Windows Defender Configuration has changed...by MALWARE!!

Z

zarm

New Member
Hi,

After I removed Bonjour from my laptop, windows defender always pop out an alert:

"A system change was made by a known application...change type: application execution...C:\windows\system32\mswsock.dll".

This happens when I connected to the network/internet and also disconnected from them.

When I checked through Event Viewer, I found some errors:

1- Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
Old value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = 1
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = 2

2- Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
Old value: Default\Real-Time Protection\EnableUnknownPrompts = 0
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\EnableUnknownPrompts = 1

3- Windows Defender Configuration has changed. If this is an unexpected event you should review the settings as this may be the result of malware.
Old value:
New value: HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction\1 = 6


Please HELP!!!!!! My laptop is just 5 months old but it goes slow day by day...

Thanks in advance!
​
 

My Computer

System One

Try a Trendmicro free scan.
 

My Computer

System One

  • CPU
    pair of Intel E5430 quad core 2.66 GHz Xeons
    Motherboard
    Supermicro X7DWA-N server board
    Memory
    16GB DDR667
    Graphics card(s)
    eVGA 8800 GTS 640 MB video card
    Hard Drives
    SAS RAID
Hello zarm,

Welcome to the forums!

I get this same message anytime I have to re-boot my internet modem.
Now I am not saying that yours can't be evilware; but it may be worth
checking out. The way I get around it is to re-boot with my computer off;
re-boot the modem then boot my machine back up.

Though it would be a real good idea to do thorough virus and spyware scans.

View attachment 4430

zarm said:
"A system change was made by a known application...change type: application execution...C:\windows\system32\mswsock.dll".
Click to expand...

Maybe if you attach a HijackThis log file (not copy/paste) someone will look at it for you.
Just heed the warnings that come with HijackThis!

TrendSecure | Download TrendMicro HijackThis


Later :shock: Ted
 
Last edited:

My Computer

System One

  • Manufacturer/Model
    * BFK Customs *
    CPU
    Intel C2Q 9550 Yorkfield
    Motherboard
    ASUS P5Q Pro
    Memory
    8GB Dominator 8500C5D
    Graphics card(s)
    XFX ATI 1GB 4870 XXX
    Sound Card
    Realtek HD 7-1
    Monitor(s) Displays
    1x 47" LCD HDMI & 2x 26" LCD HDMI
    Screen Resolution
    1920x1080P & 1920x1200
    Hard Drives
    2x 500GB 7200RPM 32MB Cache WD Caviar Black
    PSU
    Corsair 620HX
    Case
    CM Cosmos RC-1000
    Cooling
    Tuniq Tower 120, 2x 140mm and 3x 120mm case fans
    Mouse
    Razer Diamondback 3G
    Keyboard
    HP Enhansed Multimedia
    Internet Speed
    18.6Mb/s
    Other Info
    My First Build ;)
Bonjour is something that is installed by apple when installing itunes
Bonjour, formerly Rendezvous, is Apple Inc.'s trade name for its implementation of Zeroconf, a service discovery protocol used in Apple's Mac OS X operating system from version 10.2 onwards, and on Microsoft Windows operating systems when installed (it is installed with iTunes, for example). Intended for use on local area networks, Bonjour uses multicast Domain Name System service records to locate devices such as printers, as well as other computers, and the services that those devices offer.
The software is released under a terms-of-limited-use license by Apple. While it is freeware for clients, developers and software companies who want to include in their software package should check with Apple on licensing agreements.
Click to expand...
i sure that this is not malware affecting your system yet windows defender just getting a little over zellis
Bonjour is a general method to discover services on a local area network so im sure its just complaining about a change that needs to be made

http://en.wikipedia.org/wiki/Bonjour_(software)
 

My Computer

System One

  • Manufacturer/Model
    Me :P
    CPU
    Core 2 Quad Q6600
    Motherboard
    Abit IN9 32X MAX
    Memory
    8 GB OCZ PC2-6400 nVIDIA SLI-Ready Edition (4X2GB)
    Graphics card(s)
    AMP! GeForce GTX 260² 896MB 448-bit GDDR3 (650MHz/2100MHz
    Sound Card
    Realtek 7.1 CH HD Audio
    Monitor(s) Displays
    17" Fujitsu siemens TFT + 32" LG HD LCD TV
    Screen Resolution
    1280x1024 + 1360x768
    Hard Drives
    150GB Raptor HDD 500GB Caviar HDD
    PSU
    Thermaltake W0133RB 1200W PSU
    Case
    Antec 900
    Cooling
    Stock + Antec 900 case fans
    Mouse
    Logitech MX Revolution
    Keyboard
    Logitech G15 (full layout)
SCSIraidGURU said:
Try a Trendmicro free scan.
Click to expand...


