Windows Defender "Event"

Lately I've been seeing two identical "events" every day, both occurring at
boot up time. I wonder if someone can explain what this means and whether I
should be concerned. I've clicked on the link, but it offers no information.

Event Type: Warning
Event Source: WinDefend
Event Category: None
Event ID: 3004
Date: 6/30/2008
Time: 10:18:00 AM
User: N/A
Computer: xxxxxxx
Description:
Windows Defender Real-Time Protection agent has detected changes. Microsoft
recommends you analyze the software that made these changes for potential
risks. You can use information about how these programs operate to choose
whether to allow them to run or remove them from your computer. Allow
changes only if you trust the program or the software publisher. Windows
Defender can't undo changes that you allow.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=74409
Scan ID: {21977671-2450-4EB2-9F04-694D29560DA9}
User: Owner
Name: Unknown
ID:
Severity: Not Yet Classified
Category: Not Yet Classified
Path Found: driver:uphcleanhlp
Alert Type: Unclassified software
Detection Type: For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

> Lately I've been seeing two identical "events" every day, both
> occurring at boot up time. I wonder if someone can explain what this
> means and whether I should be concerned. I've clicked on the link,
> but it offers no information.
> Event Type: Warning
> Event Source: WinDefend
> Event Category: None
> Event ID: 3004
> Date: 6/30/2008
> Time: 10:18:00 AM
> User: N/A
> Computer: xxxxxxx
> Description:
> Windows Defender Real-Time Protection agent has detected changes.
> Microsoft recommends you analyze the software that made these changes
> for potential risks. You can use information about how these programs
> operate to choose whether to allow them to run or remove them from
> your computer. Allow changes only if you trust the program or the
> software publisher. Windows Defender can't undo changes that you
> allow. For more information please see the following:
> http://go.microsoft.com/fwlink/?linkid=74409
> Scan ID: {21977671-2450-4EB2-9F04-694D29560DA9}
> User: Owner
> Name: Unknown
> ID:
> Severity: Not Yet Classified
> Category: Not Yet Classified
> Path Found: driver:uphcleanhlp
> Alert Type: Unclassified software
> Detection Type: For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.

Um, what did you find out when you followed the recommended links? You
did try them, right?

I said so in my op. One link goes to Windows Defender Home Page, the other
offers a "search" that yields nothing. Thanks for the "help."
"Twayne" <nobody@devnull.spamcop.net> wrote in message
news:u3FwEIE3IHA.4036@TK2MSFTNGP02.phx.gbl...
>> Lately I've been seeing two identical "events" every day, both
>> occurring at boot up time. I wonder if someone can explain what this
>> means and whether I should be concerned. I've clicked on the link,
>> but it offers no information.
>> Event Type: Warning
>> Event Source: WinDefend
>> Event Category: None
>> Event ID: 3004
>> Date: 6/30/2008
>> Time: 10:18:00 AM
>> User: N/A
>> Computer: xxxxxxx
>> Description:
>> Windows Defender Real-Time Protection agent has detected changes.
>> Microsoft recommends you analyze the software that made these changes
>> for potential risks. You can use information about how these programs
>> operate to choose whether to allow them to run or remove them from
>> your computer. Allow changes only if you trust the program or the
>> software publisher. Windows Defender can't undo changes that you
>> allow. For more information please see the following:
>> http://go.microsoft.com/fwlink/?linkid=74409
>> Scan ID: {21977671-2450-4EB2-9F04-694D29560DA9}
>> User: Owner
>> Name: Unknown
>> ID:
>> Severity: Not Yet Classified
>> Category: Not Yet Classified
>> Path Found: driver:uphcleanhlp
>> Alert Type: Unclassified software
>> Detection Type: For more information, see Help and Support Center at
>> http://go.microsoft.com/fwlink/events.asp.
>
> Um, what did you find out when you followed the recommended links? You
> did try them, right?
>

Defender Real Time Monitoring is advising you of the "not yet classified"
User Profile Hive Cleanup Service startup driver and service events:

http://www.microsoft.com/downloads/d...displaylang=en

http://download.microsoft.com/downlo...5ac/readme.txt
--
Regards, Dave


"JD" wrote:

> Lately I've been seeing two identical "events" every day, both occurring at
> boot up time. I wonder if someone can explain what this means and whether I
> should be concerned. I've clicked on the link, but it offers no information.
>
> Event Type: Warning
> Event Source: WinDefend
> Event Category: None
> Event ID: 3004
> Date: 6/30/2008
> Time: 10:18:00 AM
> User: N/A
> Computer: xxxxxxx
> Description:
> Windows Defender Real-Time Protection agent has detected changes. Microsoft
> recommends you analyze the software that made these changes for potential
> risks. You can use information about how these programs operate to choose
> whether to allow them to run or remove them from your computer. Allow
> changes only if you trust the program or the software publisher. Windows
> Defender can't undo changes that you allow.
> For more information please see the following:
> http://go.microsoft.com/fwlink/?linkid=74409
> Scan ID: {21977671-2450-4EB2-9F04-694D29560DA9}
> User: Owner
> Name: Unknown
> ID:
> Severity: Not Yet Classified
> Category: Not Yet Classified
> Path Found: driver:uphcleanhlp
> Alert Type: Unclassified software
> Detection Type: For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
>