MS Anti-spyware

Except it's now MS Defender beta 2


http://www.microsoft.com/athome/security/spyware/software/default.mspx



Thank you
Ian

So-o-o-o-o.......what does this mean? Uninstall MS AntiSpyware and download MS Defender beta 2? Install Defender over the top? Don't do
anything cause' it's too soon?

Edit : I took the plunge anyway...installed over the top...it wipes
out MS AntiSpyware...did the first scan in about 3 mins.

DavyWavy -

I have the real time protection on but there is no icon in the systray like the other version had..Is it supposed to have an icon or not? Thanks.







Dell Dimension 4550,Win XP Home SP2, 2.4 GHZ P4, 512MB DDR PC2700 Ram, ATI Rage 128(32MB),Cable
Dell Inspiron 5160,XP Home SP2,2.8 GHZ,512MB Ram,32MB Video

No icon in my tray until scan...

DavyWavy -

>No icon in my tray until scan...

That's annoying isn't it, it's nice to know it's loaded at startup correctly.

Also, I can't find a way to manually check for sig. updates (may not be necessary!)

From the Help section.....

>From the Help section.....
>

>Edit : I took the plunge anyway...installed over the
>top...it wipes out MS AntiSpyware...

Yeah but it doesn't clean up/delete folders in \Program Files

There are good FAQ's on that page. For one thing it says that MS Defender will remain a free program after it is out of beta.

Shelly

I installed it, uninstalled MSAS first, and I have an icon for MS Defender in the tray, its a grey castle.

There area number of settings you can change under Tools. I ran a scan after updating the definitions, and it found and removed a trojan called "Broadcast Urban Tuner" that had been previously undetected.

http://research.sunbelt-software.com/threat_display.cfm?name=BroadcastURBAN%20tuner&threatid=6093

Shelly

>I installed it, uninstalled MSAS first, and I have an icon
>for MS Defender in the tray, its a grey castle.

I saw the grey castle but only whilst it was scanning. That's odd.

Me too. I certainly don't like it's appearance and it took about 30 mins to do a full computer scan.

Should I deactivate RealTime protection first ? before uninstall .

Jane

Thats done automatically when you run the uninstall.

Shelly

Thank you Shelly !

Jane

I uninstalled first. The castle icon only showed when it was updating the program, and went away during the scan. The scan was 7 and 1/2 minutes.

Ed W.

Mine is the same way.....The castle is only in tray when updating...Not scan. So is it running live even thou no icon in tray? Thanks.






Dell Dimension 4550,Win XP Home SP2, 2.4 GHZ P4, 512MB DDR PC2700 Ram, ATI Rage 128(32MB),Cable
Dell Inspiron 5160,XP Home SP2,2.8 GHZ,512MB Ram,32MB Video

My icon went away too after I rebooted to install the monthly security updates. And yes, it still gives real time protection without the icon present.

Shelly

Gee Shelly,I didn't think you installed beta programs

LilJoe

Wasn't it you that once said "All Microsoft programs are betas"?

Jim.

It's not really a beta since it's an update of the program they acquired in the purchase of Giant Software.

Shelly

Yeah, well...

According to this, that was last week and was later rectified by Microsoft, it was probably that day that we had two updates.

Yep, it's fixed.
http://www.informationweek.com/security/showArticle.jhtml?articleID=180200780&subSection=Viruses+and+Patches

I've got the new program on two machines (XP Pro and XP Home). I uninstalled MS Anti-Spyware first, deleted the program files folder, did a RegSeeker scrub, rebooted and installed. No problems. An initial quick scan took 7 1/2 minutes and found nothing. With Avast, Sygate Personal Firewall, Windows Defender and Firefox, I'm feeling pretty safe (and frugal).

Yeah, I also kind of liked the old program's ubiquitous "bull's-eye" icon in the taskbar to let me know it was running, but oh well... The times they are a-changin'

Customers running Symantec's consumer products, Norton Antivirus and
Norton Internet Security, are not impacted by this issue. This issue
also does not affect customers using Symantec's software alongside
Microsoft Windows Defender Beta 2 either in Windows XP or preview
versions of Windows Vista.

Customers running Symantec Antivirus (SAV) Corporate Edition versions 7,
8, 9 or 10 or Symantec Client Security (SCS) versions 1, 2 or 3 in
combination with Windows AntiSpyware Beta 1 could be impacted by this
issue. The beta software will prompt and allow the user to remove a
registry key containing subkeys belonging to these Symantec products.
The deletion of these registry keys will cause all versions of the SAV
and SCS software to stop operating correctly. No files are removed in
this situation, only registry keys.

Once this issue was discovered, Microsoft quickly released a new
signature set (5807) to remove this false positive. Both companies are
working jointly together to identify the number of affected customers,
which we believe to be very limited.

Microsoft and Symantec have worked jointly on an automated tool to
repair installations of Symantec's software that were affected by this
issue. This tool is available at no charge from Symantec Product
Support Services.

