Why does WD throw this error only in the Event Viewer?

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Windows Defender Real-Time Protection agent has detected changes. Microsoft
recommends you analyze the software that made these changes for potential
risks. You can use information about how these programs operate to choose
whether to allow them to run or remove them from your computer. Allow
changes only if you trust the program or the software publisher. Windows
Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {8593C593-9AB2-459F-92BD-DF6004699F6E}
User: xxxxx\xxxx
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found: service:PROCEXP111
Alert Type: Unclassified software
Detection Type:


======
How am I supposed to "Allow" or "Deny" this software if WD keeps sending
the alert to the Event Viewer instead of at the systray icon (WINXP SP2 Home
Ed.)?
Please help me understand?
 
Hi Bcool

I honestley don`t know. Wish I could give you a coherent, meaningful answer.
I don`t think even our Bill S and Engel can, which may be why your question
has not been addressed.

From what I understand, WD pushes out EV entries such as the one you have
posted, if it doesn`t understand (or comes across) an application it cannot
identify with certainty. That is to say. A flag is given in standard format -
presumeably progged by the developers that way if it doesn`t recognise a prog
as cotia. YET!! YET is the operative word. Because there are times when one
is left wondering. For how long and when they will become cotia? Who knows?
There does seem to have been some progress but what this represents in terms
of progress is difficult to assess from the end user point of view.

In the meantime. The cynics (myself included) will tell you. Know and
understand the software you have installed on your comp and trust
accordingly. Fat help if you`re not computer literate. Maybe thats the point
MS are trying to drive home. We must educate ourselves.

Stu

Have you joined the MS spynet community with advamced membership?
 
I think that's a reasonable explanation, Stu.

The original question was why these alerts go to the events log and not
directly to the user.

That's a default configuration choice--there is an options setting to have
these alerts appear for the user, but it is off by default and I'm very glad
it is.

You mention that computer users must educate themselves. Certainly that's a
great idea, if you have the time and the inclination to do so. However, the
vast majority of computer users don't have that time--they are focussed on
getting "stuff" done---whether it is work, or play, with the computer as a
tool to that end. The computer should facilitate that, not get in the way.
Most users won't have the faintest idea what PROCEXP111 is (in fact, I don't
either--having done no research on it yet!) So Microsoft doesn't bother
them with information that will be of no use to them, may result in them
making an incorrect choice, if faced with a prompt requiring a choice, and
may also result in their feeling less safe, when in fact there is no reason
for that.

So--if you feel you can make sense out of the prompts that will result, turn
on:

"Choose if this program should notify you about:

Software that has not yet been classified for risks.
Changes made to your computer by software that is permitted to run."

(Tools, Options, scroll down using the scroll bar on the right of the
window.)

However, most users will not know what to do with the information presented
in these prompts, so these settings are off by default.

There's no harm in turning these on, as long as you remember that you've
done so and aren't too perplexed when you see a new warning and can't recall
where it is coming from. You can learn some things about what is happening
in your machine--for example, as a new program is installed, you will see
alerts about actions taken in the course of the install.
 
Thank you Bill. I do my best - sometimes.

------------------------------------------------------------------------------------------------

`That's a default configuration choice--there is an options setting to have
these alerts appear for the user, but it is off by default and I'm very glad
it is.`
Click to expand...
------------------------------------------------------------------------------------------------

Agreed. I feel program settings are better left to `default` for those who
are not computer literate. The `recommended` option in installs has, for me,
been one of the best innovations in recent years and the option I always go
for when installing. The tinkering can come later when you fully understand
what it is you are dealing with. In that way, if you are presented with one
of those `decision making dialog boxes`, you can cope and hopefully, make the
right decision. Better still, is the option to reset to default values if you
`screw up`. Its great to see developers have recognised this and give you
these alternative setting options once the application has been successfully
installed. BUT. I`m a trusting guy and in spite of my cynasism, have a great
deal of faith and respect for MS developers as - doing the right thing in
those areas I don`t fully understand.

Stu
 
Thank you Bill and Stu!

1.) Yes I have joined Advanced Spynet membership
2.) Yes - I have option setting so I get all alerts even about trusted
software
3.) No - it makes no difference - a couple of alerts just insist on going
to Event View only with no notice to user.
4.) I see that apparently intelligent people are using this utility so
despite my misgivings I continue to use it as well. I try to ignore the
notion that comes over me occasionally that the emperor is wearing no clothes.

Thanks for your insights.
 
Back
Top