WD and Sophos

[Jerry Vaughn]

Am I the only one having trouble with WD objecting to Sophos's update
procedure?

I published the WD log earlier so here is the event log entry if that
will help.

There has to be a way to add to this to the always ignore but I can't
find it.

Jerry


Windows Defender Real-Time Protection agent has detected spyware or
other potentially unwanted software.
For more information please see the following:
http://www.microsoft.com
Scan ID: {5783E602-7AD3-4BBA-B1E3-AEC654FD2C5B}
User: JERRY-TCPP\jwvaughn
Name: Unknown
ID:
Severity ID:
Category ID:
Path Found: file:C:\Documents and Settings\All Users\Start Menu
\Programs\StartUp\InterCheck Monitor.LNK;file:C:\Program Files\Sophos
SWEEP for NT\ICMON.EXE;startup:C:\Documents and Settings\All Users\Start
Menu\Programs\StartUp\InterCheck Monitor.LNK
Alert Type: Unknown
Detection Type:


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Bill Sanderson MVP]

If you don't want to be notified about "unknown"s, I'd recommend unchecking
the setting in tools, options, real time protection options "software that
has not yet been classified for risks" (and, perhaps, choosing basic over
advanced Spynet membership level.)

 

[Jerry Vaughn]

I really would like to know about unknowns BUT Sophos? When the anti-
spyware is complaining about one of the top anti-virus programs you have
to wonder what is going on!

I realize there is some risk in adding an "always allow" but which is
worse? Adding that risk or putting my head in the sand and ignoring the
warnings about unknown by turning them off.

Jerry

 

[Bill Sanderson MVP]

I hear you--and there are some similar issues with other antivirus apps. I
suspect that some of these, at least, are beta issues--things that will get
settled between the vendors, but perhaps not until Windows Defender goes
gold--if the third party needs to make a change, they are likely to want to
wait and make that change once, when the beta is no longer a moving target.
If Microsoft needs to make a change, that may be awaiting available time on
the part of the development team to get to those details--which may not
happen until later in the development cycle.

I hear you on the annoyance factor, and it is important to post this stuff
here, so that the developers have an alert about the issue--but in the end
you may need to provide your own workaround--either via an exclusion (and
I'm not sure that works for this case)--or, ultimately, removing the beta if
the annoyance factor is too high. What I don't know is how Spynet voting
figures into this--I'm sure the more votes the better, but we may be
awaiting a critical mass of users, to get enough votes in.

--