Searching for Windows Firewall help.

[frog]

Windows XP Pro SP3

My Event Viewer/System continues to show an ! in a yellow triangle
several times a day....for example:

Type: Warning, Date: 5/29/2009, Time: 7:48:46 AM, WinDefend, Category:
None, Event: 3004, User: N/a, Computer: Frog-ADF6F860

When I click on an entry of this type, I get the following:

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 5/29/2009
Time: 7:48:46 AM
User: N/A
Computer: Frog-ADF6F860
Description:
Windows Defender Real-Time Protection agent has detected changes.
Microsoft recommends you analyze the software that made these changes
for potential risks. You can use information about how these programs
operate to choose whether to allow them to run or remove them from your
computer. Allow changes only if you trust the program or the software
publisher. Windows Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {BACBCD4F-70B0-4898-B483-2DA0C0F02692}
User: Frog-ADF6F860\Frog Pond
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found:
firewallport:HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1130:UDP
Alert Type: Unclassified software
Detection Type:

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

When visiting this web page I get the following:

Results for: Microsoft Product: Windows Defender; Version: 1.1.1593.0;
Event ID: 3004; Event Source: WinDefend; File Name: MpEvMsg.dll;

No results were found for your query. Please see Search Help for
suggestions.


My many hours of trying to understand this problem, seeking help from
this news group, and watching this problem happen several times a day
has me completely baffled. First of all, I'm not sure that this is a
problem that I should really be concerned about. Secondly, I have no
clue as to what software on my system is causing this problem to occur.
It seems that Ports (several different ports numbers are involved) are
open via my Windows Firewall and that Windows Defender is letting me
know that this is a potential danger to my system. I'm not sure how
these ports were opened in the first place (I did not knowingly open any
ports on my Windows Firewall)and I do not know how to close ports on the
Windows Firewall. I have learned through my research that is is
possible to open ports on the Windows Firewall...but I did not learn how
to close ports. I also did not learn how to identify what ports are
open and what software is involved with open ports.

I have two thoughts about what could be causing this ongoing problem to
occur, but my limited technical skills are keeping me from knowing what
to do next. For example, I once had my Windows 98SE machine networked
with my Windows XP machine via a Verizon installed router. This
connection is currently not in use and could be terminated (not sure how
to do this). I believe this connection through the router must involve
open ports in some way. Secondly, I have a couple of games installed on
my system that are used on seldom occasions...one that shows in the
Windows Firewall/Exceptions window. I could remove this software from
my system via the Add/Remove process (I'm not sure whether this action
will also remove the game entry from the Windows Firewall/Exceptions
window). I have no other thoughts about what might have ports open on
my system. Is there a system log some place on my computer that records
information about port use? I'm not aware of such a log if it exists;
but, as I said earlier, I have limited knowledge about such details.
Would it be better for me to present this problem in a different
newsgroup, and, if so, what news group?

I am looking to any thoughts/guidance that you want to share with me on
this subject.


Frog

[shenan stanley]

