*&^%$#@! MSpy did it again!

Lady Fitzgerald · Sep 18, 2015

Yesterday, Windows Updates posted one Important and two Optional updates. The Important on was new definitions for Windows Defender. I hid one of the optional updates, then I was going to wait to download and install the remaining Optional and Important update for a few days like I normally do.

A few minutes ago, I noticed the Windows Update icon in the Notification area had disappeared again (the past few months, it comes and goes when there are updates pending) so I manually checked it and the Important update was gone. I checked and *&^%$#@! MSpy had downloaded and installed the thing despite my having Windows Updates set to only notify me and NOT download and install anything until I decide. This is around the third time this year this has happened. What the hell, MSpy!

Layback Bear · Sep 19, 2015

What were the KB's that Microsoft sneaked in.

Lady Fitzgerald · Sep 19, 2015

Layback Bear said:
What were the KB's that Microsoft sneaked in.

KB915597

It gets even more insidious. I went into Windows Defender to see what was going on (the update was definitions for Windows Defender) and found it had turned itself back on (I had it turned off since I have an AV), was checking for definitions before running scans, apparently downloading and installing them, and also has something I hadn't seen before: Microsoft SpyNet. Supposedly, it only sends information about detected spyware threats but one line in what SpyNet does was especially chilling: "In some instances, personal information might be unintentionally sent to Microsoft." Unintentionally my Aunt Fanny! MSpy went too far a long time ago and has been steadily getting worse. I may not wait until 2020 to tell MSpy to go to hell!

NoelDP · Sep 19, 2015

MS SpyNet has existed and been part of Defender since Vista as in Beta.
Live with it.

ThrashZone · Sep 19, 2015

Interesting
Don't manually check for updates
If updates disappear they might not of been too important could of been recalled.
Might of been referring to these ?
http://www.sevenforums.com/windows-...s-windows-update-have-two-kb-article-ids.html

Lady Fitzgerald · Sep 19, 2015

NoelDP said:
MS SpyNet has existed and been part of Defender since Vista as in Beta.
Live with it.

Funny I never saw it before. Live with it? Hell, no! I shut Defender off. Hopefully, it will stay off this time!

ThrashZone · Sep 19, 2015

Yea windows defender :/
Kind of the utility that has never found anything ever

Lady Fitzgerald · Sep 19, 2015

ThrashZone said:
Yea windows defender :/
Kind of the utility that has never found anything ever

...except how to turn itself back on.

ThrashZone · Sep 19, 2015

Probably second in one of the slowest scanners ever created
Second to MSE

Still though both should comply with CEIP preferences again I say "should"

Callender · Sep 19, 2015

RE: Windows Defender. I have always disabled it. However there's a scheduled task that will run even if you disable the windows defender service and registry entries:

Checked registry for MS Spynet and all entries seem to be disabled. I don't use MSE.

Lady Fitzgerald · Sep 19, 2015

Callender said:
RE: Windows Defender. I have always disabled it. However there's a scheduled task that will run even if you disable the windows defender service and registry entries:

View attachment 371889

Checked registry for MS Spynet and all entries seem to be disabled. I don't use MSE.

View attachment 371891

I checked task scheduler and I couldn't find an entry for Windows Defender.

Callender · Sep 19, 2015

Lady Fitzgerald said:
I checked task scheduler and I couldn't find an entry for Windows Defender.

Okay no problem. It must have been deleted sometime in the past.

UsernameIssues · Sep 20, 2015

Callender said:
Lady Fitzgerald said:

I checked task scheduler and I couldn't find an entry for Windows Defender.

Click to expand...

Okay no problem. It must have been deleted sometime in the past.

I seem to recall that Lady Fitzgerald once used MSE.
http://www.sevenforums.com/system-s...tion-version-1-143-376-0-a-5.html#post2266719

Installing MSE deletes the scheduled task shown below.

Uninstalling MSE does not restore it.
(At least not to the same location.)

Callender · Sep 20, 2015

UsernameIssues said:
I seem to recall that Lady Fitzgerald once used MSE.
http://www.sevenforums.com/system-s...tion-version-1-143-376-0-a-5.html#post2266719

Installing MSE deletes the scheduled task shown below.

