Message

[Guest]

Hi, all of you.
At every start of Windows I get the following message.
Which is the real meaning and how can I get rid of it.
____________________________________________
Application Registration change occurred.

This agent monitors the various ways which allow a program, script, or
executable to be started independent of an application.

Path:
C:\Programmi\Windows Defender\MpCmdRun.exe

Detected changes:
file:
C:\WINDOWS\tasks\MP Scheduled Scan.job

file:
C:\Programmi\Windows Defender\MpCmdRun.exe

taskscheduler:
C:\WINDOWS\tasks\MP Scheduled Scan.job

Advice:
Allow this detected item only if you trust the program or the software
publisher.

Publisher:
Microsoft Corporation

Digitally Signed By:
Microsoft Corporation

Product name:
Windows Defender

Description:
Windows Defender Command Line Utility

Original name:
MpCmdRun.exe

Creation date:
03/04/2006 18.12

Size:
248528 bytes

Version:
1.1.1347.0

Type:
application

Checkpoint:
Task Scheduler

Category:
Not Yet Classified

____________________________________________--
Thanks.
ErrePi

 

[Dave M]

You can look at the third thread below this one, specifically Bitman's
reply, or many other discussions throughout this forum using the search
function.

From: AlanD
Subject: Switching on RTP again - but how to deal with alerts?
Date: Sat, 22 Jul 2006 01:30:02 -0700
Newsgroups: microsoft.private.security.spyware.general

 

[Guest]

Thank you, Dave
I have read other posts,
but I have _not_ the option 'Changes made to your computer by software that
is allowed to run' enabled, and this message is displayed.

Can anyother else help me?
Thanks, thanks and best regards

 

[Dave M]

ErrePi;

Make sure you look for and use the scroll bar on the right of the Options
Screen to scroll down and find that option. If you shut it off by
unchecking it you might have the experience of having many System Restore
checkpoints created daily which are named Windows Defender Checkpoints.
Each is of substantial size.

To see the points,
Start > Programs > Accessories > System Tools > System Restore
Check radio button "Restore my computer to an earlier time" , then Next
Click individual Bold dates on the calendar to see the checkpoints, when
through click "Cancel" to exit.

That may or may not be what you want, you'll just have to look at the
effect of making this change... and knowing what to look for is the key
item here. I'd rather live with the warning balloon messages myself, since
I know what they are, and that they are harmless at startup. MicroSoft was
looking into changing this behavior, but that could take a while (said with
a

 

[Guest]

Dave M.; thank you for your replies.
I asked for a problem and found another one.
This is the situation:
I get the message
"An application Registration Change was made for a known application file:
c:\program files\windows defender\MpCmdRun.exe."
if the box is checked or not in 'options' about notifying you of
'changes made to your computer by software that is allowed to run'.
If that box is unchecked I get a system checkpoint at each system start.
See also Bug Report 7/23/2006.
Regards.

 

[Dave M]

Take a look at the thread down three threads, Bitman's suggested
explanation
seems reasonable enough to me, particularly the part about changing the
scheduled task date flagging an alert from WD, this would be an example of
Behavioral based detection as opposed to Signature based detection, so I'm
supposing that you have the Use Heuristics box checked in options as well
as the
Notify about software that's allowed to run. Am I correct about these
checkboxes? :

From: AlanD
Subject: Switching on RTP again - but how to deal with alerts?
Date: Sat, 22 Jul 2006 01:30:02 -0700
Newsgroups: microsoft.private.security.spyware.general