Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 856443" data-attributes="member: 32260">&quot;New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1&quot;means that Windows Defender service was activated.This happens when you (re)start your computer. As @[USER=52096]Gandalf_The_Grey[/USER] already noticed, this can also happen when WD is updating. You can compare the time of last such event with the last system start or WD update.If it is not correlated with the above events, then something else (also the malware) could interfere with WD service. But, I did not hear about the malware that wanted to turn ON the WD service.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 856443, member: 32260"] [I]"New value: HKLM\SOFTWARE\Microsoft\Windows Defender\IsServiceRunning = 0x1"[/I] means that Windows Defender service was activated. This happens when you (re)start your computer. As @[USER=52096]Gandalf_The_Grey[/USER] already noticed, this can also happen when WD is updating. You can compare the time of last such event with the last system start or WD update. If it is not correlated with the above events, then something else (also the malware) could interfere with WD service. But, I did not hear about the malware that wanted to turn ON the WD service.:)(y) [/QUOTE]

Verification