Windows Defender tells, that System Configuration Change has occur

[SlowArrow]

Dear Defenders;-)

Playing anything from the BBC News Player, which was configured here to use
the MS Media Player causes to produce a notification as below all the time
(for example, for
http://news.bbc.co.uk/player/nol/ne.../7285927.stm?bw=bb&mp=wm&asb=1&news=1&bbcws=1)
As far as I remember, this happens from the borning of the defender program,
it does not occur with its predessor. It does not occur by playing anything
from an other site. I use Windows XP very updated, IE 7, Office 2007, and
there are some ms development tools installed. I've joined the MS Spynet with
an advanced membership. Is there anything wrong with my computer (which can
happen, but I checked with a few antivirus, antitrojan, etc legal tools,
without errors), or there is a reason, the defender can't make a rule for
such kinds of events.

Thanks for your explanations ahead,

SlowArrow

The notification of the Defender program follows:

Summary:
System Configuration change occurred.

This agent monitors security related configuration changes made to Windows.

Detected changes:
New: 2584:UDP:*:Enabled:Windows Media Format SDK (iexplore.exe)
Original: Not available

firewallport (New):
HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\2584:UDP

Advice:
Permit this configuration change only if you trust its origin. It is
recommended that you run a quick scan if you choose to deny this change.

Checkpoint:
Firewall Port Exceptions

Category:
Configuration Change

 

[Bill Sanderson]

I think that you have enabled the checkbox for "notify me of changes made to
my system by known programs." or some similar wording--sorry, I can't look
that up easily at the moment.

There's no harm in doing so, of course--and you will see some interesting
notifications when you install software, for example.

If this notification bothers you, uncheck that box in tools, options.
Scroll down--I think it is near the end.

 

[SlowArrow]

Dear Bill!

Thanks your answer!

Yes, I know, there are options to switch the checking of the system changes
off, but I wouldn't like to do it, because of the reason, you mentioned.
However, this popup, which appears each and every one playing a newscast from
just _that_ site is very inconvinient and disturbes me quite much. Perhaps,
there is something wrong with that site, or they use a never published
feature, I don't know. This is why I ask the developers or some guru's of the
subject to check the problem. There should be a solution, at least in the
form of an exception, if not in this version of the defender, then in the
next.

Or, the problem is in my mashine, which may happen...;-)

Regards,

SlowArrow

 

[Bill Sanderson]

Thanks - that's useful feedback. I'm not sure whether Microsoft still reads
these groups looking at product usage issues, but they may well do so--and
that will be helpful, perhaps.

I can't easily test your link, but I'll see if I can do so at some point--I
have server 2003 machines with Defender on them, but very few XP machines,
and IE is locked down on the 2003 machines.

I suspect that rather than doing something improperly, the player is just
opening a port on the fly--this is pretty typical behavior for Windows Media
Player, I think--and it is a good thing to be notified about--if some
program that you were unaware of, or which you had knowingly installed, but
did not expect to be communicating with the outside world, opened a port on
the firewall, you'd want to hear about it.

 

[Kkaiser1]

Tested the link you provided, on an XP sp2 machine. Did not get an alert from
Defender.