Windows Defender in Vista X64 Software Explorer

I'm not sure why, but when I use the software explorer in Windows Defender, all of the start up programs are not being listed; I mean nothing other than Windows programs. I know I have other start ups going. Is there a problem with defender in X64 vista?

I have also noticed that these start ups are not in the usual place; I found the registry entries for them: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] Maybe that is the reason that defender doesn't list them. Maybe someone that knows a little more than me can validate my finding and maybe have a solution for it.

hhhiii said:

I'm not sure why, but when I use the software explorer in Windows Defender, all of the start up programs are not being listed; I mean nothing other than Windows programs. I know I have other start ups going. Is there a problem with defender in X64 vista?

Click to expand...

Mine lists regular programs. (ATI/NOD32/Motorola/realtek HD audio).
software that is currently running on your computer that can affect your privacy or the security of your computer

Use Software Explorer in Windows Defender to view detailed information about software that is currently running on your computer that can affect your privacy or the security of your computer. You can see, for example, which programs run automatically when you start Windows and information about how these programs interact with important Windows programs and services.

Software Explorer helps you monitor the following items:

• Startup programs, which are programs that run automatically with or without your knowledge when you start Windows.
  Currently running programs, which are programs that are currently running on the screen or in the background.
  Network-connected programs, which are programs or processes that can connect to the Internet or to your home or office network.
• Winsock service providers, which are programs that perform low-level networking and communication services for Windows and programs that run on Windows. These programs often have access to important areas of the operating system.

To use Software Explorer to view software running on your computer

1. You can use Software Explorer to view and manage programs that you use. To view and manage programs and other software for all users on the computer, however, you need to provide an administrator password or permission.
   
   open Windows Defender.
   Click Tools, and then click Software Explorer.
2. In the Category list, select the type of software that you want to monitor. To monitor software that is used by all users on the computer, click Show for all users.
   
   If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Understanding Software Explorer details

Software Explorer displays basic information about programs, such as the program name, publisher, and version. Depending on the category you choose, you might also see these important types of information.

Source: Windows Vista Help and Support

hhhiii said:

I have also noticed that these start ups are not in the usual place; I found the registry entries for them: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] Maybe that is the reason that defender doesn't list them. Maybe someone that knows a little more than me can validate my finding and maybe have a solution for it.

Click to expand...

64-bit startup programs are listed in a seperate part of the registry than the 32-bit startups:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (64-bit)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run (32-bit)

You can also see what is running here:
start>in search, type msconfig>click program>click continue>click startup tab

Thanks for the input. My machine has this for this registry entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE C:\\Windows\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\Windows\\system32\\NvMcTray.dll,NvTaskbarInit"
"Windows Defender"="C:\\Program Files\\Windows Defender\\MSASCui.exe -hide"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Java\\jre6\\bin\\jusched.exe\""
@=""
"AVP"="\"C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Internet Security 2009\\avp.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AutorunsDisabled]
"Acrobat Assistant 8.0"="\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrotray.exe\""
"Adobe Acrobat Speed Launcher"="\"C:\\Program Files (x86)\\Adobe\\Acrobat 9.0\\Acrobat\\Acrobat_sl.exe\""
"QuickTime Task"="\"C:\\Program Files (x86)\\QuickTime\\QTTask.exe\" -atboottime"


These are not being picked up by windows defender at all except for defender. They are listed using msconfig though. I have disabled them by using Autoruns and they were not there before I disabled them. The screen shot is the way it has always displayed. I am concerned that something isn't right here concerning defender.



As you can see these entries are not there. I never had a problem with defender before and am wondering if there is a problem with my recent install of vista X64. I hope not, that's a lot of work down the drain. I do have one more thought on this. I did download this version of Vista X64 via torrent and have considered that this version may have had windows defender "hacked" to hide start up programs. Just a thought though and I don't know this for sure.

After doing research on this problem, I have concluded that the X64 version of software explorer does not find all of the start up programs. It seems to skip over the WOW 6432 entries in the registry. It would seem to me that M$ could have fixed this problem by now, since 7 is almost ready for RC1 release. Oh well.

Just a little update for any interested. I have been working with M$ on this issue with software explorer in vista x64 and they have concluded that the version that is installed on the x64 is the same as the x86 version therefore it does not see the WOW 6432 entries in the registry. That is why it does not show all start up programs like the x86 version. They told me that there would be a patch or an update to fix it in the future, but I will believe it when I see it.