Frog wrote:
> Windows XP Pro SP3
>
> My Event Viewer/System continues to show an ! in a yellow triangle
> several times a day....for example:
>
> Type: Warning, Date: 5/29/2009, Time: 7:48:46 AM, WinDefend,
> Category: None, Event: 3004, User: N/a, Computer: Frog-ADF6F860
>
> When I click on an entry of this type, I get the following:
>
> Event Type: Warning
> Event Source: WinDefend
> Event Category: None
> Event ID: 3004
> Date: 5/29/2009
> Time: 7:48:46 AM
> User: N/A
> Computer: Frog-ADF6F860
> Description:
> Windows Defender Real-Time Protection agent has detected changes.
> Microsoft recommends you analyze the software that made these
> changes for potential risks. You can use information about how
> these programs operate to choose whether to allow them to run or
> remove them from your computer. Allow changes only if you trust
> the program or the software publisher. Windows Defender can't undo
> changes that you allow. For more information please see the
> following: http://go.microsoft.com/fwlink/?linkid=74409
> Scan ID: {BACBCD4F-70B0-4898-B483-2DA0C0F02692}
> User: Frog-ADF6F860\Frog Pond
> Name: Unknown
> ID:
> Severity: Not Yet Classified
> Category: Not Yet Classified
> Path Found:
> firewallport:HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1130:UDP
> Alert Type: Unclassified software
> Detection Type:
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> When visiting this web page I get the following:
>
> Results for: Microsoft Product: Windows Defender; Version:
> 1.1.1593.0; Event ID: 3004; Event Source: WinDefend; File Name:
> MpEvMsg.dll;
> No results were found for your query. Please see Search Help for
> suggestions.
>
>
> My many hours of trying to understand this problem, seeking help
> from this news group, and watching this problem happen several
> times a day has me completely baffled. First of all, I'm not sure
> that this is a problem that I should really be concerned about. Secondly,
> I have no clue as to what software on my system is
> causing this problem to occur. It seems that Ports (several
> different ports numbers are involved) are open via my Windows
> Firewall and that Windows Defender is letting me know that this is
> a potential danger to my system. I'm not sure how these ports were
> opened in the first place (I did not knowingly open any ports on my
> Windows Firewall)and I do not know how to close ports on the
> Windows Firewall. I have learned through my research that is is
> possible to open ports on the Windows Firewall...but I did not
> learn how to close ports. I also did not learn how to identify
> what ports are open and what software is involved with open ports.
> I have two thoughts about what could be causing this ongoing
> problem to occur, but my limited technical skills are keeping me
> from knowing what to do next. For example, I once had my Windows
> 98SE machine networked with my Windows XP machine via a Verizon
> installed router. This connection is currently not in use and
> could be terminated (not sure how to do this). I believe this
> connection through the router must involve open ports in some way.
> Secondly, I have a couple of games installed on my system that are
> used on seldom occasions...one that shows in the Windows
> Firewall/Exceptions window. I could remove this software from my
> system via the Add/Remove process (I'm not sure whether this action
> will also remove the game entry from the Windows
> Firewall/Exceptions window). I have no other thoughts about what
> might have ports open on my system. Is there a system log some
> place on my computer that records information about port use? I'm
> not aware of such a log if it exists; but, as I said earlier, I
> have limited knowledge about such details. Would it be better for
> me to present this problem in a different newsgroup, and, if so,
> what news group?
> I am looking to any thoughts/guidance that you want to share with
> me on this subject.

Uninstall Windows Defender for now.

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

What AntiVirus software do you have?

I suggest something simple and effective like AntiVir, Avast! or AVG... eSet
NOD32 is great if you want to purchase one.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

[smlunatick]

On May 29, 3:47

[frog]

