Failure Codes When Blocking Programs

[Guest]

Recently, I've been prompted to Allow or Block 2 programs by Windows Defender.

I decided to block both times.

The first time, I was trying to block Keynote Connector from running when I
turned on my computer. I got a failure code of 0x80078019.

The second time, I was trying to block the SDDMI2 driver
(C:\WINDOWS\system32\DDMI2.sys). I got a failure code of 0x80078021.

I've allowed Windows Defender to do a quick scan after each incident and it
comes up clean.

 

[Guest]

I am also interested in a Microsoft response. I am not sure what "block" is
supposed to do and whether the action taken by "block" differs based upon the
real time agent detecting the problem and/or whether the software is
"classified" or "not yet classified".

 

[Tom Emmelot]

Hi Zian,

first one, i suppose you install that program by your self!?
http://user.xms.keynote.com/applications/panel_portal/faq_connector.asp
The other one is from Dell and if you are running a Dell that is also
legitimate.

Regards >*< TOM >*<

Zian schreef:

 

[Guest]

Yes. I did but half way through the installation process I changed my mind so
I told Defender to block it.

According to the Dell support forums, DDMI2.sys shouldn't be required.
Actually, the current attitude toward DDMI2.sys is rather conflicted
(http://forums.us.dell.com/supportfo...d=dim_other&message.id=229202&query.id=157240
and
http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=53623)

I think you're missing the bigger issue. Even if both programs are 100% OK,
Windows Defender's failure codes are still mystifying. In addition, failure
to block supposedly well-behaved software doesn't raise my confidence that
Defender can block malicious software.

 

[Tom Emmelot]

Zian,

I don't agree, the first (keynote) is not malicious software and block
it on the install process half way is not the way you should block,
normal is to block it at the start.
The second is a not yet allowed software that WD detect(and you are not
the first that report it here)this is a Dell service to keep your
software from Dell update. Normal if it was malicious software, and WD
could not stop it, the advice is to do a full scan in save mode.
May be some MVP can give more info about the failure code nubers and
what they are about.

Regards >*< TOM >*<

Zian schreef:

 

[Guest]

Hi Zian

I agree with you on the bigger issue. As far as I am concerned, block
hasn't worked correctly under Windows Defender since day one and WD
supporters seem reluctant to acknowledge the issue.