Here's an odd one that I've never seen before. An hour ago I had occasion to
restart my computer, and just now I happened to take a look in Event Viewer
and found two entries at the time of the restart like this one, both
registered at the same time:

Quote:
Windows Defender Real-Time Protection agent has detected changes. Microsoft
recommends you analyze the software that made these changes for potential
risks etc, etc.
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found: driver:uphcleanhlp
Alert Type: Unclassified software
Detection Type:
End of quote.

There are always entries related to UPHClean in Event Viewer, but I've never
seen Defender respond to it. There was no pop-up at the time asking me to
allow or block this change - Defender just silently allowed it. There's
nothing in Defender's history relating to it. It's only of slight interest -
but does anyone know what this is about?

This is normal, I believe. It is possible that you have an older version of
UPHClean, so it is worth checking and downloading the current version.

As I recall, you may need to uninstall the old version and install the new
one--but my recall is pretty fuzzy.

The default action for an "unknown" is to silently allow with these log
entries. If the item had been known bad, you would get an alarm. You can
change the default behavior via tools, options, to see alerts about "items
not yet classified"--but I would urge folks not to do this lightly--we get
lots of messages asking what these alerts are about when that setting change
is made.

--

"Alan D" <(E-Mail Removed)> wrote in message
news:8103FAD2-AEA2-4C4F-99C7-(E-Mail Removed)...
> Here's an odd one that I've never seen before. An hour ago I had occasion
> to
> restart my computer, and just now I happened to take a look in Event
> Viewer
> and found two entries at the time of the restart like this one, both
> registered at the same time:
>
> Quote:
> Windows Defender Real-Time Protection agent has detected changes.
> Microsoft
> recommends you analyze the software that made these changes for potential
> risks etc, etc.
> Name: Unknown
> ID:
> Severity: Not Yet Classified
> Category: Not Yet Classified
> Path Found: driver:uphcleanhlp
> Alert Type: Unclassified software
> Detection Type:
> End of quote.
>
> There are always entries related to UPHClean in Event Viewer, but I've
> never
> seen Defender respond to it. There was no pop-up at the time asking me to
> allow or block this change - Defender just silently allowed it. There's
> nothing in Defender's history relating to it. It's only of slight
> interest -
> but does anyone know what this is about?

"Bill Sanderson MVP" wrote
> The default action for an "unknown" is to silently allow with these log
> entries. If the item had been known bad, you would get an alarm.

Thanks Bill. That answers the only aspect that concerned me - that there was
a warning in Event Viewer, but no alert. (And now I come to think about it,
the warning is very sensible.)

Bill, I'd like to ask a similar question about WD and the Uphclean service.
Since the last WD engine update 1.1.2503, when I shutdown, I get the old
restart at shutdown problem like we used to see with Win98. Still working on
the culprit (BIOS is OK, set to not restart with any power glitches, pwr
settings rechecked) but I see 2 UpHclean entries at shutdown in the Event
viewer, the 2nd one regarding the Mspmeng.exe not shutting down properly.
Wasn't seen previously. Checked all the KB info, and I don't have Easy CD
creator on my machine. My Uphclean Ver 1.6.30.0.
Any reports of WD causing improper shutdown and restart you've seen, or
anybody's seen, or are now having the same problem.
Thanks,

i have version 1.6.30 for uphclean
on microsoft web site it says 1.6d
someone want to tell me what the latest version is more than just "d" so I
know I am downloading and installing a new version not the one I have?

