Widows Security Centre problem

[bill clarke]

Hi all, this my first time here, I have down loaded V1.4, and ran it, it came up with a red issue with "windows security centre override" I deleted this problem, then after rebooting found that the windows security centre was showing I had no anti virus software. This is not the case i have Tren Micro PC-cillin, a check of it showed everything was switched on. I reversed the process and rebooted and it still shows the same problem.
I sent this same question to the web site, but got a message saying failed delivery from yahoo.
can anyone help me on this one please ?
Thanks

Bill Clarke.

[bill clarke]

Quick update: did a system restore which did not fix the problem.

[David Arnatt]

http://forums.spybot.info/showthread.php?t=623&highlight=windows+security+centre

This is just a notification to alert you, if you go Control Panel > Security Center > and choose "Anti Virus" and down the bottom there is ' disable as i use a 3rd party program such as norton" can't remember of the top of my head what it says but similar to that.

[bill clarke]

Thanks David, I had a read of that thread and looked at the setting for my security, and all three box's are checked to alert me, maybe I'm a bit thick but why is it telling me that I have no anti virus when I do ?

[md usa spybot fan]

... it came up with a red issue with "windows security centre override" I deleted this problem, ...
There are two different detections that indicate Windows Security Center overrides:
AntiVirusOverride
FirewallOverride
If you are not sure which of the two you got, you can review what you fixed by looking in the Fixes.yymmdd-hhmm.log from when the problem was fixed.

Note: By default here are two Checks.yymmdd-hhmm logs produced during a scan. The second Checks.yymmdd-hhmm has the details of what the scan found. A Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something.

Two methods to look at that information:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the Fixes.yymmdd-hhmm from when you got the error message. Open it.
Method 2
The Checks.yymmdd-hhmm and Fixes.yymmdd-hhmm files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Fixes.yymmdd-hhmm file. Double click on it and it should open with Notepad.
For these detections:
Windows Security Center.AntiVirusOverride: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
Windows Security Center.FirewallOverride: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0
I suggest that you go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Firewall" and "Virus Protection" (expanding if necessary). I believe that you have overridden the protections and that you will find a button labeled "Recommendations". If you click on the "Recommendations" button I believe that you will get a window that indicates something like:
I have a firewall that I'll monitor myself.
and
I have an antivirus program that I'll monitor myself.
Note: with these setting Windows won't monitor your firewall and virus protection status and won't send you alerts if they are off or out of date.

[David Arnatt]

There are two different detections that indicate Windows Security Center overrides:
AntiVirusOverride
FirewallOverride
He mentions he has PC - Cillin I think he might be talking about the Anti Virus one, best to just follow up on what MDA said.

[bill clarke]

Yes David i am talking about the anti visu one, I want to know why it is telling me I don't have any anti virus software when I do, what has spybot changed ?

[md usa spybot fan]

This detection:

Windows Security Center.AntiVirusOverride: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
Indicates that Windows Security Center "Virus Protection" was been overridden.

If you had gone into Windows Security Center you more than likely found "Virus Protection" set to "OFF" and the "Recommendations" set to "I have an antivirus program that I'll monitor myself".

For more information see:
How to Disable Antivirus Alerts When Security Center Does Not Detect Installed Antivirus Application
http://www.microsoft.com/windowsxp/using/security/internet/sp2_disableavalerts.mspx

Since you allowed Spybot to set Windows Security Center "Virus Protection" to "ON" by fixing the detection and were receiving alerts concerning your anti-virus it indicates that Windows Security Center is not recognizing your anti-virus. According to this article, Trend Micro™ OfficeScan™ Corporate Edition and Trend Micro™ PC-cillin™ Internet Security should be recognized:
Antivirus Partners Currently Supporting Windows Security Center
http://www.microsoft.com/athome/security/viruses/wsc/en-us/flist.mspx


Trend Micro (http://www.trendmicro.com/en/products/desktop/overview.htm)

Trend Micro, Inc. is a global leader in network antivirus and Internet content security software and services, focused on outbreak prevention and threat impact management. Its award-winning desktop products, Trend Micro™ OfficeScan™ Corporate Edition and Trend Micro™ PC-cillin™ Internet Security, are fully compliant with Microsoft Windows Security framework and WMI standard.
By restoring the Windows Security Center.AntiVirusOverride detection (Spybot > Recovery) you should have returned to the original condition including Spybot detecting the problem unless the detection was ignored.