Defender switches off

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Sorry folks, I'm probably very dim!

Afraid that defender keeps switching itself off for no apparant reason. Is
it likely to be clashing with something else? Does anybody know of any issues?

Thanks
 
Hello Daft Bat,

Can you say more about what you saw that led you to say that it "that
defender keeps switching itself off ...?"



What do you see in the system event logs around the time of defender keeps
switching itself off.

I believe this stuff is logged in the system event log--scan starts and
ends, definition updates, etc


Еиçεl
--


RESIGNATION
Where there is no choice, we do well to make no difficulty.-----George
Macdonald.
 
Hi Engel,

I have defender set so the icon shows in the status bar and it has a nice
green tick to show it's working. It can stay like that for minutes or hours,
then for no apparant reason it has either disappeared or has the yellow
exclamation mark, when I look to find out why the box normally comes up and
says "windows defender is turned off" etc. Well I know I didn't turn it off,
so suspect that gremlins are at work!

As for the "system events log" - sorry, but I did say I was very dim. If you
can tell me where to find it, I'll keep track of what it says and let you
know. Afraid me and pc's are a bit like me and cars, I know how to start it,
fuel it and drive it, but don't know anything about what's under the bonnet!

Thanks

Jane
 
Hi Jane,

Am I correct in thinking that you installed Windows Live OneCare ?



Do Start - Run – type:

eventvwr.msc

and hit enter.

Click on the System event log.

Click on View, Filter.

In the Source dropdown control, choose WinDefend.

Double click, this will give you a list of system events generated by
Windows Defender.

Look in the right pane for yellow or red-triangle events

Right click to highlight a specific event you wish to examine and select
properties to show the full Description.

See if the cause of stoping is described there.
 
Hi Engel,

I did try OneCare as I had pop-up ads appearing all over the place, but it
found nothing so I ditched it (decided it was a waste of time!) and managed
to clean up with a combination of AVG and Spybot (I hope!)

As for the rest, thanks for the instructions. It just switched itself off
about 30 minutes ago and the event viewer says:

Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 5010
Date: 12/05/2007
Time: 16:13:32
User: N/A
Computer: ACER-PC
Description:
Windows Defender scanning for spyware and other potentially unwanted
software is disabled.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I tried the link and there was no info available.

I'm off for the weekend so will catch up on any thoughts you have in a
couple of days.

Thanks

Jane
 
Hi Jane,

Scan with CCleaner and Ewido (now known as AVG Anti-Spyware)
CCleaner will clear your temp folders where a lot of malware hides installers
and Ewido performs great with Trojans.


Go for scans in safe mode (F-8)

Windows XP
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment
that is installed in your machine, amount of memory, hard drives installed
etc. At this point you should gently tap the F8 key repeatedly until you are
presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.
Do whatever tasks you require (CCleaner) and when you are done reboot to
boot back into normal mode.


Ccleaner - http://www.ccleaner.com
Note, uncheck Yahoos tool bar during install.


CCleaner even has a built-in Registry Cleaner. It's not the best (not
CCleaner's main function), but it will find invalid registry entries that
most Registry Cleaners will not. Unlike the Disk Cleaners with a Registry
Cleaner, CCleaner does really fast scanning for Registry Issues. The reason
is CCleaner doesn't want to effect Windows performance or effect any
applications. It's better to be safe than sorry!

The first time you run CCleaner's Issues scanner you'll have to keep
running it back-to-back until it finds nothing. One scenario is a registry
key may only be a reference pointing to a completely different location in
the registry and when it's removed then that reference link is also noticed
as being invalid on a subsequent scan. It's generally a good idea to keep
running the Issues scan until nothing is listed.


Reboot
--

Then try Ewido scan on line

http://www.ewido.net/en/download/
--


DIFFICULTY
The difficulty in life is the choice.-----George Moore
 
Thanks Engel

Have done all as suggested. Defender has kept running while PC is switched
on now. However, if I switch PC off, when I come to switch on again it does
not run automatically on start-up. Should it?

Jane
 
Hi Jane,

1.- There is also a third-party fix which has had good results for a number
of folks here:

Dial-a- Fix

http://wiki.djlizard.net/Dial-a-fix

Scroll down about 2/3 of the way to Download Dial-a-fix

Run this program with all the functions activated in safe mode.

--it may look as if the scan has frozen.
DAF is actually doing lots of shoveling and shuffling, so don't interrupt it.

Dial-a-fix is essentially a scripted run through of the standard Microsoft
fixes.
---


2.- You can repair Windows Defender.

First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove

Programs in Control Panel. Click WD and click Change.
Click Next, and then
click Updªte.

Reboot

If you still have the same problem, try this:
First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove
Programs in Control Panel.
Click WD and click Support Information and
click Repair.

Reboot.
--


For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
---


GREED
The miser and the pig are of no use till death.-----La Mothe
 
Hi again!

Switching itself off again now and still not turning on at start up. Have
tried the suggestions but am unable to repair defender. Get this message

The path 'C:\Documents and Settings\User\Local settings\Temporary Internet
Files\Content.IE5\IK5747UJ\WindowsDefender[1].msi' cannot be found. Verify
that you have access to this location and try again, or try to find the
installation package 'WindowsDefender[1].msi' in a folder from which you can
install the product Windows Defender.

