Windows Defender (Beta 2): MS AntiSpyware - Renamed

[ɹəuəllıʍ ʇɐb]

I decided to give it another try, and it still makes grinding noises when switching the scan from drive C to D. I haven't even informed Microsoft. I have yet to work out how to contact them about anything. Does anyone know if they have made any comments regarding this problem, if it is indeed widespread?

On the Windows Defender download page there is a link to the WD newsgroups. There are a number of Microsoft staff and developers in there that do in fact take notice of any problems that occur.

My version now is

1.1.1051.0

1.1.1372.0 engine

1.14.1410.10 version built on 27.4.06 at 4.33am

This is not the latest WD version; mine is 1.1.1347.0 - it does not update automatically; it must be downloaded. Engine and definitions are up to date.

[andsome]

I managed to find a forum, and have posted regarding the problem. HERE.

[ɹəuəllıʍ ʇɐb]

Looks like I pointed you to the wrong group; one MVP refers you to a different group (current last post).

[-pops-]

I installed this program when it first came out as MS Antispyware (I think it was on a disk from MS).

I didn't like it, can't remember why but out it came.

Reading here about the developments with it just now, I thought I'd give it another go.

Well, it did a quick scan in a few minutes and didn't find anything. I then did a full scan and found that it will only scan drives that are connected by the motherboard IDE (I have two additional hard drives on a PCI IDE card).

When it had completed "C" drive and changed to the other one on the same cable during the scan I heard a quite loud and odd noise coming from the machine. Not quite "grinding" but certainly disturbing.

So, andsome, you are certainly not the only one who gets this.

I was given the all clear regarding spyware. I will do my normal Sunday afternoon scans with my usual scanners and see what they come up with.

Edit: Just done a scan with Spydefense and that found 4 minor "things" that the MS software completely missed. The galling thing is that Spydefense found these in a 3 minute 30 second scan - Windows Defender took 34 minutes to tell me there was nothing.

It has now been removed twice. I won't be installing it a third time.

[andsome]

Glad I'm not the only one with the same problem. I certainly won't bother with it again.

[CurlyWhirly]

I am waiting for the final release as I rarely install BETA software and I am glad that I decided to wait after hearing about the grinding noise(s) on the hard drive(s) but these kinds of events are to be expected as it is BETA software after all.

I am still using Microsoft Anti-Spy at the moment but Windows Defender will be replacing it when it's no longer in BETA.

[ɹəuəllıʍ ʇɐb]

I have so far only used WD's scheduled scanner (Quick Scan) during night time. There is no telling whether or not there were any kind of noises during that time.

So I decided to run a Full Scan while I was sitting at the computer. If first scanned the entire C: drive; it took 56 minutes, and it made not the slightest noise.

I was doing something different when all of a sudden some astonishing sound came out of my computer chassis. Not horrible, not grinding, but very unusual!

I quickly Alt-Tabbed to the WD window, and I saw that it was now scanning the D: drive. Within seconds it completed the D: scan, switched to E:, and the noise stopped.

What's different between the three drives? All three partitions are on the same HD. All three are NTFS, but D: is formatted with 64KB clusters, and contains only one very large PST file. That is the only distinction I can make from the other partitions.

WD has now completed scanning of F:, G:, H:, I:, J:, N:, and O:, and no further noises were heard.

[-pops-]

The noise I experienced was at the changeover from "C" to a physically different drive on the same IDE cable. It ignored the other two, physically separate, drives I have on a PCI IDE card. Consequently, this software is not of much use to me, even if it didn't make odd (worrying) noises as it doesn't scan all the hard drives. I don't have problems with other security programs finding and scanning these.

[andsome]

It worries me that this threshing about could be causing damage. I won't run it again. On my computer I have watched as it changes drives. Just before the C scan completes, the noise starts and D flashes up, then as the noise continues for a few seconds C and D flash on and off alternately. Once the scan settles onto D, the noises stop. Maybe grinding noise is not the best description, it was all that I could think of at the time. Maybe crashing of gears would be more appropriate, as when a poor gear change is made in a car.

[-pops-]

Another point is that following my Defender scan yesterday, I commented on SpyDefense finding something well, during the afternoon, even Ad-Aware found 5 "critical" entries and Ewido found two. I can't believe that these had been inserted in the time between my morning and afternoon scans so, I am asking if the MS product is any use at all?

(It couldn't be yet another of these things that MS have bought, messed about with sufficient to wreck it and are now promoting it as something good and innovative - like they have done with so, so many other bits of previously good software, could it?)

[ɹəuəllıʍ ʇɐb]

I think I found it! :P

Checked the WD newsgroups again, and found that several people actually wrote about noises from the floppy drive. (But others wrote about grinding noises from the HD).