GURU, I tried to follow your advice but the dialogbox below come out and after I clicked ok it still come out until I click cancel then the scanner in idle mode...i dont know??

Result from trendmicro free scan....
Scanning and Cleaning Complete

HouseCall did not find any potential threats on your computer. Make sure you run HouseCall once a week to keep your PC clean and malware free.:)
 

Attachments

  • trendmicrohousecall_error.jpg
    trendmicrohousecall_error.jpg
    9.9 KB · Views: 34
  • trendmicro_warning.jpg
    trendmicro_warning.jpg
    6.9 KB · Views: 1,142

My Computer

System One

Bare Foot Kid said:
Hello zarm,

Welcome to the forums!

I get this same message anytime I have to re-boot my internet modem.
Now I am not saying that yours can't be evilware; but it may be worth
checking out. The way I get around it is to re-boot with my computer off;
re-boot the modem then boot my machine back up.

Though it would be a real good idea to do thorough virus and spyware scans.

Maybe if you attach a HijackThis log file (not copy/paste) someone will look at it for you.
Just heed the warnings that come with HijackThis!

TrendSecure | Download TrendMicro HijackThis


Later :shock: Ted
Click to expand...

Hello BareFootKid,

Here is HijackThis log file. Hope you and other specialist can give excellent words! Thank Sir...
 

Attachments

My Computer

System One

Hi,
Regarding the hijackthis log i have a few questions.
Is your laptop a HP pavillon?
Do you run BBC iplayer?

With regards to the Defender alert, before telling how to avoid the alert when it is related to a known windows system file, would you please give the size of mswsock.dll (exact size please).
 

My Computer

System One

sidney1st said:
Hi,
Regarding the hijackthis log i have a few questions.
Is your laptop a HP pavillon?
Do you run BBC iplayer?

With regards to the Defender alert, before telling how to avoid the alert when it is related to a known windows system file, would you please give the size of mswsock.dll (exact size please).
Click to expand...

Hi Sid,

I'm using Presario V3631TU but not running BBC iplayer (even I never know about this player before).

About the size of mswsock.dll, from properties I got 223,232bytes/218KB (size) and 225,280bytes/220KB (size on disk). Am I correct?

Thank you in advance.
 

My Computer

System One

Then, no problems with the files i were thinking of.

You should (just my opinion) deinstall the Akamai activex and the toolbars which may alter your system.

With regards to the WD warnings, try this (if not done already)

In Defender, go to tools/options/Choose if windows Defender should notify you about
Untick "Software that has not been classified for risks" and do not forget to save.
Reboot
 

My Computer

System One

I'm quite release when u said no problem. But how do I uninstall akamai? I remembered this activeX was installed to download Adobe CS3 file. Try to install via Add/Remove but not find this akamai?

Thank u Sid.
 

My Computer

System One

It is an activeX, you can deinstall it in IE/Tools/manage add-ons

With regards of the ddl file, i said no problem because the version is right ;)
Sometimes malware come from the same file which has been replaced and therefore the size is different. So there is no problem in your hijackthis (no known bad files).
 

My Computer

System One

Help! I have the same problem but none of your suggestions have helped. The problem is really slowing down my computer. I don't use iTunes and can't find anything with the name akamai. I've run virus and malware scans and found nothing. I'm a little frustrated
:( I'd appreciate any help.
 

My Computer

System One

No malwares in your log.

To start with, clean temp files, Internet cache, etc... (crap cleaner does it very safely) and defrag your drive!
Then you could try this to find where from are coming your problems.
1/ In tolls/addons management, deactivate all plugins installed by yourself or by progs you installed.
2/ I noticed that you have some bars (yahoo, google), deactivate them.
3/ Open MSconfig, in startup untick all programs which are not necessary:
Nvidia, Adobe, Meteo, HP...
4/ Reboot and check if your machine runs fine.
 

My Computer

System One

I did everything that you recommended. The computer is definately faster but the same message pops up as soon as I log on-kinda like it's flipping me off! Any other ideas or should I just live with it? Thanks for the help!
 

My Computer

System One

For the popup:
Control Panel / Windows Defender / tools / options
Scroll down to "Choose if windows Defender should notify you about"
Uncheck Software that has not been classified for risks"
Click "SAVE"
If not solved, uncheck too: "Changes made to your computer
by software that is permitted to run"
Click "Save"
 

My Computer

System One

Thanks again. The message is gone and the computer is running faster BUT...it's like the symptoms are cured but what's the cause of the original trouble? Why are there changes being constantly made by mswsock.dll? Any ideas??
 

My Computer

System One

Maybe some registry changes that Defender does not appreciate or it could happen when you have a physical connection problem between your machine and the router (i've seen the case).
 

My Computer

System One

You must log in or register to reply here.
Back
Top