Evidently it's really a beta now, since MS worked on it.

Unistalled MSAS, installed the new Win Def. The icon for it appeared instantly in the Tool Tray after it installed. It took two tries to get the updates download to start, but they're coming in now.

I no longer get the grey castle icon in system tray

My startup manager has a the following command:

“Program files\Widows Defender\MSASCui.exe” –hide

If I take the hide out of the command will the icon then show up in my system tray?

For quick access to the ap, I pinned it to my Start menu. Less clutter in my system tray.

Nope, I just tried it. All that does is open the apps status window when you boot your computer.

MSU

I also noticed that icon was not in my Tool Tray this morning and checked to processes to see if it was running. MSASCui.exe was there.

I can't find an option within the program settings to either allow or hide the icon, and I don't think that it's really needed anyway because there isn't any menu item or tool in the program that allows you to manually check for updates. I did see the Security Center shield in the tool tray when I logged on and something downloaded. It wasn't the monthly security updates, so my hunch is that Win Def automatically checked for updates at logon like my antivirus program does. I think that icon will appear when it needs attention. Otherwise, it's in the background.
--

Reading through the FAQs on this new program doesn't yield much about how the program is updated. There is only a mention of automatic updates and that's it, no other information. I did send feedback to Microsoft about it.

>I can't find an option within the program settings to either
>allow or hide the icon, and I don't think that it's really
>needed anyway because there isn't any menu item or tool in the
>program that allows you to manually check for updates.

Quote:To check for new definitions manually
>Open Windows Defender. (Click Start, click Programs, and then
>click Windows Defender.)
>Click the Down arrow next to Help, and then click About
>Windows Defender.
>In the Windows Defender dialog box, click Check for Updates.

Thanks. They really buried that one, and I can't find any information in the help files or the programs web site about that.

Attachment #1, (jpg file)

Right, but I thought everyone was looking to get the castle icon to show in the system tray area so they could be sure at a glance that it was indeed running.

MSU

Am I correct in assuming that the consensus of the forum that I (we) should use this program even though Ms antispyware doesn't expire until 7-31-06? Will updated definitions continue for MS antispyware

it said on the site that present users of MSAS would receive a notice to update to MS Defender.

Shelly

Am I to download both of these files as it says download the files that are appropriate to me?:

File Name: File Size
WindowsDefender.msi
6.4 MB

WindowsDefenderX64.msi
7.9 MB

I have WinXP sp2.
Thanks,

Edit: I'm assuming since I have "home" edition that I would choose the first file : WindowsDefender.msi?

Adirondack Girl

No, only one of them.
WindowsDefenderX64.msi is for the 64-bit version of Windows XP.

You want this one...
WindowsDefender.msi
6.4 MB

Thanks Darren, that's what I thought but I wasn't sure.

Edit: Installed fine. I like it! I really like the "Tools" section "Software Explorer". Finally helped me figure out how to disable an annoying message at startup(that I received occasionally) and where it came from in the first place .

Adirondack Girl

I ran the update, but I didn't see a status of what was happening. I show Windows Defender Version 1.1.1051.0, Engine Version 1.1.1185.0, and Signature Version 1.13.1272.4.

Are these the current updates everyone is seeing? Is there any indicator that an update has been completed?

Mine is Signature Version 1.13.1276.3

edit: It says that there is no later update available.

Same here. So far, so good for me. I just do the updates manually.

Edit:Windows Defender vs. 1.1.1051.0
Engine vs. 1.1.1185.0
Signature vs. 1.13.1276.3

Adirondack Girl

The only way I got mine to update was to open Add/Remove Programs. Then I chose to change and update Windows Defender. Finally it updated for me. Nothing else seemed to work and I tried them all.

When I receive the message to update, it downloads the update, starts to install, then I get the following message:



Now I'm getting this:



Maybe I should uninstall and start over.


Edit: Uninstalled/reinstalled and Defender now reports the following:

Windows Defender Version: 1.1.1051.0
Engine Version: 1.1.1185.0
Signature Version: 1.13.1276.3

Attachment #1, (jpg file)
Attachment #2, (jpg file)

I got nothing. There was some jibberish in Event Viewer.

I get 2 warnings in my EventViewer ! WindowsDefender targets Everest driver (every time I open Everest ) & uphcleanhlp driver (at the shutdown) as a malware . MSAntispyware never did that . It doesn't pop-up , just shows the warning in the EventViewer-System .

Jane

I have "Defender" installed on my wife's PC, not mine so the following pertains only to what I saw on that one machine. I saw an "Automatic Update" icon in the SystemTray and thought it was rather odd since all the recent Windows Security updates were already installed on Tuesday. So, when I clicked on the balloon tip I was surprised to see that the update was for "Defender".

This raises some important questions in regard to updating Defender's "Definitions":

1) Are the updates for Defender now integrated with Windows Automatic Update?

2) If so, then this would mean that unless you have "Automatic Update" configured to automatically download and install new updates, it will require user input to get them.