Anyway, I ran the Full Scan again - this time watching the WD panel during the entire 56 minutes. Then - guess where it went: the A: floppy drive! The floppy light blinked for a few seconds, and during this time the unusual noises occurred (almost 5 ~ 10 seconds). Then it stopped and started scanning the D: drive.

I know that -pops- does not have floppy drives in his computer(s), but Mr. Andsome: do you have a floppy drive on your machine?

[andsome]

I think I found it! :P

Checked the WD newsgroups again, and found that several people actually wrote about noises from the floppy drive. (But others wrote about grinding noises from the HD).

Anyway, I ran the Full Scan again - this time watching the WD panel during the entire 56 minutes. Then - guess where it went: the A: floppy drive! The floppy light blinked for a few seconds, and during this time the unusual noises occurred (almost 5 ~ 10 seconds). Then it stopped and started scanning the D: drive.

I know that -pops- does not have floppy drives in his computer(s), but Mr. Andsome: do you have a floppy drive on your machine?

I do have a floppy drive but this did not cause the noise. When the scan reaches almost the end of C drive, the letter D flashes on, then off again and C reappears, then D again, and so on. It is while C and D are flashing that the noise occurs. Floppy drive A does not appear at all.

[AlanHo]

I have just carried out a full scan using Windows Defender without any crashing, grating or rumbling noises.

I have a primary drive partitioned into C: for the OS and Programs and D: for Documents and Settings.

I have a second hard drive with just one partition for back ups and Acronis.

However, I did notice that as it came to the end of scanning the C drive it alternated between scanning the C drive and D drive for about 30 seconds before concentrating on just the D drive. Despite the constant flicking between one drive and onother - it did it in silence.

Later it alternated between the E drive and C drive for about the same time before concentrating on the E drive.

I also have two USB external drives which it scanned in turn - but this time I did not see any similar scanning transitions - just a clean break between each drive.

It all took 96 minutes and it found no problems.

Which makes me think. When I installed the scanner I carried out a full scan of all drives and it found about 20 problems which were corrected. It now resides on the computer and scans all internet traffic - dealing with any problems as soon as they are found.

In the circumstances, perhaps I should not be surprised to find it confirms a clean bill of health - otherwise either the original scan was deficient or it has allowed nasties to escape its clutches when I have been surfing or Emailing.

I sometimes feel that people demand much higher standards from Microsoft than they do to other suppliers. No software is so perfect that it can cope with every possible permutation of hardware and software on millions of computers throughout the World. I am happy to rely on Microsoft software and have always been able to resolve the few problems it has caused me. I cannot say the same for McAfee, Norton. PC Tools and early versions of Nero that were a nightmare.

.

[ɹəuəllıʍ ʇɐb]

I do have a floppy drive but this did not cause the noise. When the scan reaches almost the end of C drive, the letter D flashes on, then off again and C reappears, then D again, and so on. It is while C and D are flashing that the noise occurs. Floppy drive A does not appear at all.

Actually the same thing happened at the end of the C: scan; it alternated between C:, D:, E:, I:, J: a couple of times, then the noise appeared. I did not see the A: displayed in WD, but I saw the A: floppy light blinking while the noise occurred.

Tried to explicitly custom scan A:, but it won't let me select it. (Without a disk in it).

[-pops-]

Whilst I agree with some of your sentiments, especially "McAfee, Norton. PC Tools and early versions of Nero that were a nightmare." I still find it of concern that, almost immediately following a scan with the Microsoft product, other software (including one program we were saying just the other day was past its best i.e. Ad-Aware) should be able to detect several items of malware.

[AlanHo]

Following you comment pops about other software revealing problems after a Windows Defender scan - I have just updated and run AdAware and Spybot after not using either for several months.

AdAware found 3 items which it defined as non-critical and spybot found 4 Firefox tracking cookies - and I do not use Firefox.

Hence I still feel comfortable about the Windows product.

[-pops-]

You are, of course, quite justified in running whatever you wish on your computer, Alan but, as far as I'm concerned and for the reasons explained, Windows Defender "doesn't do it for me" and I will be giving it a long term miss.

No doubt it will be one of the included parts of Vista so, eventually, I will have to have it if I promote myself to that O/S :)

[SpeakerForTheDead]

I was having a similar issue to many, many posts that signatures would not update. If you use the interface to 'check for updates', it will go out and check (seemingly) and return with a message that everything is up-to-date. Check the status screen and it still states that you are out of date by xx number of days. Check the help screen and the signature file is still woefully out of date. Uninstall and reinstall does not help. Performing the MS kb article fix has no results. The below method will correct the issue. WARNING that this requires some careful editing of your registry to rip windows defender out by its roots and a couple of reboots to disconnect some dlls and delete them.

