"Win Defender detected changes"

[Guest]

I have gotten this message almost everytime I have started my computer since
installing Win Defender. It always references the same program: "Powermarks
3.5". I use this program and have it launch at Startup. Defender always
claims "Detected Changes - Powermarks.Ink". The suggested action is to
"Accept". I always "Apply". It always says "Succeeded".
My question is: How can I make Defender stop asking about this every time I
start my computer?

I am using Win XP Home, Defender Ver. 1.1.1051.0

 

[Tom Emmelot]

Hello Dick,

go to:
Tools/General Settings/Advanced Options/and browse met Add to the file
and Add him.

Regards >*< TOM >*<

Dick2006 schreef:

 

[Guest]

Thank you Tom,

I added Powermarks.ink, which is the specific file Defender specifies and
also Powermarks.exe, which is the Program. Still Defender claims to detect
changes everytime I boot.

Any other ideas? It is irritating to have to deal with this all the time.

Thanks, Dick

 

[Guest]

I see the same thing happening every time I reboot, where Win Defender
incorrectly says that it has detected changes in the startup links
"PGPtray.exe.lnk" and "Microsoft Time Zone.lnk".

I tried to follow the advice someone gave of adding these to things to not
scan, but it won't add the .lnk - it instead adds the files to which the link
points. I don't want to add the whole Startup directory, because real changes
to that directory should be scanned and reported.

Any other ideas?
Thanks
-Jay Libove, CISSP
Atlanta, GA, US

 

[Bill Sanderson MVP]

A couple of folks have hacked the registry to add paths to the exclusions
listed in that box. That has a number of risks, too, and it takes
significant effort--you have to add yourself to permissions on the key and
then remove afterwards, for safety.

The thread is in .general, and involves "techie007"--so if you search for
messages from that sender, you should find it. This is not something I'm
prepared to give further help with--so if it looks daunting---I'd steer
clear.

I'm not certain that the current functionality (not allowing paths) is the
final design. It'd be worth revisiting if the UI portion of the program is
updated at some point.

--

 

[Guest]

Thanks Bill. I don't find editing the registry daunting. I find the need to
edit the registry to fix a problem in a user interface brought on by a
problem in the core functionality of a product, however, to be of real
concern

The more important question is: any idea why WinDefender is continually
detecting "changes" in these .lnk files, when in fact they have not changed,
and the user has already explicitly allowed the .lnk's in previous go-rounds
with WinDefender?

Can we be assured that Microsoft's (Giant's?) engineers are aware of this
problem and will fix it?

Thank you
-Jay Libove, CISSP

 

[Bill Sanderson MVP]

The question of why the continual re-detection I don't know the answer to.
I can say that I've never seen it, on about 50 machines of various ages and
speeds, all either XP Pro SP2, Windows 2000 SP4 Server, or Windows 2000 SP4
Professional.

I can't speak to the Microsoft awareness either--these groups do get combed
by the development team, so I'd assume so, but I haven't had any direct
discussion, nor do I recall seeing any thread involving this issue with a
[MSFT] participant.

I do wonder whether there's some third-party software involved in
this--perhaps an antivirus, or some other "protective" software which causes
some change that creates the redetection?

Any chance you could compare files, one day to the next, using a tool like
this:

http://www.microsoft.com/downloads/...58-31B7-47E2-A663-7365C1686C08&displaylang=en

(another bit of functionality that used to be in Microsoft Antispyware--I'm
not sure it is gone, but this is easier to point to.)

It might be good to see if you can get the attention of the two other folks
that had this issue--techie007, and there was another person who I led back
to his work--and maybe compare brief notes about software? Whether or not
the UI functionality can be changed is definitely a Microsoft decision, but
this continual re-detection may be something that needs either cooperation,
or at least a clearer understanding of the why.


--

 

[Guest]

Well, just Damn. Bill, thank you for suggesting checksumming the .lnk files
which WinDefender "claimed" were changing. In fact, they are changing. (I
used 'cksum' from CygWin - couldn't live without CygWin!).

Now the question becomes - WHY are they changing?

Can someone please point me to a description of the content of a .lnk file
so I can see WHAT is changing, then maybe I can figure out the why? (Yes, I
know I'm being lazy by asking, sorry, thanks).
-Jay

 

[Bill Sanderson MVP]

..lnk files are just shortcuts you can create yourself by right clicking an
object and chosing creat shortcut. You can edit their properties, but
there's nothing dynamic about them, normally.


--