I have "Software that has not yet been classified for risks" switched
off but stll get Defender restore points. It produces one "Windows
Defender checkpoint" the first time the computer starts for the day.
No checkpoints prior to 14 April
I upgraded to current version on 14th April - 2 checkpoints
15th - 1 checkpoint
16th - ""
17th - ""
18th - ""
19th - 7 checkpoints (sigs were updated to current this day - 4
checkpoints prior to sig update, 3 following sig update)
20th - 3 checkpoints
Events for 19th were as follows - seems that a checkpoint was produced
for each one.
8:01:50 AM
Windows Defender Real-Time Protection agent has detected spyware or
other potentially unwanted software.
For more information please see the following:
http://www.microsoft.com
Scan ID: {CE7E1AE3-75B1-42AA-A0B5-BBBCF82E4706}
User: JOHN-NAD648S2RH\John
Name: Unknown
ID:
Severity ID:
Category ID:
Path Found:
driver
xHelp20;file:C:\WINDOWS\system32\Drivers\PxHelp20.sys
Alert Type: Unknown
Detection Type:
8:02:07 AM
Windows Defender Real-Time Protection agent has taken action to
protect this machine from spyware or other potentially unwanted
software.
For more information please see the following:
http://www.microsoft.com
Scan ID: {CE7E1AE3-75B1-42AA-A0B5-BBBCF82E4706}
User: JOHN-NAD648S2RH\John
Name: Unknown
ID:
Severity ID:
Category ID:
Alert Type: Unknown
Action: Ignore
2:58:45 PM
Windows Defender Configuration has changed. If this is an unexpected
event you should review the settings as this may be the result of
malware.
Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\ASSignatureVersion = 1.14.1396.12
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\ASSignatureVersion = 1.14.1402.2
2:58:45 PM
Windows Defender Configuration has changed. If this is an unexpected
event you should review the settings as this may be the result of
malware.
Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\EngineVersion = 1.1.1303.0
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\EngineVersion = 1.1.1372.0
2:58:45 PM
Windows Defender Configuration has changed. If this is an unexpected
event you should review the settings as this may be the result of
malware.
Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\SignatureLocation = C:\Documents and Settings\All
Users\Application Data\Microsoft\Windows Defender\Definition
Updates\{85F4B4A3-C330-450E-88DC-0A04249CA8FB}
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Signature
Updates\SignatureLocation = C:\Documents and Settings\All
Users\Application Data\Microsoft\Windows Defender\Definition
Updates\{3A52D1BF-D596-423B-B333-DB312E6427BA}
2:58:45 PM
Windows Defender engine version has been updated.
Current Engine Version: 1.1.1372.0
Previous Engine Version: 1.1.1303.0
Update Source: Scheduled
User: NT AUTHORITY\SYSTEM
2:58:45 PM
Windows Defender signature version has been updated.
Current Signature Version: 1.14.1402.2
Previous Signature Version: 1.14.1396.12
Update Source: Scheduled
Signature Type: AntiSpyware
Update Type: Full
User: NT AUTHORITY\SYSTEM
Current Engine Version: 1.1.1372.0
Previous Engine Version: 1.1.1303.0
John Allen
