MSE 2 Final Released!

[Greg S]

i used Mse before and i liked it just one thing ,when i open a folder ( It contane many compresed softwares) it take a few while ,I have 3 gb of ram ,does it normal ?

Yeah, I do think it's related to MSE because it does the same for me throughout it's version history to date. You won't find many who will say the same though, as I have a feeling it's only in certain hardware combination related scenarios as far as my theory on it.

I can't use it on my system, I go with something else.

Same here and it is related to MSE according to MS. It can only be tamed by excluding explorer.exe process which is advice from MS.

MSE updated through updates a couple of weeks or more ago. Since then, I'm having a situation with MSE that is troubling me. Once a day, MSE with a random GUI number wants to change registry settings and then load a kernel driver which is fine except for one thing. My HIPS doesn't seem to have the ability to permanently allow the rule because of the daily changing of the random GUI. I could do it by allowing the services process full control but I'm afraid that it would leave me wide open so to speak. Below is the info for such a daily event with the latest MSE. Sorry, it's kinda lengthy but I want the detailed shown in case anyone knows why or a way to overcome the daily ritual of this.

 2/3/2011 14:05:45    Set registry value    Permitted
Process: e:\windows\system32\services.exe
Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpKslade2f93a\Start
Data: 0x00000004(4)
Rule: [Registry Group]Autostarts Locations -> [Registry]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\*; Start
 
 
2/3/2011 14:05:46    Delete registry key    Permitted
Process: e:\windows\system32\services.exe
Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpKslade2f93a
Rule: [Registry Group]Autostarts Locations -> [Registry]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
 
 
2/3/2011 14:05:49    Create registry key    Permitted
Process: e:\windows\system32\services.exe
Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpKsl2df405c0
Rule: [Registry Group]Autostarts Locations -> [Registry]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
 
 
2/3/2011 14:05:51    Set registry value    Permitted
Process: e:\windows\system32\services.exe
Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpKsl2df405c0\Start
Data: 0x00000001(1)
Rule: [Registry Group]Autostarts Locations -> [Registry]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\*; Start
 
 
2/3/2011 14:05:52    Set registry value    Permitted
Process: e:\windows\system32\services.exe
Target: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpKsl2df405c0\ImagePath
Data: \??\E:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6CC745D3-C3D0-4145-8B88-57322F224560}\MpKsl2df405c0.sys
Rule: [Registry Group]Autostarts Locations -> [Registry]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\*; ImagePath
 
 
2/3/2011 14:05:56    Load kernel driver    Permitted
Process: e:\windows\system32\services.exe
Target: e:\programdata\microsoft\microsoft antimalware\definition updates\{6cc745d3-c3d0-4145-8b88-57322f224560}\mpksl2df405c0.sys
Rule: [App]e:\windows\system32\services.exe

 

[Airbot]

Same here and it is related to MSE according to MS. It can only be tamed by excluding explorer.exe process which is advice from MS.

Greg, can you post a link to where they admit this if you can find it. Thanks.

 

[Greg S]

Same here and it is related to MSE according to MS. It can only be tamed by excluding explorer.exe process which is advice from MS.

Greg, can you post a link to where they admit this if you can find it. Thanks.

I've been searching since my post and haven't found it yet. In addition to that, at one time they had exclusions for MSE's main files. I'll keep looking. I had it bookmarked at one time, but switch back and forth between snapshots which caused me to lose it. When switching snapshots, I have rarely used the recover files feature because at the time of switching, I can't remember which ones I want to recover. Also to recover, it has to take a snaphot of the system prior to a restore which I do not like. I'll keep looking.

 

[NoN]

I do not have this prob with MSE v2.0, maybe those have set DEP for All Programs & All Services should lower it back to only Windows Programs & Services...could overkill performances!

 

[sygnus21]

False Positive?

Did anyone else get a MSE warning about their Jave add-on being a trojan????

I got one yesterday....