BTW, when I checked for new updates through the "Help/About" section, I got the "Failed to install" error message like the others reported. New updates were dated 1/13/2006, but that is the date for the currently installed updates.

Jeff
simul iustus et peccator

There are definitely problems with this beta.

Visit the Basement

Well, I hesitate to say it, but mine installed and works fine...so far...

DavyWavy -

I have automatic updates turned off and I update manually. Why doesn't this program require my permission to go through free ZA firewall to look for updates? I can't remember whether the previous version asked but this version doesn't. SpywareBlaster, Ad-Aware and Spybot all ask.

I would think it has to.

Review your settings in ZA - Program Control | Programs & see if it is allowed in there.

If it does not show in there, then maybe it's actually using an IE interface to the Internet. And if you allow IE, then by default you're allowing Defender.

Disallow IE, then try a manual update of Defender & see if you're prompted.

That's probably the answer because I haven't given the program itself access.

I haven't either , Noreen . And it did not ask !
I got a pop-up from Windows Updates this morning . It was for WinDefender definitions . I let it install but the defs version is the same that I already had . On all 3 comps .

Jane

Look in Help/About Windows Defender to see what definitions you have installed.

Shelly

Version is the same , Shelly .

Jane

That is the latest version of the signatures.

Shelly

You more than likely have granted access in ZA to "Generic Host Process for Win32 Services" which is where Windows Defender gains access on my computer. You may also be asked to allow access to "User Interface".

Jim.

It shows up in ZA as User Interface:

Attachment #1, (jpg file)

It shows up in ZA as User Interface:

Attachment #1, (jpg file)

Doesn't show-up in mine . I use ZApro 4.5.594 . Nothing for WindowsDefender shows up !

Jane

I'm using ZA Pro also, but my version is 6.1.737.000. I wonder why we have different versions?

Jim.

>I'm using ZA Pro also, but my version is 6.1.737.000. I
>wonder why we have different versions?
>
>Jim.
------------------------------------------------------
because you have updated and she has not

LilJoe

An annoyance with the program is that it keeps finding the same program (Slipstream) and asking me to allow or to block it. It doesn't have an "always allow" selection that I can see. Consequently, everytime I access the internet it comes up again. (Slipstream is a web accelerator program from my isp for dial-up).

>An annoyance with the program is that it keeps finding the
>same program (Slipstream) and asking me to allow or to block
>it. It doesn't have an "always allow" selection that I can
>see. Consequently, everytime I access the internet it comes up
>again. (Slipstream is a web accelerator program from my isp
>for dial-up).
------------------------------------------------------------
Did you right click it and select Trusted?

LilJoe

No. Under "Review Detected Changes" there is no right click function but there is a box one can select for "Action" specifying "Allow" or "Block". You click "Allow" and it says "Succeeded" but then the same alert comes back after detecting the program again when I once again connect to the internet.

Exactly ! I'm looking for some setting to let me set ignore . I get these warnings in Event viewer, everytime I open Everest , or @ startup for uphcleanhlp . I would like to be able to set it to ignore I turned the notification alerts on , in hope that I could change it to ignore or trusted. No such setting . All you can do is Allow or Block .

BTW , Noreen , full scan takes 49 minutes on my desktops and 1 hr on the laptop .

Jane

The previous version didn't take so long.

A full scan took 14 minutes for me.

Shelly

I wish !

Jane

Me too! Shelly must be running some kind of bare bones system.

Attachment #1, (jpg file)

It shows up in the Programs listing of Zone Alarm as "User Interface" with the castle icon. I do remember that I had to allow it with ZA on this system, and Windows XP firewall on another system.

Are the updates for Defender now integrated with Windows Update?


Yes - fully. I have Windows Update set to "Notify" and the Defender updates come through exactly as standard Windows Updates.

It recommends that you run the scan daily and reminds you of it !24 hrs later , very punctual But when I click the "Start Scan" button I get invalid pointer error . Anyone else gets this ? I get it on all my comps . Have to click "Scan options" up in the menu to start the scan .

Jane

Yes, same thing happens here and must go up to "scan" in menu as you noted.

Adirondack Girl

Problem I am having with it is it always requires a re-start after it finds something. Here's the message:

"A reboot is required to fully clean your system."

This I don't need

It has cleaned several things from my systems and never required a restart, although I can see it needing to restart if you have to remove something that is already running in Windows, so I think you did need it, badly.

The autonatic updating is working, since I have the latest update on all machines.

Shelly

>It has cleaned several things from my systems and never
>required a restart, although I can see it needing to restart
>if you have to remove something that is already running in
>Windows, so I think you did need it, badly.
>
>The autonatic updating is working, since I have the latest
>update on all machines.

I have it doing a scheduled scan at 2:00 AM with only AV and firewall active. The last time it got the message it didn't give me the option to see what it wanted to clean. Just the reboot message. Maybe I'l do a reinstall.