MS AntiSpyware got confused

Topic

New Reply

How about this one:

This morning I activated the AVG e-mail scanner in the AVG Control Center, and up pops an informational alert from MS AntiSpyware telling me something. I obviously has MSAS real-time protection activated (I thought I might evaluate it for some month).

Now, since my focus was on the e-mail scanner I didn’t get enough time to read the message, so I went over to MSAS > Real-time Protection > View all events. Here I find MSAS telling me that a startup value for Zone Labs Client has been added to a Run-key. Very funny, since that value has been there long before MSAS was installed.

This aside, I do think there is use for this real-time protection. One month ago, when I added a site to “Trusted sites” I got amused when MSAS popped up telling me what I had done. Ah well, it’s still beta.

Argus

Reply | Quote

Replies

Some software does not check if a particular key or value is already present in the registry — it just (re-)writes it. This will trigger any software designed to report on registry “changes”…

John

Reply | Quote

Also, updates will change either the scanner or the scanned file. If the scanner is changed, it may be reset and must learn your system again. If the the scanned file is changed, the scanner sees it as a changed (or new) file and yells at you to reconfirm. I see that as a good thing – I don’t think I want my scanners to automatically accept at changes.

Bill (AFE7Ret)
Freedom isn't free!

Reply | Quote

“Some software does not check if a particular key or value is already present in the registry — it just (re-)writes it.”

I can understand that.

But it was not the Zone Alarm value that was changed; it was the e-mail scanner that was added. And if, for any odd reason, the Zone Alarm value was changed at the same time both would have been reported by MSAS.

Argus

Reply | Quote

All the active protection I run works much the same way, including WinPatrol, SpyBot TeaTimer, and active protection from PestPatrol. On my personal machine, add ZoneAlarm Pro to that mix.

Reply | Quote

I am not sure I understand what you say. Of course “active protection” will from time to time generate alert messages that are only a confirmation of what you just did. And that can sometimes be funny, trustful that everything is working or something else.

But my post was about the fact that MSAS reported another program than that that changed start key value.

Regards,
Argus

Reply | Quote