Defender Real-Time Protection Causing Applications to Crash on Invocation

[Guest ThomasFilliman]

We have a few customers who have been experiencing a strange behavior with Windows 7 within the last month or so.

 

The symptom is that when a user launches an application from the first level folder of a share, for example from explorer, that the application will have it's startup directory changed to the root of the share and if the explorer window is open the window will exit out of the folder to display the root of the share as if someone also clicked on the back button in explorer.

 

 

I have reproduced this failure mode on an in-house computer, and have discovered that if I disable the option "Scan programs that run on my computer" within Windows Defender, the problem does not occur.

 

 

Windows Defender has been running in this environment for years.

 

There are no events logged in the event viewer.

 

This problem seems to have started sometime in May 2014.

 

 

Does anyone have any idea of what is wrong?

 

Perhaps how to get a log of defender's actions? A way to test the prior version of Defender?

 

 

Thanks!

 

Continue reading...