I also had the same notifications awhile back as posted here - http://www.sevenforums.com/system-security/131437-mse-2-final-released-9.html#post1140943. I cleaned those files out just to be safe and all was good for awhile, even with Java installed - until yesterday.

Is MSE giving false positive on these???

Thanks.

 

[oreo27]

Did anyone else get a MSE warning about their Jave add-on being a trojan????

I got one yesterday....

View attachment 144741

I also had the same notifications awhile back as posted here - http://www.sevenforums.com/system-security/131437-mse-2-final-released-9.html#post1140943. I cleaned those files out just to be safe and all was good for awhile, even with Java installed - until yesterday.

Is MSE giving false positive on these???

Thanks.

I think you can read that a few pages back that it happened to other people as well.

If I remember correctly, download and installing the latest JAVA update fixes this issue.

 

[sygnus21]

I think you can read that a few pages back that it happened to other people as well.

If I remember correctly, download and installing the latest JAVA update fixes this issue.

Yeah I did that... and then it popped up again. Just wondering if MSE isn't giving a false positive on it. Sounds like it is.

Thanks

 

[Tatletz]

Hi guys,
This is the first time I start using MSE, and it works just fine. The only downfall for me is the update issue. It seems that there is no automation into this process apart from virus definitions update setting prior to scheduled daily scan. In WU this is shown as optional therefore it must be done manually, alternative way is to use the update tab on MSE itself. It's not a big deal to hit the update tab in this regard, but was wondering is it only me(being a novice with MSE) or this is how it works. Any comment will be highly appreciated.
Thank you!

 

[Golden]

Hi Tatletz,

Please refer to this recent thread:

http://www.sevenforums.com/system-security/149369-mse-update-question.html

Regards,
Golden

 

[Tatletz]

Hi Tatletz,

Please refer to this recent thread:

http://www.sevenforums.com/system-security/149369-mse-update-question.html

Regards,
Golden

Thanks mate,

No big fuss, so just click on update tab and you are good. One can't expect freeware to be like the paid for anyway.

 

[Spidey1976]

MSE Freezes Expolorer

Not sure if I should start a new thread or if I can get this taken care of here:

I've been using MSE for a long while now and just recently had a problem. Ever since I installed SP1 for 7, MSE will freeze explorer for 3-5 minutes while installing updated definitions, whether I do it manually or through windows update. MSE will go through the "searching" phase and "downloading" phase just fine, but when it begins the "installing" phase it freezes the pc.

I have tried uninstalling and reinstalling MSE, but the problem persists. MSE works perfectly fine on my old XP laptop and older Vista 32-bit machines, but does not seem to like my setup on the 7 machine. The only change to the machine was the installation of SP1.

I ended up removing MSE for now. Everything else is working fine. System specs are up to date.

 

[oreo27]

I think you can read that a few pages back that it happened to other people as well.

If I remember correctly, download and installing the latest JAVA update fixes this issue.

Yeah I did that... and then it popped up again. Just wondering if MSE isn't giving a false positive on it. Sounds like it is.

Thanks

That's odd. I remember getting the detection, updating, rescanning and getting a clean result.

Maybe you should consider the possibility of an actual infection. Hopefully it's not.

What does PSI - Consumer - Products say about your Java version?

 

[sygnus21]

When I said I updated my version it was when I first got the notification. Months/updates later I than get another notification. Anyways I've removed the offending file (was an old version) and all is good now. Thanks

And thanks for the link. Will come in handy.

 

[Golden]

Hi Spidey,

What anti-virus software did you have installed prior to MSE, if any? I'm wondering if there may be remnents of it left over, and is now causing havoc with the MSE installation. Although why it only happened after installation of SP1 I cannot say.

If may be worth doing an online scan using ESET too.

Regards,
Golden

 

[oreo27]

When I said I updated my version it was when I first got the notification. Months/updates later I than get another notification. Anyways I've removed the offending file (was an old version) and all is good now. Thanks

And thanks for the link. Will come in handy.

Glad to hear that it's working properly now. I'm not quite sure but don't old Java versions get replaced when installing new ones?