thanks
robin
"Bill Sanderson MVP" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> This is normal, I believe. It is possible that you have an older version
> of UPHClean, so it is worth checking and downloading the current version.
>
> As I recall, you may need to uninstall the old version and install the new
> one--but my recall is pretty fuzzy.
>
> The default action for an "unknown" is to silently allow with these log
> entries. If the item had been known bad, you would get an alarm. You can
> change the default behavior via tools, options, to see alerts about "items
> not yet classified"--but I would urge folks not to do this lightly--we get
> lots of messages asking what these alerts are about when that setting
> change is made.
>
> --
>
> "Alan D" <(E-Mail Removed)> wrote in message
> news:8103FAD2-AEA2-4C4F-99C7-(E-Mail Removed)...
>> Here's an odd one that I've never seen before. An hour ago I had occasion
>> to
>> restart my computer, and just now I happened to take a look in Event
>> Viewer
>> and found two entries at the time of the restart like this one, both
>> registered at the same time:
>>
>> Quote:
>> Windows Defender Real-Time Protection agent has detected changes.
>> Microsoft
>> recommends you analyze the software that made these changes for potential
>> risks etc, etc.
>> Name: Unknown
>> ID:
>> Severity: Not Yet Classified
>> Category: Not Yet Classified
>> Path Found: driver:uphcleanhlp
>> Alert Type: Unclassified software
>> Detection Type:
>> End of quote.
>>
>> There are always entries related to UPHClean in Event Viewer, but I've
>> never
>> seen Defender respond to it. There was no pop-up at the time asking me to
>> allow or block this change - Defender just silently allowed it. There's
>> nothing in Defender's history relating to it. It's only of slight
>> interest -
>> but does anyone know what this is about?
>
>

Hi Robinb,

Check the date in the web page.
--

"Robinb" wrote:

> i have version 1.6.30 for uphclean
> on microsoft web site it says 1.6d
> someone want to tell me what the latest version is more than just "d" so I
> know I am downloading and installing a new version not the one I have?
>
> thanks
> robin
> "Bill Sanderson MVP" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > This is normal, I believe. It is possible that you have an older version
> > of UPHClean, so it is worth checking and downloading the current version.
> >
> > As I recall, you may need to uninstall the old version and install the new
> > one--but my recall is pretty fuzzy.
> >
> > The default action for an "unknown" is to silently allow with these log
> > entries. If the item had been known bad, you would get an alarm. You can
> > change the default behavior via tools, options, to see alerts about "items
> > not yet classified"--but I would urge folks not to do this lightly--we get
> > lots of messages asking what these alerts are about when that setting
> > change is made.
> >
> > --
> >
> > "Alan D" <(E-Mail Removed)> wrote in message
> > news:8103FAD2-AEA2-4C4F-99C7-(E-Mail Removed)...
> >> Here's an odd one that I've never seen before. An hour ago I had occasion
> >> to
> >> restart my computer, and just now I happened to take a look in Event
> >> Viewer
> >> and found two entries at the time of the restart like this one, both
> >> registered at the same time:
> >>
> >> Quote:
> >> Windows Defender Real-Time Protection agent has detected changes.
> >> Microsoft
> >> recommends you analyze the software that made these changes for potential
> >> risks etc, etc.
> >> Name: Unknown
> >> ID:
> >> Severity: Not Yet Classified
> >> Category: Not Yet Classified
> >> Path Found: driver:uphcleanhlp
> >> Alert Type: Unclassified software
> >> Detection Type:
> >> End of quote.
> >>
> >> There are always entries related to UPHClean in Event Viewer, but I've
> >> never
> >> seen Defender respond to it. There was no pop-up at the time asking me to
> >> allow or block this change - Defender just silently allowed it. There's
> >> nothing in Defender's history relating to it. It's only of slight
> >> interest -
> >> but does anyone know what this is about?
> >
> >
>
>
>

"Engel" wrote
> Check the date in the web page.

Hmmm. The date on the webpage is 8 March 2007. I can't remember when I
installed UPHclean - was it 2 months ago? No idea.

Robin, my version is the same as yours. Is this different to 1.6d? Who can
tell?

Why the heck does it all have to be so obscure?

Alan D and Robinb.

With XP I use it. I have archived the program, and this is the information.


Look the date and version. From the readme text.

UPHClean v1.6d readme.txt
Updated April 27, 2005 by Robin Caron
Send all feedback/comments/problems to (E-Mail Removed)


Again, check the date and version. From the web page.

Quick Details
Version: 1.6d
Date Published: 9/22/2006
Language: English
Download Size: 24 KB - 353
*Download size depends on selected download components.


