect that the individual is referring to a message that appears on
startup and is launched from the systray area that contains the text:

"application registration change"

I note that for example on a system reboot:

03/19/2006 06:29 AM - Again today on reboot I get a warning or notice that
MpCmdRun.exe [this for File Version; 1.1.1051.0] had an "application
registration change" - this is seen in the systray area. Message lasts
for a
brief period of time and the Windows Defender Icon is also present at that
time.

Curiously, should an individual plug that text into a Windows Defender
search for "application registration change" - they will not get an
explantion what the system is actually doing or why.

Closest match is to the "Application Registration" monitoring the program
does but doubt that a program monitoring itself event is going on here.

Rather - I suspect that the event has to do with Signature Files and the
check for new signature files as per commentary at:

http://www.microsoft.com/athome/sec...D5649468C647&lang=en&cr=US&sloc=en-US&m=1&p=1

However, we again find that the message that is actually displayed does
not
contain any reference to signature files and as noted above there is no
information contained in the "Help" or "Search" features for the program
which readily explains a "displayed event".

Again, appears to be part of their dilemma as to when or where to "tell
them
nothing" or "tell them everything" and the enormous middle ground where
this
falls - i.e. an event is being confirmed - but user cannot readily
identify
what the process that is being confirmed via their display actually does
or
is for.....

All displayed warnings and confirmation messages for a software program
should contain keywords or event ID that can readily be searched to locate
an
explanation of the process.

As such -- If you know what you are doing you should be able to explain
it -
if you can't explain it - maybe you are not sure what you are actually
doing!!!



Bill Sanderson said:
Is there a system event log entry for these messages? I'd like to see
what
that says is happening--this isn't something I've seen.
Click to expand...
Click to expand...
 
Back
Top