MpCmdRun file "SpyNetService -RestrictPrivileges -AccessKey..........

windozeUser · 08 Jun 2020

Hi,
[am using windows 8.1]
my laptop used to be continuously unable to update Defender after using the system restore [used restore to an earlier time to be able to update defender,as this proiblem occurs regardless] and then updating Defender,if i try again on another day i would get a message that defender wasnt allowed to update the virus signatures, have forgotten the "reason" in the msg.
Now, i am having a look at the "MpCmdRun" file that is in the windows/temp folder,as the laptop developed a problem at the same time as the windows defender problem above,where i am not able to delete certain files and folders in the windows/temp folder,such as the MpCmdRun files and the Crashpad folder with its files it contains,unless i take ownership of it [have to do this every time i want to delete these files].
I suspected malware.

And NOW there are entries in the MpCmdRun file:
"MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SpyNetService -RestrictPrivileges -AccessKey..............."

DO I HAVE SPYWARE ON MY LAPTOP?

HAVE MULTIPLE ENTRIES like the above as well as the below :
MpCmdRun: Command Line: "C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges"

BUT now i am able to update defender,which i havent been able to do for a long time,unless i reformat the laptop or i use system restore ..........?!

Could anyone shed some light or have more info on this??

THANKS in advance

regards

Jacee · 08 Jun 2020

Please see this: MpCmdRun.exe Windows process - What is it?

Compumind · 08 Jun 2020

@windozeUser -

Welcome to Windows Ten Forums!

You really should be on Windows 10. It's time.

Adding to the good post by @Jacee above -

mpcmdrun.exe - What is mpcmdrun.exe?

FWIW.

Callender · 08 Jun 2020

FYI:

Block spynet.

Code:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SpyNetReporting /t REG_DWORD /d 0 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v DontReportInfectionInformation /t REG_DWORD /d 1 /f

Also see:

https://www.askvg.com/windows-10-tip...dows-defender/

So it's just defender reporting some user data to Microsoft.

See also:

Enable or Disable Diagnostic Data Viewer in Windows 10

A little more info on enabling/ disabling spynet:

Set Windows Defender Antivirus blocking to high on Windows 10 - gHacks Tech News

Note: Personally I don't use Defender.