1) First uninstall Windows defender from the control panel/add remove programs. This resulted in an error for me, but I think it's a worthwhile step anyways.

2) Go to your task manager (Crt+alt+Del), processes tab, right click on the msmpeng.exe process and end the process. Do the same with the MSASCui.exe process.

3) Open up 'my computer', browse to your c: Drive/Program Files/Windows Defender/ and delete every file that it will allow you to delete. Some it will not, such as MpshHook.dll. There are some others too, but it is not important at this stage, as deleting them is going to require a reboot later, don't reboot yet however, do the next step first.

4) Click Start/Run and type regedit and click ok.

5) in the registry editor interface, on the menu bar click 'edit' and then 'find' and search for 'defender'. You are going to get a whole lot of hits with this. Any entry you find that points to the 'program files/windows defender' folder (we previously deleted files from), delete the registry entry for these. Delete everything that refers to the windows defender application you find (with one exception, you may have downloaded the 'windows defender.msi' installation file from Microsoft. you can keep these registry entries. Deleting them however will only result in you possibly having to download the application again). Some of the search results will be pointing to a child folder to a higher level windows defender registry entry. In this case you will want to delete the higher level registry entry to remove all references to the application. Some of the attempts to delete the entries will result in an error that states that the attempt to delete it failed. In this case, right click on the entry and change the permissions to all full control for 'everyone' and apply the changes, then you can delete the key.

6) I would recommend several passes on step 5. Be sure to highlight the highest level parent node (my computer generally) in the registry tree each time you start the search, so you search the entire registry. It took several passes for me to remove them all. This took quite a while too, so don't get dismayed.

7) The pain isn't over, sorry. You now need to repeat the registry search for 'windef' Again remove all of the entries you find here too.

8) Now go back and try to remove the remaining files in the c:/program files/windows defender/ folder. Don't worry, you still won't be able to delete them all. When you have deleted as much as it allows you to you are done with this step.

9) Reboot your machine.

10) Now go back and try to remove the remaining files in the c:/program files/windows defender/ folder. You should be able to delete everything there now.

11) Delete the 'Windows Defender' folder in the program files folder. Delete any Windows Defender folders in the Program Files folder. I had a second one named 'Windows Defender(2)'. Probably there from a second attempt to reinstall the application. If you have tried several times, I suspect you would have several of these. Delete them all.

12) Reboot again to be sure that all of the dlls have been unloaded from volatile memory now.

13) I checked my registry again after this for both 'defender' and 'windef' and found no entries (except for pointers to my installation package, 'windowsdefender.msi'). You probably don't have to, but it might help for further troubleshooting for people this invasive removal doesn't work for.

14) I check my services (Start/settings/controlpanel/administrative tools/services) and found that the 'Windows Defender' service no longer appeared as a service there. Again, You probably don't have to, but it might help for further troubleshooting for people this invasive removal doesn't work for.

15) Reinstall Windows Defender (I did beta 2 successfully). I got a nasty exception error (ox8050800d) after the installation and it tried to launch, but just click ok if you get it and allow the application to continue. Allow it to obtain the updates or click the button to get the updates (Help/about/check for updates button also). Again I got a few exception errors as I did this. Once the updates were downloaded and I ran a 'quick scan' I stopped getting any errors and the package denotes that it is up to date.

It's painful and long, but it worked for me. I hope I didn't miss any ting as I tried to regurgitate what I did to resolve this. Hope it helps others.

Thanks

[ɹəuəllıʍ ʇɐb]

Thank you for the detailed report. However, I think that most users who experience these update problems, and who are not hard-core beta testers, will just wait until a stable version of WD is available.

So far it still seems to be unknown why some users experience problems with almost every update, and others have not the slightest problem at all (I have none).

[andsome]

I've removed the wretched program altogether .

[SpeakerForTheDead]

I think it is simply a matter of whether you uninstalled the previous version before installing the new beta 2 version. It took several hours to gather the facts together to come to a resolution. I saw a number of people having a similar issue as I was and decided that I would help some people. Your dismissal of my post is maddening in that regard. It is clearly apparent now that you do not want it fixed, but much prefer to simply complain about the software. I will keep the resolutions to problems to myself in the future. Sorry to interupt your MS hate fest.

Thank you for the detailed report. However, I think that most users who experience these update problems, and who are not hard-core beta testers, will just wait until a stable version of WD is available.

So far it still seems to be unknown why some users experience problems with almost every update, and others have not the slightest problem at all (I have none).

