Windows Defender detects MSN Desktop Searchbar

  • Thread starter Thread starter Eric
  • Start date Start date
E

Eric

When installing the MSN Desktop Search toolbar, Windows Defender logs
entries in the Event Viewer as malware detected. There is no strange
behavior with these programs together. They both work as usual. When you
open Windows Defender to check the History the level threat is "Unknown".

Description:
This program has potentially unwanted behavior.

Advice:
Allow this detected item only if you trust the program or the software
publisher.

Resources:
regkey:
HKCU@S-1-5-21-839522115-1965331169-2147116355-1003\Software\Microsoft\Internet
Explorer\MenuExt\Open in new foreground tab

iemenuext:
HKCU@S-1-5-21-839522115-1965331169-2147116355-1003\Software\Microsoft\Internet
Explorer\MenuExt\Open in new foreground tab

file:
C:\Program Files\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll

Category:
Not Yet Classified


How often does this happen?

Always

Reproduction Steps:

1. Uninstall MSN Desktop Searchbar
2. Clear entries in the Event Viewer
3. Reinstall MSN Desktop Searchbar

Additional Information:

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 3/7/2006
Time: 1:43:32 PM
User: N/A
Computer: ERIC1
Description:
Windows Defender Real-Time Protection agent has detected potential malware.
For more information please see the following:
http://www.microsoft.com
Scan ID: {832B8DB3-CE0F-44AF-958E-F391CA354B3D}
User: ERIC1\Eric
Threat Name: Unknown
Threat Id:
Threat Severity:
Threat Category:
Path Found:
regkey:HKCU@S-1-5-21-839522115-1965331169-2147116355-1003\Software\Microsoft\Internet
Explorer\MenuExt\Open in new foreground
tab;iemenuext:HKCU@S-1-5-21-839522115-1965331169-2147116355-1003\Software\Microsoft\Internet
Explorer\MenuExt\Open in new foreground tab;file:C:\Program Files\MSN
Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll
Threat Classification: Unknown
Detection Type:


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
 
Thanks for the clear report Eric. I think this is expected behavior--the
control is apparently not yet known. This is one reason why such reports
are not, by default, brought to the attention of the user for action.
 
Back
Top