SpyBot and Firewall issue

[Help_plz]

Many times I've used spybot to clean up peoples computers, and for some reason I've know run across an error I cannot resolve. Every now and again Spybot will show up Windows Security Center. notifications. I let spybot fix whatever problems it finds, and all is well. However, for whatever reason this time is different.

The three specific "errors" it found are:
Windows Security Center.AntiVirusDisableNotify
Windows Secuirty Center.FirewallDisableNotify
Windows Security Center.Update Disable Notify

After the scan it was functioning properly, shut down the computer, and when I booted it up this morning windows notified me my automatic updates were turned off as well as having no antivirus installed. This I expected to see as is the typical result. However, I did not recieve a messege about my firewall being turned off. Is it the case that spybot accidently detected no firewall was enabled, when in deed one was, and went about trying to fix it anyway, thus disabling Windows Firewall entirely? Anytime I try to access it it gives me a messege saying "Due to an unidentified problem, windows cannot display your firewall settings" I tried the restore feature, and still have the same problem. Any help that can be provided in resolving the matter would be greatly appreciated, log file is below.



--- Report generated: 2006-08-28 16:05 ---

SpySheriff: Settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1004336348-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn!=dword:0

Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2

Windows.ActiveDesktop: User settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1004336348-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallPaper!=W=1

Windows.Explorer: User settings (Registry change, fixed)
HKEY_USERS\S-1-5-21-1004336348-57989841-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn!=W=0

Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Advertising.com: Tracking cookie (Firefox: default) (Cookie, fixed)


Avenue A, Inc.: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


CasaleMedia: Tracking cookie (Firefox: default) (Cookie, fixed)


DoubleClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


FastClick: Tracking cookie (Firefox: default) (Cookie, fixed)


HitBox: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


MediaPlex: Tracking cookie (Firefox: default) (Cookie, fixed)


ValueClick: Tracking cookie (Firefox: default) (Cookie, fixed)


WebTrends live: Tracking cookie (Firefox: default) (Cookie, fixed)


CoreMetrics: Tracking cookie (Firefox: default) (Cookie, fixed)



--- Spybot - Search & Destroy version: 1.4 (build: 20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2006-08-28 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2006-02-06 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2006-02-20 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2006-08-25 Includes\Cookies.sbi (*)
2006-08-25 Includes\Dialer.sbi (*)
2006-08-25 Includes\Hijackers.sbi (*)
2006-08-25 Includes\Keyloggers.sbi (*)
2004-05-12 Includes\LSP.sbi (*)
2006-08-25 Includes\Malware.sbi (*)
2006-08-25 Includes\PUPS.sbi (*)
2006-08-25 Includes\Revision.sbi (*)
2006-08-25 Includes\Security.sbi (*)
2006-08-25 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2006-08-25 Includes\Trojans.sbi (*)



-Chris

[md usa spybot fan]

This detection in the Spybot-S&D log that you posted indicates that the Windows Security Center was not set to start automatically when you started or re-started the system.


NotifyMicrosoft.WindowsSecurityCenter_disabled: Settings (Registry change, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2

Since you fixed that detection and if the detection is no longer appearing during a Spybot-S&D scan, it is possible that Windows Security Center was not running originally and now is. If Windows Security Center was originally disabled, you would not have received any notifications concerning the Firewall, Automatic updates and Virus protection prior to Windows Security Center running after the re-boot.

re: These detections.


Windows Security Center.AntiVirusDisableNotify
Windows Secuirty Center.FirewallDisableNotify
Those detections do not indicate that there is no AntiVirus or Firewall. They indicate that the notification within Windows Security Center is turned off so that Windows Security Center will not report on the status AntiVirus or Firewall.

If you go into Start > Control Panel > Security Center > Resources (on the left hand side of the window – expand if necessary) > click "Change the way Security Center alerts me". This brings up an "Alert Setting" window.

There are three possible alerts:
Firewall
Alert me if my computer might be at risk because of my firewall settings
Automatic Updates
Alert me if my computer might be at risk because of my Automatic Updates settings
Virus Protection
Alert me if my computer might be at risk because of my virus protection software settings
I believe that you will find that the first and third items are unchecked. This is the cause of the following Spybot detections:


Windows Security Center.FirewallDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Windows Security Center.AntiVirusDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0

[Help_plz]

What I was trying to convey in the fist post was that I had already set Windows Security Center to not monitor my Virus protection or Automatic Updates, but i DID have it monitor my firewall, i.e. option 1 being on, option 2 and 3 being off. However, when I did a scan it said option 1 was off as well (noticed this in retrospect). Clicked fix all problems, after reboot now have the continual error of "Due to an unidentifiable problem, windows cannot display your firewall settings."
Tired the restore feature and still stuck with this problem..

[md usa spybot fan]

... after reboot now have the continual error of "Due to an unidentifiable problem, windows cannot display your firewall settings."
Is it posible the error is actually:

"Due to an unidentified problem, windows cannot display Firewall settings". If so, doing a Google search finds several hits. One such match is:
"Windows cannot display Windows Firewall settings" error while accessing Firewall settings in Windows XP Service Pack 2
http://windowsxp.mvps.org/sharedaccess.htm