Anti virus message

[sjkumar]

Hi,
I just installed spybot, updated it and checked for problems.
There were 3 problems.
HKEY (Possible hijacker , spybot message.)
HKEY (some other message)
Windows.. () some message

After the scan was complete, I removed all the three entries.
Now everytime I start windows, I get a pop up baloon which says that my anti virus is turned off.
Although when I open norton anti virus, it's ON and shows OK.
I am on windows XP and it's a security center warning when an anti virus is not found or damaged.
When I installed Norton, it gave me an option (while running live update), to use norton as my default virus check and not windows security center.
I checked that.

When I used spybot, I think I accidentally deleted that entry . Is it possible to retain that?
Other than this, my system works better now.
Thank you.

[sjkumar]

Hi,
I just noticed that in the security center, the Anti virus button is red when windows starts and it says OFF. It automatically turns ON after a second or so.
I am sure I have removed some entry.
Can you please suggest some solution?
thank you

[md usa spybot fan]

Sjkumar:

It may be helpful if you could provide more details about what problems you fixed in Spybot as well as the content of the balloon message that you are getting. Also does the balloon message go away on its own when Norton finishes loading or do you have to take some action?

Please post the Fixes.yymmdd-hhmm log that was produced when you did a "Fix selected problems" in Spybot.

By default here are two Checks.yymmdd-hhmm logs produced during a scan. The second Checks.yymmdd-hhmm has the details of what the scan found. A Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something.

To post the Fixes.yymmdd-hhmm log from the scan/fix there are two methods:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the Fixes.yymmdd-hhmm file from the scan/fix just before you started having the problem. Open it. Right click > Select all. Right click > Copy. Paste to the post.
Method 2
The Checks.yymmdd-hhmm and Fixes.yymmdd-hhmm files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Fixes.yymmdd-hhmm file. Double click on it and it should open with Notepad. Copy and paste into the post.

[sjkumar]

Hi,
There are 2 check files with following in them.
-----------
27.06.2006 14:42:45 - found: Windows Security Center.AntiVirusDisableNotify Settings
-----------
Second one:
-----------
Windows Security Center.AntiVirusDisableNotify: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0
-----------

Then in Fix file:
--------------------
Windows Security Center.AntiVirusDisableNotify: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

-------------------

When I installed norton, it asked me if I want norton to be my default virus check and not windows security center. I chose norton. I am 100% sure that I have deleted that particular entry done by norton.

The baloon is the default Windows XP security center warning box.
This is how you can see it safely. (Windows XP.)
In control panel there's a shortcut for windows firewall. Double click it and disable firewall. Click OK.
Almost instantly the baloon will come up and says "Your computer might be at risk. Firewall is turned off. Click this baloon to fix this problem."
Clicking it will take you to security center where you can turn ON the firewall.

It does the same for AntiVirus status check and this is the message I am getting when windows starts.
"Your anti virus is turned off. clik this baloon."

When I click it, I see anti virus off. But in a second, it shows it ON again without me doing anything.

How can I fix this?
Thank you and greatly appreciate your help.
Thanks. :)

[md usa spybot fan]

Spybot detected that the Windows Security Center Virus Protection alert was turned off. By fixing the following detection you turned that alert on:


Windows Security Center.AntiVirusDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0
To turn the alert back off, go into Start > Control Panel > Security Center > Resources (on the left hand side of the window – expand if necessary) > click "Change the way Security Center alerts me". This brings up an "Alert Setting" window. There are three possible alerts:
Firewall
Alert me if my computer might be at risk because of my firewall settings
Automatic Updates
Alert me if my computer might be at risk because of my Automatic Updates settings
Virus Protection
Alert me if my computer might be at risk because of my virus protection software settings
Uncheck Virus Protection.

To keep that detection from reappearing during Spybot scans, go into Spybot > Mode > Advanced mode (answer yes to the warning message if necessary) > Settings > Ignore products. Click on the Security.sbi tab. Expand the width of the Product column so that you can see the entire text of the entries by grabbing the divider between the Product and Details columns and sliding it to the right. Check the following entry:
Windows Security Center.AntiVirusDisableNotify

[sjkumar]

Thank you!
Done what you said, restarted and no alert message now.
Thank you.
best wishes.