Defender won't run at startup

Rojo;

Since you can run Defender manually, I rather imagine your also running
Windows Live OneCare which by default disables Windows Defender, but
doesn't remove it. Should you choose to remove OneCare in the future,
Defender will re-activate automatically and should again run at
startup.

http://windowsonecare.spaces.live.com/Blog/cns!C29701F38A601141!3842.entry


--
Dave M
------------------------------------------------------------------------
Dave M's Profile: http://forums.techarena.in/member.php?userid=25399
View this thread: http://forums.techarena.in/showthread.php?t=962405

http://forums.techarena.in

Nope. Not running OneCare. I do have ESET NOD32 running; I don't know if
this does the same thing. Interestingly, Security Center tells me Defender
is running, even though it doesn't show in the Task Manager.

Having now run it manually (it'll stay resident until I reboot now) I can
see the last update was on May 1st. This seems reasonably up-to-date, unless
it updates daily like most other malware software. I'll try not to worry
about it too much.

It just seems a bit odd. I regularly used to see the animated taskbar icon
that showed me it was running a scan. I've not seen that for ages.



"Dave M" <Dave.M.38yn7d.DeleteThis@DoNotSpam.com> wrote in message
news:Dave.M.38yn7d@DoNotSpam.com...
>
> Rojo;
>
> Since you can run Defender manually, I rather imagine your also running
> Windows Live OneCare which by default disables Windows Defender, but
> doesn't remove it. Should you choose to remove OneCare in the future,
> Defender will re-activate automatically and should again run at
> startup.
>
> http://windowsonecare.spaces.live.com/Blog/cns!C29701F38A601141!3842.entry
>
>
> --
> Dave M
> ------------------------------------------------------------------------
> Dave M's Profile: http://forums.techarena.in/member.php?userid=25399
> View this thread: http://forums.techarena.in/showthread.php?t=962405
>
> http://forums.techarena.in
>

Only OneCare, not ESET, should have that effect because the Defender
functions are included in the OneCare suite, and it wouldn't be
benificial to have two copies of the same Anti-Spyware running.

I agree it's odd. Some things to check. In WD options you have
automatically scan my computer, use real-time protection, and use
Windows Defender checked correct? Task Manager should show both
processes MSASCui.exe and MsMPEng.exe running.

Also the following System Services need to be in Started Status for WD
to run:
1.Automatic Updates
2.Background Intelligent Transfer Service (BITS)
3.Cryptographic Services
4.Remote Procedure Call (RPC)
5.Windows Defender

As to the scheduled scan running, WD uses the System Scheduler, so
make sure Control Panel > Scheduled Tasks > Advanced > View hidden
tasks is checked, then see when the last MP Scheduled scan was run,
also right click that task and attempt to initiate a immediate run of
the scan. What happens when you do that, does the scan start, and the
animated icon appear in the taskbar notification area?

You're pretty current as far as definition updates go, although there
was one earlier today 5/06. Defender usually updates automatically
once, sometimes twice a week.


--
Dave M
------------------------------------------------------------------------
Dave M's Profile: http://forums.techarena.in/member.php?userid=25399
View this thread: http://forums.techarena.in/showthread.php?t=962405

http://forums.techarena.in

"Dave M" <Dave.M.3909je.RemoveThis@DoNotSpam.com> wrote in message
news:Dave.M.3909je@DoNotSpam.com...
>
>
> I agree it's odd. Some things to check. In WD options you have
> automatically scan my computer, use real-time protection, and use
> Windows Defender checked correct? Task Manager should show both
> processes MSASCui.exe and MsMPEng.exe running.
>

All those options are indeed checked. MSASCui.exe is running, but only
because I launched Defendr manually to check the settings. MsMPEng.exe is
not running. I can't even find this file on my system. It's not in
System32 and a Windows Search of Everywhere comes up blank (although this
happens more often than no, whatever I'm searching for).

> Also the following System Services need to be in Started Status for WD
> to run:
> 1.Automatic Updates
> 2.Background Intelligent Transfer Service (BITS)
> 3.Cryptographic Services
> 4.Remote Procedure Call (RPC)
> 5.Windows Defender
>
Automatic Updates isn't even listed in Services. Windows Update is set to
install updates automatically, but now I think about it I can't remember the
last time I saw this happen either. All the other services you mentioned
are Started, although Cryptographic Services is set to Manual rather than
Automatic. Is this OK?


> As to the scheduled scan running, WD uses the System Scheduler, so
> make sure Control Panel > Scheduled Tasks > Advanced > View hidden
> tasks is checked, then see when the last MP Scheduled scan was run,
> also right click that task and attempt to initiate a immediate run of
> the scan. What happens when you do that, does the scan start, and the
> animated icon appear in the taskbar notification area?
>

Last Run Time: Never. Right-clicking and selecting Run has no visible
effect whatsoever, although since doing it this post lost focus a couple of
times as I was typing this, so presumably something tried to happen.

I'm just in the process of running sfc /scannow but the last time I ran it
(a couple of weeks ago) it didn't find any problems. I'll post again if it
finds anything.

Rojo;

There's a couple of problems at least. MsMpEng.exe (WD scan engine)
should be in the Program files/Windows Defender folder. Seems like
Defender got hosed at some point. Can you try a repair install if your
running XP
(I don't think you're running on Vista where this won't work):
Control Panel > Add/Remove > highlight Windows Defender > click Support
Info > click Repair.
That should fix Defender without having to re-install completely.

Look at this post for your automatic updates service missing problem:
http://www.aota.net/forums/archive/index.php/t-17881.html
Crypto service in manual mode is just fine.

I wonder why you got so many problems showing up at once? Did that
machine have an infection in the past that got cleaned up?


--
Dave M
------------------------------------------------------------------------
Dave M's Profile: http://forums.techarena.in/member.php?userid=25399
View this thread: http://forums.techarena.in/showthread.php?t=962405

http://forums.techarena.in

Hello Rojo,

You might try this.

Go to the main Windows Update window and click on "Installed Updates" (on
the left-hand side of the window, at the bottom), and then remove "Update for
Microsoft Windows (KB931099)" (only).

Reboot. Reboot again. (2 Reboots) Go back to Windows Update, and re-install
the same update, by clicking on the Check for Updates button.

Other folks may have additional ideas for you; hope this helps a bit, see if
that helps.

Let us know how it works ºut.

Good luck
- -- ---

"Rojo Habe" wrote:

> I've just noticed that Defender isn't running, even though the Registry key
> (HKLM\Software\Microsoft\Windows\CurrentVersion\Run) is there. The path
> specified by this key (%ProgramFiles%\Windows Defender\MSASCui.exe -hide) is
> valid. I can copy and paste it into a Run box and the process appears in the
> Task Manager (and stays there until I reboot). If I view the System Startup
> page in Spybot S&D the key exists. I've actually changed '%ProgramFiles%'
> to 'C:\Program Files' (without the quotes) to see if it makes a difference -
> it doesn't. If I view the Startups tab in The Ultimate Troubleshooter it
> finds the key but shows File Not Found in the Launch Command field.
>
> I'm at a bit of a loss. I thought perhaps the permissions had got screwed
> up for either the Windows Defender folder or the executable itself, but if
> that were the case, should I be able to run the command manually? In any
> case, the permissions can't be edited. Everything's greyed out.
>
> I'm quite happy to run without Defender; I'd just rather be the one who
> decides. I'm concerned that to all intents and purposes it's supposed to be
> running but isn't.
>
> Any ideas?
>