Windows Defender Checkpoints?

[Daze]

I've just noticed that, since reinstalling Windows Defender a couple of
days ago, my System Restore is now making "Windows Defender
Checkpoint"(s), instead of "System Checkpoint"(s). Can someone explain
if there is any difference between the two, and if not, why are these
latest restore points seemingly being associated with Windows Defender?
Their creation dates have no relationship to scans or any other
activities of Windows Defender that I'm aware of.

 

[Bill Sanderson MVP]

I've noticed this on my own system, with Windows Defender still installed.
I get only the usual restore points--one a day, or for installs--but they
are labelled Windows Defender. This looks worth bugging.

Do I recall that your uninstall did not go smoothly?

 

[Daze]

I've noticed this on my own system, with Windows Defender still installed.
I get only the usual restore points--one a day, or for installs--but they
are labelled Windows Defender. This looks worth bugging.

Do I recall that your uninstall did not go smoothly?

Previously, my uninstall went smoothly EXCEPT for the fact that I was
left with a WD signatures update in my Add/Remove Programs, which I was
only able to finally get rid of through some judicious registry editing.
Then I reinstalled WD, which updated easily for the first time ever, but
now I notice my restore points are all called Windows Defender checkpoints.

 

[Tom Emmelot]

Hi Daze,

From Dr. Bill & Steve Dodson
------------------------------------
Steve Dodson has posted a registry edit to change this behavior, which
isn't seen on all machines--let me find it:
----------
In the registry editor,

Create a "REG_DWORD" Key named "DisableRestorePoint" and set it to TRUE
under the following location in the registry.

HKLM/Software/Microsoft/Windows Defender/Scan/
--------------------------------------
This needs a little interpretation:

1) find the location named above.
2) Highlight the Scan object, and right click it, choose permissions, and
give your user FULL.
3) create a value as instructed above, and set it to "1."
4) reverse your action in 2)--uncheck Full for your user.

 

[Bill Sanderson MVP]

OK - just checking! I don't know what's going on here. I'll report my
restore points as a bug and see what happens.

My guess is that this is a bug--a beta issue--but I'm not sure how to
resolve it in a situation where the beta has been uninstalled. Might
involve another reinstall/uninstall with fixed code.....

--

 

[Bill Sanderson MVP]

Nuts--so--today I look at it and I have precisely ONE Windows Defender
restore point. That one is beginning of the day which is a bit odd, but all
the others have normal labels, so I guess I have nothing to report at this
point.


--

 

[Bill Sanderson MVP]

Maybe worth trying--but since he has uninstalled Defender, it surely
shouldn't have any effect?

--

 

[Tom Emmelot]

Hi Bill,

I think your was to long in the pool!

I quote Daze first message:
I've just noticed that, since reinstalling Windows Defender a couple of
days ago, my System Restore is now making

Regards >*< TOM >*<

Bill Sanderson MVP schreef:

 

[Bill Sanderson MVP]

Ahh--OK - maybe I am confused. Hot day. Did get into the pool but only did
two laps, lots of people there, and I'm reading a good book. Will go back
late in the evening and get in a few laps before it closes at 10 PM.

--

 

[Tom Emmelot]

Hi Bill,

wait a bit for the pool!

Test this:
Make a map c:\toolbar
make with notepad a file with some xxxx and name it toolbar.dll, put it
the map.
Then make from the toolbar.dll also a zip in the same map.
Run a full or customized or Quick scan.
You get a high warning "IBIS toolbar",
about the toolbar.dll
but nothing about the zip !!!!!
You also have a new restore point!

Regards >*< TOM >*<


Bill Sanderson MVP schreef:

 

[Daze]

Hi Daze,

From Dr. Bill & Steve Dodson
------------------------------------
Steve Dodson has posted a registry edit to change this behavior, which
isn't seen on all machines--let me find it:
----------
In the registry editor,

Create a "REG_DWORD" Key named "DisableRestorePoint" and set it to TRUE
under the following location in the registry.

