Which idiot came up with Windows Defender * UAC

[Carol Haynes]

Is anyone REALLY frustrated  (like me) about the behaviour of Windows Defender?

Having been using Windows Vista on my laptop for a while now I had not noticed any particular issues so I decided to give Windows Defender another try on my office desktop running Windows XP Pro.

Everytime I start up Windows stupid Defender blocks a number of applications from starting - including business software supplied to me by my Bank (and written by one of the better known business software companies) - until I give permission for it to run.

There appears to be no mechanism to add the applications to the allowed list so I am faced by a set of tasks every time I switch on my computer!

I looked online and the only way to add anything to the allowed list is to respond to a popup but these blocked apps don't produce the required pop up duing startup (and if I exit them and start them manually they work fine).

Windows Defender has gone from my system now - but why on earth would anyone write such a stupid piece of security software.

I haven't looked - does anyone know if you can disable this behaviour in Windows Vista (and 7 when it emerges)?

Also UAC stops the simple seach tool "Everything" from being run at startup in Vista  !!! The only way I could get it to start with the computer was to set up a scheduled task that runs at logon with full admin rights - how stupid is that ... again no 'allowed' or 'exceptions' list.

[lanux128]

wasn't there a Norton tool that adds this "exclusion" feature? it was mentioned in the forums before, i think..

[techidave]

I got rid of Windows Defender from my Vista system.  It is running much faster now, it seem to be always scanning the hard drive.

Your right Carol, it does have some major drawbacks.

[f0dder]

I don't know much about Windows Defender - doesn't seem to slow down my laptop (it only does a file scan every now and then), so I've kept it since it doesn't interfere with my work.

As for "Everything" not being able to run at startup, what happens? Does it give an error message, or does it simply not start? It might be an issue of Everything trying to add itself to the HKLM\Software\Microsoft\Windows\Currentversion\Run key, but not being allowed - try manually adding it?

[SKA]

Well Carol - here goes:
http://www.groovypos...erver-2008-or-vista/

SKA

[Carol Haynes]

I don't know much about Windows Defender - doesn't seem to slow down my laptop (it only does a file scan every now and then), so I've kept it since it doesn't interfere with my work.

As for "Everything" not being able to run at startup, what happens? Does it give an error message, or does it simply not start? It might be an issue of Everything trying to add itself to the HKLM\Software\Microsoft\Windows\Currentversion\Run key, but not being allowed - try manually adding it?

-f0dder (April 21, 2009, 05:37 AM)

I just get a UAC error at startup saying 'Everything' has been blocked from running (actually it is a little tray icon with a balloon style popup - right clicking on the icon lets me allow the application but you can't tell it to remember that so you have to do it every single time!).

[nudone]

i'm using the scheduled tasks method of running Everything. i admit it's a bit of a faff but once done it all works as you'd expect - so, can't you just do a similar thing for your bank apps?

(defender seems to be running fine on here, too.)

[lanux128]

here is the tool i mentioned: NortonUAC. of course, it depends on how far are you willing to use a Norton product..

[lanux128]

from Everything FAQ: How do I bypass the UAC to run "Everything" with administrative privileges on system startup?


• http://www.voidtools...es_on_system_startup

[Carol Haynes]

Well Carol - here goes:
http://www.groovypos...erver-2008-or-vista/

SKA

-SKA (April 21, 2009, 06:10 AM)

Thanks - simpler solution than anything I have found is:

Open Windows Defender and go to Option
Scroll down and uncheck 'real-time protection'
Scroll further down and uncheck "Use Windows Defender"

Now when Windows Vista starts up it ignore Windows Defender completely (and if you look in services you can see the service is not running but it has been left on automatic).

All the other suggested fiddling means that you have to remember what you did should you decide to re-enable Defender  with the above method you just go to the Security Centre and start it up again.

