I know this forum is OneCare, but i cannot find anywhere to give
feedback/question on Defender, so here goes...

I d/l'd defender a few days ago and installed it on my system. I was rather
dismayed though in putting it through some test to see that it did not
apparently catch some of the simplest exploits that spyware and such use
sometimes.

I tried adding a new shortcut to my startup folder, and Defender was
clueless.
I tried changing my hosts file, and Defender was clueless.

Both of these were caught by AntiSpyware, and it would prompt me to
allow/deny the changes. If Defender cant catch these simple exploits, it
really calls into question whether it could catch more complex ones. Due to
this i am thus far very UNimpressed with defender and would prefer to see the
previous AntiSpyware come back.

Can anyone give any explanation as to why Defender is handicapped, and if it
will be healed?

Thanks!

- Aaron.

Aaron,

This is actually the correct place to report Windows Defender Issues Due
to feedback from many users, we removed some of the notifications which were
too "annoying." You can re-enable these messages by going to tools ->
general settings -> and selecting "When changes are detected from software
that has not been classified" and selecting "When changes are detected from
allowed software.

As far as the host file and startup issues you are reporting, we do
recognize the changes occurred (and log an event to the System Event Log).
Once you enable the settings above, you will see balloon notifications when
these changes occur.

--
-steve

Steve Dodson [MSFT]
Windows Defender Beta Lead
MCSE, CISSP
http://blogs.technet.com/stevedod
--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
"Eidolon" <(E-Mail Removed)> wrote in message
news:E6BA3B95-DD8F-40AD-AB9C-(E-Mail Removed)...
>I know this forum is OneCare, but i cannot find anywhere to give
> feedback/question on Defender, so here goes...
>
> I d/l'd defender a few days ago and installed it on my system. I was
> rather
> dismayed though in putting it through some test to see that it did not
> apparently catch some of the simplest exploits that spyware and such use
> sometimes.
>
> I tried adding a new shortcut to my startup folder, and Defender was
> clueless.
> I tried changing my hosts file, and Defender was clueless.
>
> Both of these were caught by AntiSpyware, and it would prompt me to
> allow/deny the changes. If Defender cant catch these simple exploits, it
> really calls into question whether it could catch more complex ones. Due
> to
> this i am thus far very UNimpressed with defender and would prefer to see
> the
> previous AntiSpyware come back.
>
> Can anyone give any explanation as to why Defender is handicapped, and if
> it
> will be healed?
>
> Thanks!
>
> - Aaron.

Yah, sorry about that 'wrong place'. Id posted on OneCare group orig, and
just copied the message.

Thanks for the info, i changed those settings and then it did notify me.
That is good. It seems weird though these items would be off by default
(startup and hosts) as those changes should especially need to be caught for
avg. end users who are clueless about that kind of stuff and they are common
exploits.

Anyway, some of these settings are very hard to find though in WD. I missed
them because the scrollbar on the general settings was had to see. It would
be great to see something like: WD setup prompts you whether you are an avg.
end user or a power user, and if enduser, show the simplified interface, and
if poweruser then show an interface more like the previous AntiSpyware,
giving more detailed controls and information and finer-grained settings and
control for adjusting WD's behaviour.

P.S. - not that this really affects functionality, just a personal thing,
but the new icon for WD is really cheezy, i think the old AS bullseye-looking
thing was nicer than the little castle wall. .


CheerZ,
Aaron.

"Steve Dodson [MSFT]" wrote:

> Aaron,
>
> This is actually the correct place to report Windows Defender Issues Due
> to feedback from many users, we removed some of the notifications which were
> too "annoying." You can re-enable these messages by going to tools ->
> general settings -> and selecting "When changes are detected from software
> that has not been classified" and selecting "When changes are detected from
> allowed software.
>
> As far as the host file and startup issues you are reporting, we do
> recognize the changes occurred (and log an event to the System Event Log).
> Once you enable the settings above, you will see balloon notifications when
> these changes occur.
>
> ---
> steve