Shenan Stanley wrote:
> Frog wrote:
>> Windows XP Pro SP3
>>
>> My Event Viewer/System continues to show an ! in a yellow triangle
>> several times a day....for example:
>>
>> Type: Warning, Date: 5/29/2009, Time: 7:48:46 AM, WinDefend,
>> Category: None, Event: 3004, User: N/a, Computer: Frog-ADF6F860
>>
>> When I click on an entry of this type, I get the following:
>>
>> Event Type: Warning
>> Event Source: WinDefend
>> Event Category: None
>> Event ID: 3004
>> Date: 5/29/2009
>> Time: 7:48:46 AM
>> User: N/A
>> Computer: Frog-ADF6F860
>> Description:
>> Windows Defender Real-Time Protection agent has detected changes.
>> Microsoft recommends you analyze the software that made these
>> changes for potential risks. You can use information about how
>> these programs operate to choose whether to allow them to run or
>> remove them from your computer. Allow changes only if you trust
>> the program or the software publisher. Windows Defender can't undo
>> changes that you allow. For more information please see the
>> following: http://go.microsoft.com/fwlink/?linkid=74409
>> Scan ID: {BACBCD4F-70B0-4898-B483-2DA0C0F02692}
>> User: Frog-ADF6F860\Frog Pond
>> Name: Unknown
>> ID:
>> Severity: Not Yet Classified
>> Category: Not Yet Classified
>> Path Found:
>> firewallport:HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1130:UDP
>> Alert Type: Unclassified software
>> Detection Type:
>>
>> For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>>
>> When visiting this web page I get the following:
>>
>> Results for: Microsoft Product: Windows Defender; Version:
>> 1.1.1593.0; Event ID: 3004; Event Source: WinDefend; File Name:
>> MpEvMsg.dll;
>> No results were found for your query. Please see Search Help for
>> suggestions.
>>
>>
>> My many hours of trying to understand this problem, seeking help
>> from this news group, and watching this problem happen several
>> times a day has me completely baffled. First of all, I'm not sure
>> that this is a problem that I should really be concerned about. Secondly,
>> I have no clue as to what software on my system is
>> causing this problem to occur. It seems that Ports (several
>> different ports numbers are involved) are open via my Windows
>> Firewall and that Windows Defender is letting me know that this is
>> a potential danger to my system. I'm not sure how these ports were
>> opened in the first place (I did not knowingly open any ports on my
>> Windows Firewall)and I do not know how to close ports on the
>> Windows Firewall. I have learned through my research that is is
>> possible to open ports on the Windows Firewall...but I did not
>> learn how to close ports. I also did not learn how to identify
>> what ports are open and what software is involved with open ports.
>> I have two thoughts about what could be causing this ongoing
>> problem to occur, but my limited technical skills are keeping me
>> from knowing what to do next. For example, I once had my Windows
>> 98SE machine networked with my Windows XP machine via a Verizon
>> installed router. This connection is currently not in use and
>> could be terminated (not sure how to do this). I believe this
>> connection through the router must involve open ports in some way.
>> Secondly, I have a couple of games installed on my system that are
>> used on seldom occasions...one that shows in the Windows
>> Firewall/Exceptions window. I could remove this software from my
>> system via the Add/Remove process (I'm not sure whether this action
>> will also remove the game entry from the Windows
>> Firewall/Exceptions window). I have no other thoughts about what
>> might have ports open on my system. Is there a system log some
>> place on my computer that records information about port use? I'm
>> not aware of such a log if it exists; but, as I said earlier, I
>> have limited knowledge about such details. Would it be better for
>> me to present this problem in a different newsgroup, and, if so,
>> what news group?
>> I am looking to any thoughts/guidance that you want to share with
>> me on this subject.
>
> Uninstall Windows Defender for now.
>
> Download, install, run, update and perform a full scan (separately) with the
> following two applications (freeware versions are the ones to use for this):
>
> SuperAntiSpyware
> http://www.superantispyware.com/
>
> MalwareBytes
> http://www.malwarebytes.com/
>
> After performing a full scan with one and then the other and removing
> whatever they both find completely, you may uninstall these products,
> if you wish.
>
> What AntiVirus software do you have?
>
> I suggest something simple and effective like AntiVir, Avast! or AVG... eSet
> NOD32 is great if you want to purchase one.
>
This machine has had CA AntiVirus software active on it continuously
from the day it was purchased. This software is updated
automatically...usually at startup each morning and I see a window on
the screen several times during a day that informs me that it was
updated successfully.

I have Malwarebytes on my system and I run this software at least two or
three times a week. This software has found only one problem since it
was originally installed.

I will give the SuperAntiSpyware software a try next. I presume that I
should do this after removing the Windows Defender software.

FYI, my computer seems to be performing normally regardless of what I
see in the Event Viewer log.

Is there a way of reinstalling Windows Defender after I remove it from
my system?