[Carol Haynes]

from Everything FAQ: How do I bypass the UAC to run "Everything" with administrative privileges on system startup?
 (see attachment in previous post)• http://www.voidtools...es_on_system_startup

-lanux128 (April 21, 2009, 07:43 AM)

Yes I saw that - I modified the method slightly. It was a big hassle having to create shortcuts and stuff so I simply created a Scheduled Task that pointed at everything.exe and started when I log in to my user account. This won't work if there are more than one user (you'd have to set up a task for each user) but it saves having to create a shortcut to the Task and then put that in the Startup folder.

[f0dder]

So, the program needs administrative privileges and to be run at computer startup? Usually, I'd say that rather than blaiming UAC, this sounds like a job for service + GUI. That's generally the correct way to do something like this, and has been since NT4 or so.

"Everything" is a bit special, though - from their FAQ (especially the point about only working with NTFS), I get the idea that instead of normal filesystem traversing APIs, they're directly reading the MFT... this means that prior to Vista, it wouldn't have been possible to use from a limited user account without a "runas" application, and UAC thus acts as an enabling technology

If the developers want to play clean, the fix is pretty simple - don't read the MFT until the first the search GUI is invoked, and only ask for UAC elevation for the duration of the MFT read; the application shouldn't need to run with administrative privileges outside that operation.

[Lashiec]

Nice point there, f0dder

In theory, if you accept to be part of Microsoft SpyNet, the actions you take towards unknown apps will end up being included in Defender's database. At least that's what the app tells to you, and what the help file says. The problem is that the thing does not work at all. I accepted Wallpaper Master and Total Uninstall petitions in Windows Defender a thousand times over most than one year, and the apps are still not being recognized. I don't know what Microsoft is doing, but clearly it isn't working, maybe we will see it fixed for Windows 7. Also, there seems to be a way to allow items permanently as you mention (heck, there's even a way to list the allowed items in the Tools section), but damned if I know how to add something. The help file mentions a mythical "Always allow" option, but it ranks up there with the tooth fairy in terms of probability of existence.

To be fair, other security apps that detect "safe" and "unsafe" software still do not detect them as well, so it looks like a general problem with these particular applications.

EDIT: No fun, man, you edited everything

[f0dder]

Lashiec: *big grin* - I originally thought I was replying to another post, hence the edit to simply "a point" (nice one, hadn't thought of it that way before you brought it up). Sorry to ruin the fun

FWIW I've never had Windows Defender pop up about anything (other than "it's been a while since you've scanned last") - is this a good or a bad thing?

[Lashiec]

During my brief encounters with Vista and Windows 7 I noticed that Windows Defender is more silent than in XP, so the lack of popups is probably a good thing. I assume UAC and other things Vista introduced made some monitoring functions of Defender useless.

[Carol Haynes]

The trouble is the lack of popups means that you cannot control what it does.

Personally I want this sort of app to pop up and say "App xxxxx is unrecognised - I you know it can be trusted click Always Allow". If you want to opt into the TechNet database thingy that doesn't work that is fine - your response can be logged and ignored but at least you can say that the apps you use every day are trusted. As it stands it either does nothing or blocks essential applications without any control.

Like UAC the temptation is simply to remove the annoyance altogether and take control over what you install yourself - and possibly use a thirdy party anti spyware app to do the job properly.

[Lashiec]

Just in case, do check the options of Defender. There are a few options that come disabled by default, and one of them may be "Notify about software not yet classified" or similar.

[Stoic Joker]

While I've always likes/used Windows Defender, it decided to trigger on Angry IP Scanner this morning ... Which its never done before. Whitelisting it was simple enough, but the fact that I had to speaks to a rather alarming trend by the AV types of blindly triggering on anything that has "potential" for misuse.

At any rate (Not to side track the thread) there is an online petition to the AV companies to whitelist the Angry IP Scanner located here http://www.petitiono...ngryip/petition.html for anyone interested.

Carol I know you're mad at WD but the problem seems to be a larger industry wide issue with FP's spiraling out of control as the AV companies fight with the fact that the 80/20 rule works better then they do ... and trying to protect (the masses) people from themselves is impossible (and foolish).