Do you have Windows Defender enabled?

[Riftsaw]

Nope.

I'm running Kaspersky.

 

[Catweazle]

I use Onecare, which subsumes all of the functions of Defender and so disables it upon install.

heh heh...

The spyware component of OneCare IS Defender!

OneCare uses the Defender engine, with OneCare's own interface accessing it. There's not much that OneCare actually even adds to a Vista install. Virus Scanner, another (outgoing) layer of firewall, but that's about it. All the rest is just a user interface to access and configure functionality which is already in the OS. For the most part, OneCare is 'extra convenience' rather than 'extra functionality'.

 

[QHalo]

newp, disabled on both my machines.

 

[wildfire99]

Ever stop to think that mp3s are compressed files, like zips, and can act as a malware carrier? If you're getting prompted playing mp3s, I suggest you stop downloading them from Kazaa.

Well that's the weird thing. I spent quality time earlier this week deciphering Windows Defender's config page to see if it was at fault for the odd warnings.

I have some MP3s that are downloaded (not from Kazaa thank you, but I guess I deserve a little venom since I give it out) that get a clean bill of health, and others that are not downloads that do get flagged as downloaded and dangerous despite having never seen the interweb.

Through it all, my WMAs don't get flagged at all. WMA is still a compressed audio carrier, but why does it get a free pass? Do I need to suggest because it's an MS product?

Anyway, buffer overruns from files come from player apps, not the OS unless the OS is doing something it shouldn't. WinAmp is just as likely as WindowsMediaPlayer to fall over due to some malicious audio file. I think it's just a bizarre thing, and I still can't figure out which process in Vista (Defender?) is responsible for this.

Also worrisome is that you can disable warnings for a single "downloaded" file via the checkbox on the popup. Where are those being saved? Do they get deleted, or in a year or two will I have disk space being eaten up by pointless safe lists in some registry file somewhere?

This is what bugs me. Mystery processes doing things of debatable value, that can't be overridden or require unusual amounts of effort to bypass, all in the name of security through obscurity (save for, at least now, the 64 bit codebase I presume).

Also, try and keep up. Defender is a Microsoft product from ground up. The original Defender was made from an entirely different code base, Visual Basic. The current one after Microsoft bought it is redesigned entirely in C++

I don't care what it was written in, and I never mentioned it. It's irrelevant to the process. What I did mean to say that if another company that had yet to be fully embraced by Microsoft's command structure was responsible for Defender's current iteration, I can see why it doesn't seem as bad as some other OS components. In fact, I have continually been impressed by how little Defender gets in the way. Regardless of what the app was written in, usability and high level thought about how the user will interact with the application (and conversely, how the app will intervene in user behavior) is of paramount importance, and is something that Vista as a whole really seems to fail at, at least for me. That Defender navigates away from this (user nagging and nannyism) in some part is to be commended.

Now if they went and rewrote it in .NET 3, we might have to have heated words.

 

[Ranma_Sao]

Well that's the weird thing. I spent quality time earlier this week deciphering Windows Defender's config page to see if it was at fault for the odd warnings.

I have some MP3s that are downloaded (not from Kazaa thank you, but I guess I deserve a little venom since I give it out) that get a clean bill of health, and others that are not downloads that do get flagged as downloaded and dangerous despite having never seen the interweb.

Through it all, my WMAs don't get flagged at all. WMA is still a compressed audio carrier, but why does it get a free pass? Do I need to suggest because it's an MS product?

Anyway, buffer overruns from files come from player apps, not the OS unless the OS is doing something it shouldn't. WinAmp is just as likely as WindowsMediaPlayer to fall over due to some malicious audio file. I think it's just a bizarre thing, and I still can't figure out which process in Vista (Defender?) is responsible for this.

Also worrisome is that you can disable warnings for a single "downloaded" file via the checkbox on the popup. Where are those being saved? Do they get deleted, or in a year or two will I have disk space being eaten up by pointless safe lists in some registry file somewhere?

This is what bugs me. Mystery processes doing things of debatable value, that can't be overridden or require unusual amounts of effort to bypass, all in the name of security through obscurity (save for, at least now, the 64 bit codebase I presume).


I don't care what it was written in, and I never mentioned it. It's irrelevant to the process. What I did mean to say that if another company that had yet to be fully embraced by Microsoft's command structure was responsible for Defender's current iteration, I can see why it doesn't seem as bad as some other OS components. In fact, I have continually been impressed by how little Defender gets in the way. Regardless of what the app was written in, usability and high level thought about how the user will interact with the application (and conversely, how the app will intervene in user behavior) is of paramount importance, and is something that Vista as a whole really seems to fail at, at least for me. That Defender navigates away from this (user nagging and nannyism) in some part is to be commended.

Now if they went and rewrote it in .NET 3, we might have to have heated words.

WinInet downloaded files have an alternate stream written to them to say they were downloaded from the internet. (Sysinternals Streams should demonstrate that)

It should prompt you for all downloaded files, wma or mp3, but it depends on your machines configuration. (You can disable prompting per file type)

I assure you that it was mostly Microsoft people working on Defender. And I think at this point in my career you'd call me one of the most "Microsoft" type people.

I'm not sure why you'd mind it being written in .NET? Does the language really matter? I only brought up the VB part, to demonstrate it was re-written.

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Catweazle]

I only brought up the VB part, to demonstrate it was re-written.

And that's the pertinent point. It was 're-written'. It wasn't merely 'translated'. The product which exists now is NOT the product which MS initially acquired the rights to.

 

[Mithent]

I have it enabled. It's not caused any noticeable inconvenience or slowdown, although it's never caught any spyware (though, to my knowledge, I've never had any, so that's hardly a problem). I don't use any other resident spyware protection either, so I have no reason to disable it.