WD system change made

[Guest]

I have wd and wloc i use xp(sp2)
WD version: 1.1.1543.0
Engine Version: 1.1.2405.0
Definition Version: 1.17.2528.1
Wloc version: 1.5.1890.34
virus& spyware definition version: 1.17.2527.2
Firewall Policy Version: 1.2.15.77
Every time I turn on my computer wd is off I turn it on and within minutes I
get a message from Wd saying " A system change has been made by a known
applicatio
Cange type: Application Registration
Application: C:\program files\windows Defender\mpcmdrun.exe
WD stays running fine but the next time I start up it is turned off again.
I have a desk top and a laptop and they both do the same.

 

[Guest]

This has been well documented on these newsgroups and will happen if you have
both WD and WLOC installed. The latter has its own integral AS scanning
engine and defs and so there is no need to have WD installed if you have WLOC.

Stu

 

[Guest]

Hello tazman06,

An application registration change has been made for a known application file

C:\program files\windowdefender\MpCmdRun.exe


This is probably happening because you have the box checked to notify you

about " Changes made to your computer by software that is allowed to run ".


For the benefit of the community reading this post, please rate the pºst.

I hope this post is helpful.

Let us know how it works ºut.

Еиçεl
-

PD I will follow Stu observertion.

 

[Bill Sanderson MVP]

Doesn't matter whether OneCare is there or not---just checking the box to be
notified of changes made to the system by permitted apps.

The change that is being notified here is the re-scheduling of the daily
scan.

You should see one such balloon for every profile on the system, I think.

--

 

[Guest]

I take your point, but in his post Tazman06 does seem to be wondering why WD
was turned off on reboot or startup and I was merely pointing out why this is
likely to happen. Which brings me to the point: Why would one want two apps
installed on your system which are supposedly designed to achieve the same
objective from the same vendor? Or, does WLOC employ different technology to
that of WD to the point the former is likely to indentify malware that the
latter will not and vice versa? If it does, that would concern me -
particularly as WLOC (which you pay a subscription for) will negate WD which,
of course, is free.

Stu

 

[Dave M]

I believe the reason for the WLOC users wanting to keep the Defender
standalone is that the way the antispyware component of OneCare was
implemented removed the Software Explorer functionality, so in order to
retain that capability they can bring up standalone Defender and still
access the tool. Other than that, there's no great reason for WLOC users
to maintain standalone Defender that I can see.

What I do wonder about is that standalone Defender at one point detected
some Trojan like activity which apparently got moved to the AV component of
OneCare, so can we assume that the detection and perhaps removal capability
was deleted from standalone Defender as well? That probably needs some
Microsoft clarification. What I haven't seen is a rash of complaints here
though, so I'm unclear as to what was actually done... The obvious example
is Virtumonde.G which was originally added to Defender sigs in May of
2006... Is it still there or has that gone to the AV side?

 

[Guest]

Good points Dave - on both accounts. Which is why I have been a long time
advocate of MS publishing what WD (and WLOC) for that matter, is supposed to
protect us from and how it sees the categories of threat. I only hope there
is some consistency between the two. Bill`s recent URL of the MS portal is a
step in the right direction. It does become very confusing and unclear
sometimes.

Stu

 

[Guest]

Thanks to all for your help. To answer your question Stu I had a virus at
one point and wloc did not detect it but after wd was installed it found it
and removed it. I know of others that have had viruses that they couldn't
get rid of. They tried wloc,mcaffe, and norton none of which could detect it
but wd fund it and removed it

 

[Guest]

Many thanks for the information Tom - very interesting.

Stu