So I don't think is much change within the program, then and today. Probably
using the feedback you can get a same or better answer.
--


ILLUSION
The unknown always seems sublime.-----Tacitus


"Alan D" wrote:

>
> "Engel" wrote
> > Check the date in the web page.
>
> Hmmm. The date on the webpage is 8 March 2007. I can't remember when I
> installed UPHclean - was it 2 months ago? No idea.
>
> Robin, my version is the same as yours. Is this different to 1.6d? Who can
> tell?
>
> Why the heck does it all have to be so obscure?
>
>
>

I don't have this installed here at home as far as I can see, so I don't
know how to verify the versioning.

--

"Robinb" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
>i have version 1.6.30 for uphclean
> on microsoft web site it says 1.6d
> someone want to tell me what the latest version is more than just "d" so I
> know I am downloading and installing a new version not the one I have?
>
> thanks
> robin
> "Bill Sanderson MVP" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> This is normal, I believe. It is possible that you have an older version
>> of UPHClean, so it is worth checking and downloading the current version.
>>
>> As I recall, you may need to uninstall the old version and install the
>> new one--but my recall is pretty fuzzy.
>>
>> The default action for an "unknown" is to silently allow with these log
>> entries. If the item had been known bad, you would get an alarm. You
>> can change the default behavior via tools, options, to see alerts about
>> "items not yet classified"--but I would urge folks not to do this
>> lightly--we get lots of messages asking what these alerts are about when
>> that setting change is made.
>>
>> --
>>
>> "Alan D" <(E-Mail Removed)> wrote in message
>> news:8103FAD2-AEA2-4C4F-99C7-(E-Mail Removed)...
>>> Here's an odd one that I've never seen before. An hour ago I had
>>> occasion to
>>> restart my computer, and just now I happened to take a look in Event
>>> Viewer
>>> and found two entries at the time of the restart like this one, both
>>> registered at the same time:
>>>
>>> Quote:
>>> Windows Defender Real-Time Protection agent has detected changes.
>>> Microsoft
>>> recommends you analyze the software that made these changes for
>>> potential
>>> risks etc, etc.
>>> Name: Unknown
>>> ID:
>>> Severity: Not Yet Classified
>>> Category: Not Yet Classified
>>> Path Found: driver:uphcleanhlp
>>> Alert Type: Unclassified software
>>> Detection Type:
>>> End of quote.
>>>
>>> There are always entries related to UPHClean in Event Viewer, but I've
>>> never
>>> seen Defender respond to it. There was no pop-up at the time asking me
>>> to
>>> allow or block this change - Defender just silently allowed it. There's
>>> nothing in Defender's history relating to it. It's only of slight
>>> interest -
>>> but does anyone know what this is about?
>>
>>
>
>

I can't say that I've seen such reports, but I'm not sure I would, either.

Repair of Windows Defender and/or remove, re-download, and install of
UPHClean might be in order.

I haven't seen shutdown issues in a good long time, but I'm afraid the base
of machines I see with Windows Defender installed is rather small at the
moment.

--

"John Van Kirk" <(E-Mail Removed).> wrote in message
newsE5A05A3-AEC3-4A43-87E5-(E-Mail Removed)...
> Bill, I'd like to ask a similar question about WD and the Uphclean
> service.
> Since the last WD engine update 1.1.2503, when I shutdown, I get the old
> restart at shutdown problem like we used to see with Win98. Still working
> on
> the culprit (BIOS is OK, set to not restart with any power glitches, pwr
> settings rechecked) but I see 2 UpHclean entries at shutdown in the Event
> viewer, the 2nd one regarding the Mspmeng.exe not shutting down properly.
> Wasn't seen previously. Checked all the KB info, and I don't have Easy CD
> creator on my machine. My Uphclean Ver 1.6.30.0.
> Any reports of WD causing improper shutdown and restart you've seen, or
> anybody's seen, or are now having the same problem.
> Thanks,
>
>
>
>
>