Uninstalling MSE does not restore it.
(At least not to the same location.)

View attachment 371912

That's interesting. I wonder if Windows Defender Service startup is disabled via msconfig> services?

As far as I can work out these two files are responsible for running update checks for windows defender:

C:\Program Files\Windows Defender\MpCmdRun.exe

C:\Program Files\Windows Defender\MSASCui.exe

I'd suggest a scan using AutoRuns then search for "Defender" just in case there's an entry somewhere that is still enabled.

ThrashZone · Sep 20, 2015

I turned off defender just to play with it a bit,
Checked and there wasn't a task listed as UNI showed.

Kind of odd I have noticed after uninstalling MSE which updates came as Optional possibly recommended but defenders comes as important :/

Callender · Sep 20, 2015

Lady Fitzgerald said:
Layback Bear said:

What were the KB's that Microsoft sneaked in.

Click to expand...

KB915597

It gets even more insidious. I went into Windows Defender to see what was going on (the update was definitions for Windows Defender) and found it had turned itself back on (I had it turned off since I have an AV), was checking for definitions before running scans, apparently downloading and installing them, and also has something I hadn't seen before: Microsoft SpyNet. Supposedly, it only sends information about detected spyware threats but one line in what SpyNet does was especially chilling: "In some instances, personal information might be unintentionally sent to Microsoft." Unintentionally my Aunt Fanny! MSpy went too far a long time ago and has been steadily getting worse. I may not wait until 2020 to tell MSpy to go to hell!

RE: KB915597

I've been messing aroud with Portable Windows Updates Notifier (application) and interestingly the default settings automatically install KB915597. Personally, I set the app not to install that update. So the question is why does this app offer to install this update by default? It also offers to install KB2310138.

UsernameIssues · Sep 20, 2015

I don't want to pollute Lady Fitzgerald's thread by continuing to document the interactions of MSE and WD. I just offered a possible explanation as to why the scheduled task for WD was not found.

Lady Fitzgerald is using Avast and it had an update recently (see here).

Maybe:
1) During that update, it uninstalls part of the core components before installing new core files.

2) During the uninstall process, WD was enabled.

3) The update installation of the new version failed to disable WD.

I did download the latest free version. That install did disable WD; however, a full install might differ from an update install. Maybe other Avast users could check to see if WD is currently disabled.

None of the above info explains why/how the WD definitions updated.

Lady Fitzgerald · Sep 20, 2015

UsernameIssues said:
I don't want to pollute Lady Fitzgerald's thread by continuing to document the interactions of MSE and WD. I just offered a possible explanation as to why the scheduled task for WD was not found.

Lady Fitzgerald is using Avast and it had an update recently (see here).

Maybe:
1) During that update, it uninstalls part of the core components before installing new core files.

2) During the uninstall process, WD was enabled.

3) The update installation of the new version failed to disable WD.

I did download the latest free version. That install did disable WD; however, a full install might differ from an update install. Maybe other Avast users could check to see if WD is currently disabled.

None of the above info explains why/how the WD definitions updated.

I haven't updated Avast yet. They have had too many problem updates lately so I'm waiting to see if any get reported, same as I do with MSpy updates.

NoelDP · Sep 20, 2015

..so why not report the problems yourself?

Lady Fitzgerald · Sep 20, 2015

NoelDP said:
..so why not report the problems yourself?

Because I prefer to avoid them.

*&^%$#@! MSpy did it again!

Senioritis Member

My Computer

3 Brain Cells

My Computer

Senioritis Member

My Computer

Three-Toed Sloth

My Computer

R.I.P. Britton30=Gary

My Computer

Senioritis Member

My Computer

R.I.P. Britton30=Gary

My Computer

Senioritis Member

My Computer

R.I.P. Britton30=Gary

My Computer

New member

My Computer

Senioritis Member

My Computer

New member

My Computer

a.k.a. UNI

My Computer

New member

My Computer

R.I.P. Britton30=Gary

My Computer

New member

My Computer

a.k.a. UNI

My Computer

Senioritis Member

My Computer

Three-Toed Sloth

My Computer

Senioritis Member

My Computer