Frog

[frog]

Frog wrote:
> Shenan Stanley wrote:
>> Frog wrote:
>>> Windows XP Pro SP3
>>>
>>> My Event Viewer/System continues to show an ! in a yellow triangle
>>> several times a day....for example:
>>>
>>> Type: Warning, Date: 5/29/2009, Time: 7:48:46 AM, WinDefend,
>>> Category: None, Event: 3004, User: N/a, Computer: Frog-ADF6F860
>>>
>>> When I click on an entry of this type, I get the following:
>>>
>>> Event Type: Warning
>>> Event Source: WinDefend
>>> Event Category: None
>>> Event ID: 3004
>>> Date: 5/29/2009
>>> Time: 7:48:46 AM
>>> User: N/A
>>> Computer: Frog-ADF6F860
>>> Description:
>>> Windows Defender Real-Time Protection agent has detected changes.
>>> Microsoft recommends you analyze the software that made these
>>> changes for potential risks. You can use information about how
>>> these programs operate to choose whether to allow them to run or
>>> remove them from your computer. Allow changes only if you trust
>>> the program or the software publisher. Windows Defender can't undo
>>> changes that you allow. For more information please see the
>>> following: http://go.microsoft.com/fwlink/?linkid=74409
>>> Scan ID: {BACBCD4F-70B0-4898-B483-2DA0C0F02692}
>>> User: Frog-ADF6F860\Frog Pond
>>> Name: Unknown
>>> ID:
>>> Severity: Not Yet Classified
>>> Category: Not Yet Classified
>>> Path Found:
>>> firewallport:HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1130:UDP
>>>
>>> Alert Type: Unclassified software
>>> Detection Type:
>>>
>>> For more information, see Help and Support Center at
>>> http://go.microsoft.com/fwlink/events.asp.
>>>
>>> When visiting this web page I get the following:
>>>
>>> Results for: Microsoft Product: Windows Defender; Version:
>>> 1.1.1593.0; Event ID: 3004; Event Source: WinDefend; File Name:
>>> MpEvMsg.dll;
>>> No results were found for your query. Please see Search Help for
>>> suggestions.
>>>
>>>
>>> My many hours of trying to understand this problem, seeking help
>>> from this news group, and watching this problem happen several
>>> times a day has me completely baffled. First of all, I'm not sure
>>> that this is a problem that I should really be concerned about.
>>> Secondly, I have no clue as to what software on my system is
>>> causing this problem to occur. It seems that Ports (several
>>> different ports numbers are involved) are open via my Windows
>>> Firewall and that Windows Defender is letting me know that this is
>>> a potential danger to my system. I'm not sure how these ports were
>>> opened in the first place (I did not knowingly open any ports on my
>>> Windows Firewall)and I do not know how to close ports on the
>>> Windows Firewall. I have learned through my research that is is
>>> possible to open ports on the Windows Firewall...but I did not
>>> learn how to close ports. I also did not learn how to identify
>>> what ports are open and what software is involved with open ports.
>>> I have two thoughts about what could be causing this ongoing
>>> problem to occur, but my limited technical skills are keeping me
>>> from knowing what to do next. For example, I once had my Windows
>>> 98SE machine networked with my Windows XP machine via a Verizon
>>> installed router. This connection is currently not in use and
>>> could be terminated (not sure how to do this). I believe this
>>> connection through the router must involve open ports in some way.
>>> Secondly, I have a couple of games installed on my system that are
>>> used on seldom occasions...one that shows in the Windows
>>> Firewall/Exceptions window. I could remove this software from my
>>> system via the Add/Remove process (I'm not sure whether this action
>>> will also remove the game entry from the Windows
>>> Firewall/Exceptions window). I have no other thoughts about what
>>> might have ports open on my system. Is there a system log some
>>> place on my computer that records information about port use? I'm
>>> not aware of such a log if it exists; but, as I said earlier, I
>>> have limited knowledge about such details. Would it be better for
>>> me to present this problem in a different newsgroup, and, if so,
>>> what news group?
>>> I am looking to any thoughts/guidance that you want to share with
>>> me on this subject.
>>
>> Uninstall Windows Defender for now.
>>
>> Download, install, run, update and perform a full scan (separately)
>> with the
>> following two applications (freeware versions are the ones to use for
>> this):
>>
>> SuperAntiSpyware
>> http://www.superantispyware.com/
>>
>> MalwareBytes
>> http://www.malwarebytes.com/
>>
>> After performing a full scan with one and then the other and removing
>> whatever they both find completely, you may uninstall these products,
>> if you wish.
>>
>> What AntiVirus software do you have?
>>
>> I suggest something simple and effective like AntiVir, Avast! or
>> AVG... eSet NOD32 is great if you want to purchase one.
>>
> This machine has had CA AntiVirus software active on it continuously
> from the day it was purchased. This software is updated
> automatically...usually at startup each morning and I see a window on
> the screen several times during a day that informs me that it was
> updated successfully.
>
> I have Malwarebytes on my system and I run this software at least two or
> three times a week. This software has found only one problem since it
> was originally installed.
>
> I will give the SuperAntiSpyware software a try next. I presume that I
> should do this after removing the Windows Defender software.
>
> FYI, my computer seems to be performing normally regardless of what I
> see in the Event Viewer log.
>
> Is there a way of reinstalling Windows Defender after I remove it from
> my system?
>
> Frog

