WD and Sophos problem

[Jerry Vaughn]

Windows Defender has recently been "detecting" that the Sophos
InterCheck has been added to StartUp. I can "allow" it but after every
Sophos update, back it comes. "Allow Always" is not a choice. Below is
an extract from WD's log.

Ideas?

Jerry

Resource Schema:startup
Resource PathxxxxxC:\Documents and Settings\All Users\Start Menu
\Programs\StartUp\InterCheck Monitor.LNK
Threat Count:1
Threat Name:Unknown
ID:2147483646
Severity:0
Number of Resources:3
Resource Schema:file
Resource Path:C:\Documents and Settings\All Users\Start Menu\Programs
\StartUp\InterCheck Monitor.LNK
Resource Schema:file
Resource Path:C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
Resource Schema:startup
Resource Path:C:\Documents and Settings\All Users\Start Menu\Programs
\StartUp\InterCheck Monitor.LNK

 

[Bill Sanderson MVP]

Do you have Defender set to alert you to changes to the system from known
programs?

 

[Jerry Vaughn]

If you mean "Changes made to your computer by software that is allowed
to run", no.

I believe this started when I updated to the last release but do to a
couple of other fires I had to put out, I'm not sure.

Jerry

 

[Jerry Vaughn]

Do you have Defender set to alert you to changes to the system from known
programs?

Nope - Jerry

 

[Bill Sanderson MVP]

Sorry to hear that--that would have been easy...

I think I'd try going for excluding the .lnk file by going to tools, options
(or general settings, depending on version), scroll down to advanced
options, and hitting the ADD button on the right of the big open rectangle.

I'm not at all sure this will do the job--some vendors seem to recreate this
link on each startup, which Defender will catch.

--