I have gone to Microsoft's website and clicked to upgrade my version, which
presumably would overwrite any problems, but it continues to not run
properly. I have also been running CCleaner every day which comes up with the
same issue after every start up. Something about a reg key and the name
"Araf15". I select to fix issue and it deletes the key, but next day it's
back again.

Any clues?

Thanks for all your help!

Jane
 
Hi Jane,

1,- Install Windows Installer 3.1 v2 (3.1.4000.2435) is availªble here:
http://support.microsoft.com/kb/893803

Locate your file msi.dll (with search if you are
not sure where it's located) and confirm what the version is, either from
it's properties or just passing your cursor over it. If it's not the
latest which is 3.1.4000.2435, then:
http://support.microsoft.com/kb/893803/
-- --

2.- 4 steps to protect your computer
http://www.microsoft.com/protect/computer/default.mspx
-- --

3.- Araf15 is a nasty, Is related to the SmitFraud family.
You are going to use HijackThis

Try this URLs provided by Dave M. and follow each step

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview

http://wiki.castlecops.com/Malware_Prevention:_Prevent_Re-infection
-- --

Good luck


Еиςеl
--


RESIGNATION
Resignation is the timid side of courage.-----





Daft Bat said:
Hi again!

Switching itself off again now and still not turning on at start up. Have
tried the suggestions but am unable to repair defender. Get this message

The path 'C:\Documents and Settings\User\Local settings\Temporary Internet
Files\Content.IE5\IK5747UJ\WindowsDefender[1].msi' cannot be found. Verify
that you have access to this location and try again, or try to find the
installation package 'WindowsDefender[1].msi' in a folder from which you can
install the product Windows Defender.

I have gone to Microsoft's website and clicked to upgrade my version, which
presumably would overwrite any problems, but it continues to not run
properly. I have also been running CCleaner every day which comes up with the
same issue after every start up. Something about a reg key and the name
"Araf15". I select to fix issue and it deletes the key, but next day it's
back again.

Any clues?

Thanks for all your help!

Jane


Engel said:
Hi Jane,

1.- There is also a third-party fix which has had good results for a number
of folks here:

Dial-a- Fix

http://wiki.djlizard.net/Dial-a-fix

Scroll down about 2/3 of the way to Download Dial-a-fix

Run this program with all the functions activated in safe mode.

--it may look as if the scan has frozen.
DAF is actually doing lots of shoveling and shuffling, so don't interrupt it.

Dial-a-fix is essentially a scripted run through of the standard Microsoft
fixes.
---


2.- You can repair Windows Defender.

First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove

Programs in Control Panel. Click WD and click Change.
Click Next, and then
click Updªte.

Reboot

If you still have the same problem, try this:
First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove
Programs in Control Panel.
Click WD and click Support Information and
click Repair.

Reboot.
--


For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
---


GREED
The miser and the pig are of no use till death.-----La Mothe
 
To all who use live OneCare and defender together.

I received this response from OneCare Support after asking why defender kept
turning off. I use XP Sp2 and all updates are current on my machine. Support
downloaded a number of log files and the like from my machine and you'll find
below an excerpt from the supports email response.


"I understand the inconvenience you have experienced. Please be assured that
I will do my best to help you.

Jeff, I would like to let you know Windows Live OneCare includes Windows
Defender, it calls Anti-Spyware in OneCare. OneCare will disable the separate
Windows Defender automatically. We need to uninstall the separated Windows
Defender. For your reference, the steps are below:

Please go to Add/Remove and uninstall Windows Defender. Click Start, select
Control Panel and double click Add/Remove Programs. Highlight Windows
Defender in the list and choose Remove."

someone earlier mentioned using defender and onecare together but didn't
elaborate.

Hope this of some help.

jeff



Engel said:
Hi Jane,

1,- Install Windows Installer 3.1 v2 (3.1.4000.2435) is availªble here:
http://support.microsoft.com/kb/893803

Locate your file msi.dll (with search if you are
not sure where it's located) and confirm what the version is, either from
it's properties or just passing your cursor over it. If it's not the
latest which is 3.1.4000.2435, then:
http://support.microsoft.com/kb/893803/
-- --

2.- 4 steps to protect your computer
http://www.microsoft.com/protect/computer/default.mspx
-- --

3.- Araf15 is a nasty, Is related to the SmitFraud family.
You are going to use HijackThis

Try this URLs provided by Dave M. and follow each step

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction

http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview

http://wiki.castlecops.com/Malware_Prevention:_Prevent_Re-infection
-- --

Good luck


Еиςеl
--


RESIGNATION
Resignation is the timid side of courage.-----





Daft Bat said:
Hi again!

Switching itself off again now and still not turning on at start up. Have
tried the suggestions but am unable to repair defender. Get this message

The path 'C:\Documents and Settings\User\Local settings\Temporary Internet
Files\Content.IE5\IK5747UJ\WindowsDefender[1].msi' cannot be found. Verify
that you have access to this location and try again, or try to find the
installation package 'WindowsDefender[1].msi' in a folder from which you can
install the product Windows Defender.

I have gone to Microsoft's website and clicked to upgrade my version, which
presumably would overwrite any problems, but it continues to not run
properly. I have also been running CCleaner every day which comes up with the
same issue after every start up. Something about a reg key and the name
"Araf15". I select to fix issue and it deletes the key, but next day it's
back again.

Any clues?

Thanks for all your help!

Jane


Engel said:
Hi Jane,

1.- There is also a third-party fix which has had good results for a number
of folks here:

Dial-a- Fix

http://wiki.djlizard.net/Dial-a-fix

Scroll down about 2/3 of the way to Download Dial-a-fix

Run this program with all the functions activated in safe mode.

--it may look as if the scan has frozen.
DAF is actually doing lots of shoveling and shuffling, so don't interrupt it.

Dial-a-fix is essentially a scripted run through of the standard Microsoft
fixes.
---


2.- You can repair Windows Defender.

First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove

Programs in Control Panel. Click WD and click Change.
Click Next, and then
click Updªte.

Reboot

If you still have the same problem, try this:
First exit WD, click the down arrow to the right of the white question mark
in blue circle and then click Exit Windows Defender; using Add or Remove
Programs in Control Panel.
Click WD and click Support Information and
click Repair.

Reboot.
--


For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçеl
---


GREED
The miser and the pig are of no use till death.-----La Mothe





:

Thanks Engel

Have done all as suggested. Defender has kept running while PC is switched
on now. However, if I switch PC off, when I come to switch on again it does
not run automatically on start-up. Should it?

Jane



:

Hi Jane,

Scan with CCleaner and Ewido (now known as AVG Anti-Spyware)
CCleaner will clear your temp folders where a lot of malware hides installers
and Ewido performs great with Trojans.


Go for scans in safe mode (F-8)

Windows XP
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment
that is installed in your machine, amount of memory, hard drives installed
etc. At this point you should gently tap the F8 key repeatedly until you are
presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.
Do whatever tasks you require (CCleaner) and when you are done reboot to
boot back into normal mode.


Ccleaner - http://www.ccleaner.com
Note, uncheck Yahoos tool bar during install.


CCleaner even has a built-in Registry Cleaner. It's not the best (not
CCleaner's main function), but it will find invalid registry entries that
most Registry Cleaners will not. Unlike the Disk Cleaners with a Registry
Cleaner, CCleaner does really fast scanning for Registry Issues. The reason
is CCleaner doesn't want to effect Windows performance or effect any
applications. It's better to be safe than sorry!

The first time you run CCleaner's Issues scanner you'll have to keep
running it back-to-back until it finds nothing. One scenario is a registry
key may only be a reference pointing to a completely different location in
the registry and when it's removed then that reference link is also noticed
as being invalid on a subsequent scan. It's generally a good idea to keep
running the Issues scan until nothing is listed.


Reboot
--

Then try Ewido scan on line

http://www.ewido.net/en/download/
--


DIFFICULTY
The difficulty in life is the choice.-----George Moore





:

Hi Engel,

I did try OneCare as I had pop-up ads appearing all over the place, but it
found nothing so I ditched it (decided it was a waste of time!) and managed
to clean up with a combination of AVG and Spybot (I hope!)

As for the rest, thanks for the instructions. It just switched itself off
about 30 minutes ago and the event viewer says:

Event Type: Information
Event Source: WinDefend
Event Category: None
Event ID: 5010
Date: 12/05/2007
Time: 16:13:32
User: N/A
Computer: ACER-PC
Description:
Windows Defender scanning for spyware and other potentially unwanted
software is disabled.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I tried the link and there was no info available.

I'm off for the weekend so will catch up on any thoughts you have in a
couple of days.

Thanks

Jane


:

Hi Jane,

Am I correct in thinking that you installed Windows Live OneCare ?



Do Start - Run – type:

eventvwr.msc

and hit enter.

Click on the System event log.

Click on View, Filter.

In the Source dropdown control, choose WinDefend.

Double click, this will give you a list of system events generated by
Windows Defender.

Look in the right pane for yellow or red-triangle events

Right click to highlight a specific event you wish to examine and select
properties to show the full Description.

See if the cause of stoping is described there.
--

IGNORANCE
In order to have wisdom we must have ignorance.----Theodore Dreiser

:

Hi Engel,

I have defender set so the icon shows in the status bar and it has a nice
green tick to show it's working. It can stay like that for minutes or hours,
then for no apparant reason it has either disappeared or has the yellow
exclamation mark, when I look to find out why the box normally comes up and
says "windows defender is turned off" etc. Well I know I didn't turn it off,
so suspect that gremlins are at work!

As for the "system events log" - sorry, but I did say I was very dim. If you
can tell me where to find it, I'll keep track of what it says and let you
know. Afraid me and pc's are a bit like me and cars, I know how to start it,
fuel it and drive it, but don't know anything about what's under the bonnet!

Thanks

Jane



:

Hello Daft Bat,

Can you say more about what you saw that led you to say that it "that
defender keeps switching itself off ...?"
 
Back
Top