Additional to the above-
I conducted total SuperAntiSpyware Scan of my system, and here is the
summary:

SUPERAntiSpyware Scan Summary
Potentially harmful items have been detected on your computer. It is
advised that you quarantine and remove these items to prevent further
infection.
Memory Items Detected - 0
Files Detected 520 (Adware Tracking Cookies)
Registry Items Detected - 0
Total Threats Detected - 520
Scan Time - 00:21:48
Click the Ok button to review the detected items.
Ok

All 520 threats detected are now resident in a quarantine file. Is it
possible that one or more of these threats was the cause of my problem.

Frog

[frog]

smlunatick wrote:
> On May 29, 3:47 pm, Frog <f...@pond.com> wrote:
>> Shenan Stanley wrote:
>>> Frog wrote:
>>>> Windows XP Pro SP3
>>>> My Event Viewer/System continues to show an ! in a yellow triangle
>>>> several times a day....for example:
>>>> Type: Warning, Date: 5/29/2009, Time: 7:48:46 AM, WinDefend,
>>>> Category: None, Event: 3004, User: N/a, Computer: Frog-ADF6F860
>>>> When I click on an entry of this type, I get the following:
>>>> Event Type: Warning
>>>> Event Source: WinDefend
>>>> Event Category: None
>>>> Event ID: 3004
>>>> Date: 5/29/2009
>>>> Time: 7:48:46 AM
>>>> User: N/A
>>>> Computer: Frog-ADF6F860
>>>> Description:
>>>> Windows Defender Real-Time Protection agent has detected changes.
>>>> Microsoft recommends you analyze the software that made these
>>>> changes for potential risks. You can use information about how
>>>> these programs operate to choose whether to allow them to run or
>>>> remove them from your computer. Allow changes only if you trust
>>>> the program or the software publisher. Windows Defender can't undo
>>>> changes that you allow. For more information please see the
>>>> following:http://go.microsoft.com/fwlink/?linkid=74409
>>>> Scan ID: {BACBCD4F-70B0-4898-B483-2DA0C0F02692}
>>>> User: Frog-ADF6F860\Frog Pond
>>>> Name: Unknown
>>>> ID:
>>>> Severity: Not Yet Classified
>>>> Category: Not Yet Classified
>>>> Path Found:
>>>> firewallport:HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\1130:UDP
>>>> Alert Type: Unclassified software
>>>> Detection Type:
>>>> For more information, see Help and Support Center at
>>>> http://go.microsoft.com/fwlink/events.asp.
>>>> When visiting this web page I get the following:
>>>> Results for: Microsoft Product: Windows Defender; Version:
>>>> 1.1.1593.0; Event ID: 3004; Event Source: WinDefend; File Name:
>>>> MpEvMsg.dll;
>>>> No results were found for your query. Please see Search Help for
>>>> suggestions.
>>>> My many hours of trying to understand this problem, seeking help
>>>> from this news group, and watching this problem happen several
>>>> times a day has me completely baffled. First of all, I'm not sure
>>>> that this is a problem that I should really be concerned about. Secondly,
>>>> I have no clue as to what software on my system is
>>>> causing this problem to occur. It seems that Ports (several
>>>> different ports numbers are involved) are open via my Windows
>>>> Firewall and that Windows Defender is letting me know that this is
>>>> a potential danger to my system. I'm not sure how these ports were
>>>> opened in the first place (I did not knowingly open any ports on my