[-pops-]

You are, of course, entitled to think what you want to about the respondents to this thread and I think the response offered by Pat Willener and others was quite reasonable.

The remedy which you have comprehensively described is, nevertheless, complex and time consuming. It also involves registry editing which some people are not happy about carrying out - with good reason.

Software that is so difficult to fully remove shows poor programming skills on the part of the creators and something such as a beta program (as this is) used to have efficient and easy methods of removal, well, at least they did when I did beta testing. This was in order that a) if the program turned out to be rubbish or b ) further developments needed examining then the older program could be easily taken out.

Lots of people have have lots of problems with this software as can be seen from this forum and from others, including forums dedicated to the subject.

Furthermore, it is not the responsibility of the public beta testers to make advancements to programs - which your removal method seems to do, complex as it is. It is up to the testers to report back to the developers with any adverse findings about the way the program under test behaves - good, bad or indifferent. At least, again, that was the way when I did it.

I have tried the program and found it lacking, as I have reported. I have let my feelings be known and I no longer use the program.

I am not anti-MS at all so any presumption there is flawed.

[andsome]

I think it is simply a matter of whether you uninstalled the previous version before installing the new beta 2 version. It took several hours to gather the facts together to come to a resolution. I saw a number of people having a similar issue as I was and decided that I would help some people. Your dismissal of my post is maddening in that regard. It is clearly apparent now that you do not want it fixed, but much prefer to simply complain about the software. I will keep the resolutions to problems to myself in the future. Sorry to interupt your MS hate fest.

Thank you for the detailed report. However, I think that most users who experience these update problems, and who are not hard-core beta testers, will just wait until a stable version of WD is available.

So far it still seems to be unknown why some users experience problems with almost every update, and others have not the slightest problem at all (I have none).

I uninstalled and reinstalled several times in an effort to get the program to work properly. After each uninstall I used crap Cleaner and Regscrub XP. I also did a search to try and find further files. I still got the annoying grinding noise when the scan switched from Drives C to D. I think I tried more than hard enough to make this wretched program work. As far as I am concerned I am well rid of it, and am not prepared to waste any more time.

[SpeakerForTheDead]

I am not challenging any statements as to whether MS products are good or bad. It's not my place to make up your mind, or anyone elses on that. I don't have any religious affiliation with any software vendor (as some people seem to). I do however find it very disheartening to find people who write pages of comments stating that all attempts to correct the issue have failed and ask that someone post a fix as soon as they find it, once it's posted, turn around and say nevermind, I really just wanted to bash MS. I don't have a problem with that, except that I am not going to help that person again. It's a waste of my time and effort. If you want to bash MS, go ahead, no skin off my teeth and none of my feelings hurt because I don't care. Ask me for help however and allow me to do the work and then dismiss it when it is complete, is tantamount to lying. If your goal is to bash MS, state it up front rather than veil your bashing behind presumably unanswered cries for help. That is disgustingly underhanded. Sorry to rock your boat, but I don't do politics or religion (especially technical religions such as Apple and Microsot cater to) and I am now seeing both here. If that makes me an outcast, then so be it. I like technical challenges regardless of whos name is on the box. If that is a problem, toss me out with the bath water please. I simply don't want to waste my time or effort.

You are, of course, entitled to think what you want to about the respondents to this thread and I think the response offered by Pat Willener and others was quite reasonable.

The remedy which you have comprehensively described is, nevertheless, complex and time consuming. It also involves registry editing which some people are not happy about carrying out - with good reason.

Software that is so difficult to fully remove shows poor programming skills on the part of the creators and something such as a beta program (as this is) used to have efficient and easy methods of removal, well, at least they did when I did beta testing. This was in order that a) if the program turned out to be rubbish or b ) further developments needed examining then the older program could be easily taken out.

Lots of people have have lots of problems with this software as can be seen from this forum and from others, including forums dedicated to the subject.

Furthermore, it is not the responsibility of the public beta testers to make advancements to programs - which your removal method seems to do, complex as it is. It is up to the testers to report back to the developers with any adverse findings about the way the program under test behaves - good, bad or indifferent. At least, again, that was the way when I did it.

I have tried the program and found it lacking, as I have reported. I have let my feelings be known and I no longer use the program.

I am not anti-MS at all so any presumption there is flawed.

[ɹəuəllıʍ ʇɐb]

Where did you see MS bashing in my reply...?

Betaware is bound to have some problems, and not everyone is cut out to be a beta tester. A number of forum members have tried WD, have experienced problems, and have uninstalled the product. Once a stable (non-beta) version is available, they will most likely give it another try.

I do not experience any problems with WD beta, and if I did, I would report them in the WD beta newsgroup.