Don't thank me, It was another member who introduced PSI to me. I don't remember the member's name but I remember that the member had a Speed Racer avatar

It's really quite a good tool. I'm very skeptical to install anything on my Desktop but that app proved to be quite good. I'm pretty obsessive about updates but it still found an unpatched application, Adobe Air, on my system.

Sorry if it's a bit off topic.

 

[Spidey1976]

Hi Spidey,

What anti-virus software did you have installed prior to MSE, if any? I'm wondering if there may be remnents of it left over, and is now causing havoc with the MSE installation. Although why it only happened after installation of SP1 I cannot say.

If may be worth doing an online scan using ESET too.

Regards,
Golden

Have not tried the ESET tool - I was using Avast! free 5.X? and since the MSE problem, using Avast! free 6.0.1. I've found users on here that had other SP1 problems, but everything is working great for me, aside from that 3-5 min freeze while definitions are installed. Also, during the freeze, I can move the mouse all over and bring up the start menu; however I can not open any other programs or use the task manager until the freeze stops.

 

[sygnus21]

I'm not quite sure but don't old Java versions get replaced when installing new ones?

I thought so too but apparently not....



The offending file was in the Deployment folder - which has a cache, which in turn has a 6.0 folder, which in turn has about 65 folders. The offending file was in folder #6

Don't thank me, It was another member who introduced PSI to me. I don't remember the member's name but I remember that the member had a Speed Racer avatar

It's really quite a good tool. I'm very skeptical to install anything on my Desktop but that app proved to be quite good. I'm pretty obsessive about updates but it still found an unpatched application, Adobe Air, on my system.

Yeah I've heard good things about Secunia.

Thanks.

 

[Fayla]

I just noticed an interesting update for MSE2

Before the 9.42PM GMT +0 Update (today)
Security Essentials Version: 2.0.657.0
Antimalware Client Version: 3.0.8107.0
Engine Version: 1.1.6603.0
Antivirus definition: 1.99.1783.0
Antispyware definition: 1.99.1783.0
Network Inspection System Engine Version: 2.0.5854.0
Network Inspection System Definition Version: 9.1.0.0

After the 9.42PM GMT +0 Update (today)
Security Essentials Version: 2.0.657.0
Antimalware Client Version: 3.0.8107.0
Engine Version: 1.1.6702.0
Antivirus definition: 1.101.1.0
Antispyware definition: 1.101.1.0
Network Inspection System Engine Version: 2.0.5854.0
Network Inspection System Definition Version: 9.1.0.0

And NO, old java versions do not remove during update, heck, the program doesn't even update properly sometimes (update loops.)

 

[oreo27]

I'm not quite sure but don't old Java versions get replaced when installing new ones?

I thought so too but apparently not....

Image Removed

The offending file was in the Deployment folder - which has a cache, which in turn has a 6.0 folder, which in turn has about 65 folders. The offending file was in folder #6

Image Removed

Don't thank me, It was another member who introduced PSI to me. I don't remember the member's name but I remember that the member had a Speed Racer avatar

It's really quite a good tool. I'm very skeptical to install anything on my Desktop but that app proved to be quite good. I'm pretty obsessive about updates but it still found an unpatched application, Adobe Air, on my system.

Yeah I've heard good things about Secunia.

Thanks.

Wow. Didn't know Java updates were installed in this manner. Too bad. At least it's sorted out. Yes, Securia is a nice application to have.

 

[Tatletz]

Did anyone else get a MSE warning about their Jave add-on being a trojan????

I got one yesterday....

View attachment 144741

I also had the same notifications awhile back as posted here - http://www.sevenforums.com/system-security/131437-mse-2-final-released-9.html#post1140943. I cleaned those files out just to be safe and all was good for awhile, even with Java installed - until yesterday.

Is MSE giving false positive on these???

Thanks.

Yes it happened to me too about 2 days ago. I just let it clean this "trojan" and then reinstalled the latast Java version. Obviously a false positive.