HKLM/Software/Microsoft/Windows Defender/Scan/
--------------------------------------
This needs a little interpretation:

1) find the location named above.
2) Highlight the Scan object, and right click it, choose permissions, and
give your user FULL.
3) create a value as instructed above, and set it to "1."
4) reverse your action in 2)--uncheck Full for your user.

OK, done. (Good instructions, BTW, Tom. I am confident that I followed
them correctly.) Now we'll just have to wait to see whether or not I
start getting the normal daily System Checkpoints again instead of the
abnormal Windows Defender Checkpoints.

I wonder why I'm having all these unusual problems related to my use of
Windows Defender? I'm running a recently installed copy of XP Pro on a
good Pentium 4 system only 3 or 4 few years old . . .

 

[Tom Emmelot]

Hi Daze,

i am fouling around with Defender and as result many checkpoints, so i
must do the same!
See my last test in this treat.

Regards >*< TOM>*<



Daze schreef:

 

[Daze]

Hi Daze,

i am fouling around with Defender and as result many checkpoints, so i
must do the same!
See my last test in this treat.

Regards >*< TOM>*<

I turned off my System Restore, which deleted all of my "Windows
Defender" Checkpoints. Then I turned it back on, which created a new
"System" Checkpoint, which is a good start. But now I'll just have to
wait to see whether or not my System Restore is completely back to
behaving normally.

 

[Bill Sanderson MVP]

Thanks---will try that later tonight--sounds like a good one for the folks
asking how they tell if Windows Defender is working.

--

 

[Bill Sanderson MVP]

I turned off my System Restore, which deleted all of my "Windows Defender"
Checkpoints. Then I turned it back on, which created a new "System"
Checkpoint, which is a good start. But now I'll just have to wait to see
whether or not my System Restore is completely back to behaving normally.

That would be an excellent and simple fix, if it works.

 

[Daze]

That would be an excellent and simple fix, if it works.

Yep. We'll see. ;-)

 

[Tom Emmelot]

Bill Sanderson MVP schreef:

Thanks---will try that later tonight--sounds like a good one for the folks
asking how they tell if Windows Defender is working.

Hi Bill,

The reason I point this that it is not working!!!
Find the toolbar.dll
But NOT in the RAR or ZIP file!!!!
And thats ON in Tools>options!!!

So what about scanning Archived files???

Regards >*< TOM >*<

 

[Bill Sanderson MVP]

Hmm - doesn't sound right--didn't get to it last night--will try again
tonight.

--

 

[Daze]

Hi Daze,

From Dr. Bill & Steve Dodson
------------------------------------
Steve Dodson has posted a registry edit to change this behavior, which
isn't seen on all machines--let me find it:
----------
In the registry editor,

Create a "REG_DWORD" Key named "DisableRestorePoint" and set it to TRUE
under the following location in the registry.

HKLM/Software/Microsoft/Windows Defender/Scan/
--------------------------------------
This needs a little interpretation:

1) find the location named above.
2) Highlight the Scan object, and right click it, choose permissions, and
give your user FULL.
3) create a value as instructed above, and set it to "1."
4) reverse your action in 2)--uncheck Full for your user.

Good news! My System Restore just automatically made a new "System"
Checkpoint today (rather than a "Windows Defender" Checkpoint), so it
looks like Steve Dodson's registry tweak did the job and all my (known)
WD-related problems are (for at least the moment) solved!

 

[Tom Emmelot]

Hi Bill,

that toolbar.dll is only detected if it is in the toolbar map!!
So maybe it is also not detected in the ZIP/RAR where i put the
toolbar.dll for the same reason. ( not really a toolbar.dll)???

I must repair my Windows Update again, than i got the new updates
normally, but i don't know what the Windows Update put out of order!

Regards >*< TOM >*<

Bill Sanderson MVP schreef: