Why does Defender Complain about Microsoft Products

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

When ever Mircosoft Update runs and installs and update on my computer
Defender complains that the program is spyware. Why? Here are some of the
recent updates that came thru:

Event Type: Warning

Event Source: WinDefend

Event Category: None

Event ID: 3004

Date: 7/19/2006

Time: 8:36:12 AM

User: N/A

Computer: TGKW001

Description:

Windows Defender Real-Time Protection agent has detected spyware or other
potentially unwanted software.

For more information please see the following:

http://www.microsoft.com

Scan ID: {F618844D-08DD-4D08-8D7D-E50A61B902E6}

User: TGKW001\Thomas R Grassi Jr

Name: Unknown

ID:

Severity ID:

Category ID:

Path Found: service:ASP.NET_1.1.4322

Alert Type: Unknown

Detection Type:





For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Warning

Event Source: WinDefend

Event Category: None

Event ID: 3004

Date: 7/19/2006

Time: 8:36:12 AM

User: N/A

Computer: TGKW001

Description:

Windows Defender Real-Time Protection agent has detected spyware or other
potentially unwanted software.

For more information please see the following:

http://www.microsoft.com

Scan ID: {8502FBE3-465E-4244-969E-267576760071}

User: TGKW001\Thomas R Grassi Jr

Name: Unknown

ID:

Severity ID:

Category ID:

Path Found: driver:ASP.NET_1.1.4322

Alert Type: Unknown

Detection Type:





For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Warning

Event Source: WinDefend

Event Category: None

Event ID: 3004

Date: 7/19/2006

Time: 8:36:14 AM

User: N/A

Computer: TGKW001

Description:

Windows Defender Real-Time Protection agent has detected spyware or other
potentially unwanted software.

For more information please see the following:

http://www.microsoft.com

Scan ID: {5208A730-CD19-424F-8CF8-DF246A5FEF2E}

User: TGKW001\Thomas R Grassi Jr

Name: Unknown

ID:

Severity ID:

Category ID:

Path Found:
regkey:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\NetFxUpdate_v1.1.4322;runonce:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\NetFxUpdate_v1.1.4322;file:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe

Alert Type: Unknown

Detection Type:





For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Warning

Event Source: WinDefend

Event Category: None

Event ID: 3004

Date: 7/19/2006

Time: 9:21:10 PM

User: N/A

Computer: TGKW001

Description:

Windows Defender Real-Time Protection agent has detected spyware or other
potentially unwanted software.

For more information please see the following:

http://www.microsoft.com

Scan ID: {69817576-CE79-42AE-85BD-5C1ADA50E9A4}

User: TGKW001\Thomas R Grassi Jr

Name: Unknown

ID:

Severity ID:

Category ID:

Path Found:
regkey:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\NetFxUpdate_v1.1.4322;runonce:HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\NetFxUpdate_v1.1.4322;file:C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe

Alert Type: Unknown

Detection Type:





For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Should we stop Defender when we install programs? If so how do you stop
defender temporarily?

I would understand if it was a third party install that has not been
registered with Microsoft but come on a Microsoft update?????

Please lets get Defender out of Beta so we can get some help...

Thanks

tom
 
Oxford

My .Net is now 2.0

Thanks

Myt main concern here is that Defender compalins about any software being
installed or updated. That was just an example of what happens. I did see
where someone posted that you can stop the real time protection prior to
installation.
Why should we have to do that?

Again

Thanks

Tom
 
Hello Tom
Why would you even install it if you are going to turn it off? If your
regular programs are entered / permitted within the program there should be
no problem. By the way what other security programs are you using? The reason
you received or receive the warnings is that the software is not signed /
verified; yes even some of Microsoft’s programs are not .net 1.1 for example.
You must give your known good unsigned software permission!
Oxford
 
Oxford

I only run WOC and Defender. If I knew what prorgams are signed or not
signed I would be working for Microsoft.
These are updates that come down from Microsoft. And yes I understand that
some prgrams are not signed, but i do not understand why a microsoft product
would be.
It is all part of quality control.
I guess for now I will stop the real time protection while doing installs

Tom
 
Oxford said:
Why would you even install it if you are going to turn it off?
Click to expand...

If RTP is causing issues, then one way to resolve the problem is to turn it
off until the issues are fixed. Hopefully we'll soon have an improved version
without these issues so that those of us who are troubled by them can turn
RTP back on again. In the meantime, we can still perform scans, check that
updates are proceeding correctly, etc.
 
Hello
Maybe I don`t understand but I also run WOCL and WD and do not encounter
this problem. I have however given the same permissions to the WOCL:

Once again I have used PCPOtimise as an example program.

Next we are off to the Windows OneCare program to give it permission.
Normally this first part is done automatically but we will check to be sure.
Open the OneCare main panel and on the left side you will see (Other Tasks)
under it click on (View or Change Settings) a panel will open with 6 Tabs on
it. Go to the Tab marked Firewall and click on it, near the bottom there is
a radio button (Advanced Settings) click on it. Now the panel that is in
front should be (Program List) scroll through this list look for (PC Pitstop
Optimise version 1.5.8.1) if it is there OK, if it is there but with the
wrong version # just click on the entry and then remove. Now you are going to
manually add the program, select the radio button (ADD) another panel will
open, at the top click on the file folder with the arrow this will bring you
back a level to Program Files, again find (PCPitstop) double click, there
double click (Optimise), scroll down to the icon as before double click and
you are suddenly back to the firewall panel and the entry for Optimise is /
has permission. Do Not close this panel yet. This is also the same for adding
other programs, just change the name.
I know it seems repetitive, maybe it will change when they merge.
Best of luck
Oxford
 
Oxford said:
Hello
Maybe I don`t understand but I also run WOCL and WD and do not encounter
this problem. I have however given the same permissions to the WOCL:

Once again I have used PCPOtimise as an example program.

Next we are off to the Windows OneCare program to give it permission.
Normally this first part is done automatically but we will check to be sure.
Open the OneCare main panel and on the left side you will see (Other Tasks)
under it click on (View or Change Settings) a panel will open with 6 Tabs on
it. Go to the Tab marked Firewall and click on it, near the bottom there is
a radio button (Advanced Settings) click on it. Now the panel that is in
front should be (Program List) scroll through this list look for (PC Pitstop
Optimise version 1.5.8.1) if it is there OK, if it is there but with the
wrong version # just click on the entry and then remove. Now you are going to
manually add the program, select the radio button (ADD) another panel will
open, at the top click on the file folder with the arrow this will bring you
back a level to Program Files, again find (PCPitstop) double click, there
double click (Optimise), scroll down to the icon as before double click and
you are suddenly back to the firewall panel and the entry for Optimise is /
has permission. Do Not close this panel yet. This is also the same for adding
other programs, just change the name.
Click to expand...

Now click on the Antivirus TAB, then the radio button (Antivirus Exclusions)
in here you are going to do the same as before click ADD, and find the
PCPOtimise.exe as you did before double click on it and again you have made
the entry then OK, close the Windows OneCare panel,
 
Oxford said:
Hello
Maybe I don`t understand but I also run WOCL and WD and do not encounter
this problem. I have however given the same permissions to the WOCL:
Click to expand...

I don't have Windows One Care, so I'm afraid I couldn't understand your
post. All I wanted to point out is that I think (unless someone can correct
me) that there are two distinct processes:
(1) the scanning of files during a system scan - where it's possible to
exclude certain files from the scan. I haven't found any use for any such
exclusions myself.
(2) the behaviour of certain benign programs (like an AOL driver, or the
program that worries Tom), which Defender believes is suspicious. This is
where the problems lie. It's not at all clear to me how to inform Defender
that this program's behaviour can be ignored, i.e - how to get them into the
'allow' list, which stubbornly remains blank, with no evident way to add to
it.
 
Hello
I really did misunderstand! I assumed that in one post the .Net program was
giving the errors this I know is corrected by the newer version.
In the other post it was about preventing warnings for known good programs.
I tried to answer, but!
I do now see what you are explaining, and I am also curious for mine is also
blank.
I thought the Software Explorer had something to do with it, but again it
doesn’t really do anything either.
Sorry for any troubles
Oxford
 
Back
Top