The Grey Chronicles

2010.October.27

Goodbye Spybot, Hello MSSE Redux, Part II


MSSE Status Notification: 26 Oct 2010For several weeks now, every computer start-up, I have grown accustomed to the Microsoft Security Essentials [MSSE] with a status notification, shown left, that it isn’t monitoring your computer because the program’s service stopped. You should start it now.

Furthermore, the Real-Time Protection is Off, while the Virus & spyware definitions are declared Out of date and a big red command bar is offered to Start now, meaning to start the AntiMalware Service Executable [MsMpEng.exe]!

All these are happening even if I have not deliberately turned Off the AntiMalware Service Executable; made sure that the Microsoft Updates downloaded the updates for both these definitions; and left the Real-Time Protection On prior shutting down the computer before turning in for bed!

Verifying the running processes in the Task Manager, the AntiMalware Service Executable [MsMpEng.exe], the Microsoft Security Essentials User Interface [msseces.exe], as well as the Windows Update Autoupdate Client [wuauclt.exe] are ALL currently running.

The Windows Update Autoupdate Client is increasing its memory usage second-by-second, EVEN if the computer has yet to connect to the Internet, plus the fact that in the Internet Options, I have configured to Never dial a connection!

In the Task Manager, when Windows Update Autoupdate Client’s memory usage reaches its usual peak of 125 MB then lowers to about 6,000 K, its normal level, the Microsoft Security Essentials icon in the System Tray turns green. After a while, the MSSE’s icon in the System Tray starts rotating. Meaning, MSSE is now updating the definitions even without the benefit of an Internet connection?

Viewing the Microsoft Security Essentials User Interface, particularly in the Update panel would show that an error has occurred: failed to connect to the Internet! Furthermore, in the Event Viewer, an Event ID: 2001 could also be found.

Snapshot: ProxyCfgMicrosoft Support Knowledge Base 900936 describes that Error code: 0x8024402c may occur if proxy or firewall settings are configured incorrectly. Tried the two Methods to correct this error to no avail. The command proxycfg -d was used. As I am using a Broadband connection, the command would obviously find that I selected direct access, but tried it anyway [see the result in the snapshot shown right]. I do not use any Local Area Network [LAN], thus tweaking the LAN Settings would not apply! The article in UpdateXP was more helpful, but still Event ID: 2001 recurred every start-up!

MSSE Status Notification: 27 Oct 2010Then today, when I started up my vintage 519-MHz mobile AMD Athlon Compaq Presario notebook with 448 MB of RAM running Windows XP SP3, the Microsoft Security Essentials [MSSE] status notification, shown left, is worst than yesterday.

The Real-Time Protection is Off, while the Antivirus & Antispyware protection are declared Disabled and a big red command bar is offered to Start now, meaning to start the AntiMalware Service Executable [MsMpEng.exe]! Fortunately, the Virus & spyware definitions are declared Up to date and a big red command bar is offered to Turn on, meaning to start the AntiMalware Service Executable [MsMpEng.exe] then manually turn on the Real-Time Protection!

Task Manager: MSSE Update: AM_Delta_Patch1.exeI remember that prior to logging off the Broadband Internet yesterday, Microsoft Updates applied AM_Delta_Patch1.exe, see snapshot shown right. On-line details of this particular file, AM_Delta_Patch1.exe, proved elusive.

PC Pitstop Process Library states am_delta_patch1.exe is returning insufficient information about this program. Searching this file in Microsoft Downloads, but even Microsoft, using its interactive Bing search engine, states: Sorry, no results were found. Never mind its suggestions for help or to search again, they will not!

AM_Delta_Patch1.exe is part of Microsoft Security Essentials, it usually appears in C:\WINDOWS\SoftwareDistribution\Download\Install directory and is immediately deleted after the patch is installed. In case it remains after a system reboot, use CCleaner instead of doing what Microsoft suggests: disable Automatic Updates from Microsoft Services Console, manually delete files from C:\WINDOWS\SoftwareDistribution\Download\, re-enable Automatic Updates from Microsoft Services Console, then Reboot!

Waited for some minutes after cold start-up for everything to load in the background, and surely, MSSE’s icon turned from red to green. And yes, Windows Update Autoupdate Client [wuauclt.exe] is resource-hogging, again! And yes, MSSE tried again to get updates even without the benefit of an Internet connection! At least, Avira AntiVir Personal, which is also free, never downloads updates when the computer is off-line!

Arrgh! Maybe there is really truth to my usual signature block: More often than not the best things in life are not for free, and that quote aptly applies to the free security add-on from Microsoft.


Notes:

Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 LicenseDisclaimer: These posts do not necessarily represent any organization’s positions, strategies or opinions; refer to this blog’s self-imposed rules: A New Year; New Rules. Unless otherwise expressly stated, posts are licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 License. Comments are moderated to keep the discussion/s relevant and civil. Readers are responsible for their own statement/s.

Next Page »

Blog at WordPress.com.