>>>> Windows Firewall)and I do not know how to close ports on the
>>>> Windows Firewall. I have learned through my research that is is
>>>> possible to open ports on the Windows Firewall...but I did not
>>>> learn how to close ports. I also did not learn how to identify
>>>> what ports are open and what software is involved with open ports.
>>>> I have two thoughts about what could be causing this ongoing
>>>> problem to occur, but my limited technical skills are keeping me
>>>> from knowing what to do next. For example, I once had my Windows
>>>> 98SE machine networked with my Windows XP machine via a Verizon
>>>> installed router. This connection is currently not in use and
>>>> could be terminated (not sure how to do this). I believe this
>>>> connection through the router must involve open ports in some way.
>>>> Secondly, I have a couple of games installed on my system that are
>>>> used on seldom occasions...one that shows in the Windows
>>>> Firewall/Exceptions window. I could remove this software from my
>>>> system via the Add/Remove process (I'm not sure whether this action
>>>> will also remove the game entry from the Windows
>>>> Firewall/Exceptions window). I have no other thoughts about what
>>>> might have ports open on my system. Is there a system log some
>>>> place on my computer that records information about port use? I'm
>>>> not aware of such a log if it exists; but, as I said earlier, I
>>>> have limited knowledge about such details. Would it be better for
>>>> me to present this problem in a different newsgroup, and, if so,
>>>> what news group?
>>>> I am looking to any thoughts/guidance that you want to share with
>>>> me on this subject.
>>> Uninstall Windows Defender for now.
>>> Download, install, run, update and perform a full scan (separately) with the
>>> following two applications (freeware versions are the ones to use for this):
>>> SuperAntiSpyware
>>> http://www.superantispyware.com/
>>> MalwareBytes
>>> http://www.malwarebytes.com/
>>> After performing a full scan with one and then the other and removing
>>> whatever they both find completely, you may uninstall these products,
>>> if you wish.
>>> What AntiVirus software do you have?
>>> I suggest something simple and effective like AntiVir, Avast! or AVG... eSet
>>> NOD32 is great if you want to purchase one.
>> This machine has had CA AntiVirus software active on it continuously
>> from the day it was purchased. This software is updated
>> automatically...usually at startup each morning and I see a window on
>> the screen several times during a day that informs me that it was
>> updated successfully.
>>
>> I have Malwarebytes on my system and I run this software at least two or
>> three times a week. This software has found only one problem since it
>> was originally installed.
>>
>> I will give the SuperAntiSpyware software a try next. I presume that I
>> should do this after removing the Windows Defender software.
>>
>> FYI, my computer seems to be performing normally regardless of what I
>> see in the Event Viewer log.
>>
>> Is there a way of reinstalling Windows Defender after I remove it from
>> my system?
>>
>> Frog
>
> Windows Defender was always a separate software from any XP version.

Thanks for the information.

Frog