Spybot & Windows Security Centre.....warning

[debanks]

Spyboot keeps finding two suspicious and recuring files. Windows Security Centre Firewall\Disable Notify. There is a similar one for Firewall. These files are in Settings HKEY_LOCAL_MACHINE\Software\Microsoft\SecurutyCentre\Antivirus disable Notify!=dwordO.
I delete them but they recur. In windows security centre everything is switched on. I'm running McAfee Firewall and anti Virus plus AGV free anti virus on XP Home. My questions are : Are these files dangerous, what do they mean and how can I stop them recuring.

I did have a Bagle worm that slipped through undetected.

Derek Banks

[spybotsandra]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

[md usa spybot fan]

debanks:

Additional clarification:


In windows security centre everything is switched on.
If you go into Start > Control Panel > Security Center > Resources (on the left hand side of the window – expand if necessary) > click "Change the way Security Center alerts me". This brings up an "Alert Setting" window.

There are three possible alerts:
Firewall
Alert me if my computer might be at risk because of my firewall settings
Automatic Updates
Alert me if my computer might be at risk because of my Automatic Updates settings
Virus Protection
Alert me if my computer might be at risk because of my virus protection software settings
I believe that you will find that the first and third items are unchecked. This is the cause of the following Spybot detections:


Windows Security Center.FirewallDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

Windows Security Center.AntiVirusDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0
When the McAfee SecurityCenter is optionally selected as the default security center, it turns off these alerts within the Windows Security Center so that the Windows Security Center will no longer notify you if your firewall and/or antivirus are disabled. As indicated by spybotsandra, this is not a threat as long as McAfee SecurityCenter is running. However, from my perspective, McAfee has done a disservice to their users by not informing them that by selecting the McAfee SecurityCenter as the default Security Center these Windows Security Center alerts will be turned off. If you were to abandon McAfee products in the future they have left the features of the Windows Security Center in a compromised condition. I personally do not have my McAfee SecurityCenter running as the default security center.

[loctet]

Hello,

[QUOTE]In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
I have a problem, the contextual menu does not allow this modification. The line in is dimmed (not selectable).

Thanks.:confused:
Best regards

[md usa spybot fan]

If you want to exclude the item from future detections:
Expand the detection if necessary (+ to the left of the detection).
Select the item (entry) that you want to exclude by left clicking on it to highlight it.
Then right click on highlighted detection.
Select from the list of options in the menu.
In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.

[nickW]

Bonjour loctet,

Il faut être en "Mode avancé" pour pouvoir effectuer cette manip.

Voir en haut, dans le menu Mode.

Salut.

[md usa spybot fan]

NickW:

I do not believe that you are correct. There is a difference between:
"Exclude this detection from further searches"
and
"Exclude this product from further searches"
spybotsandra's (http://forums.spybot.info/member.php?u=5) original suggestion was to:


… exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans".
To the best of my knowledge you can only "Exclude this detection from further searches" after you "Check for problems" and the detection is listed on the problem detection screen.

You can exclude "products" (or un-exclude them) by going into Spybot > Mode > Advanced mode > Settings > Ignore products.

If you have excluded a single detection you can remove it from the ignore list by going into Spybot > Mode > Advanced mode > Settings > Ignore single entries.

[loctet]

Effectivement je ne suis pas en mode avancé.
Merci de votre réponse et pour l'adresse du forum.
Salut.:)

[EloquentBaboon]

I received the same notification and asked spybot to fix it along with 4 instances of RealDownloadExpress --- now i'm having issues. If my machine idles too long, it locks up. Also sometimes the screen-saver is interrupted for no apparent reason. A friend of mine says it sounds like i've inadvertently deleted some registry files. Asked S&D to recover, the RealDownloadExpress came back, but not the Windows Security Centre Firewall\Disable Notify.

Can anyone tell me/speculate on what's going on here and what i can do to fix it?

Thanks very much in advance
EQB




Spyboot keeps finding two suspicious and recuring files. Windows Security Centre Firewall\Disable Notify. There is a similar one for Firewall. These files are in Settings HKEY_LOCAL_MACHINE\Software\Microsoft\SecurutyCentre\Antivirus disable Notify!=dwordO.
I delete them but they recur. In windows security centre everything is switched on. I'm running McAfee Firewall and anti Virus plus AGV free anti virus on XP Home. My questions are : Are these files dangerous, what do they mean and how can I stop them recuring.

I did have a Bagle worm that slipped through undetected.

Derek Banks

[Dragonphish]

The detections for Windows Security Virus scan and Firewall issues were easily verified and excluded per the instructions previously listed in this thread. Thanks to all who contributed.

[verryberry]

I am unable to exclude this detection. If I allow it to "fix" them, my protection programs are all screwed up after.

I don't want to have to bother unchecking these items each and every time, but exclude is greyed out. (I have tried highlighting the main line as well as the settings line)

Please help

[md usa spybot fan]

This should work:
If you want to "Exclude this detection from further searches":
Expand the detection (+ to the left of the detection).
Select the item (entry) that you want to exclude by left clicking on it to highlight it.
Then right click on highlighted detection to bring the context menu.
In the context menu select "Exclude this detection from further searches".

In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.
If that does not work:
Go into Spybot > Mode > Advanced mode > Settings > Ignore products > Security tab and check the items there.

Note: The Windows Security Center detections have been separated into individual "Products" to facilitate exclusion. Therefore they can be checked for exclusion as individually as "Products" in advanced mode.

[verryberry]

The first suggestion did not work. No matter what was highlighted, the exclude option never became available for me.

The advanced mode under products did work though. Thank you!

[gaskibba]

Hi, I had the same two notification-warnings come up. I found that clicking on the "Exclude this product..." option the first notification didn't reappear when rescanning but the second one did.
On a related note, when I went to send in a bug report describing the problem, I got the Following message when I clicked send.
"Warning: mail(): Could not execute mail delivery program '/usr/sbin/sendmail -t -i ' in /homepages/14/d83789217/htdocs/spybot/scripts/emailform.php on line 164

Thank you, you will get a response soon"

So I'm not sure if the email got thru or if I may have caused myself a problem
in using the "Excude this product...." option memtioned above.

Thanks for any comments about this.
gaskibba

[md usa spybot fan]

gaskibba:

Did you ""Exclude this product from further searches" for each detection separately?

[gaskibba]

md usa spybot fan:

Yes I did each seperately. I've went to the exclude products list in the advanced mode and found that I have 7 "Windows Security" entries.
Somethings not quite right. I'm thinking of backing up via System Restore to where I was this morning.

[md usa spybot fan]

gaskibba:

I assume that you are looking in Spybot > Mode > Advanced mode > settings > Ignore products > in either the All products or Security.sbi tab. There are currently seven (7) different Windows Security Center detections:
Windows Security Center.AntiVirusDisableNotify
Windows Security Center.AntiVirusOverride
Windows Security Center.FirewallDisableNotify
Windows Security Center.FirewallOverride
Windows Security Center.SP2Update
Windows Security Center.TaskManager
Windows Security Center.UpdateDisableNotify
You should only check the two (2) that you want to exclude.

Note: If you can't see the full name of the product, expand the Product column of the screen by placing the cursor in the column title bar between the Product and Detail columns until the column separator move symbol appears (cross with arrow heads pointing left and right), press and hold the left mouse button and drag the column separator to the right.

[FredOp]

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.



The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

First, thank you for the clear and concise explanation of what is being detected and why. In fact, I found it so helpfuly, I have a Feature Request because of it. And, since I couldn't find where one puts Feature Requests, I'm putting it here. My apologies if I missed the right place to post it; I have an amazing ability to miss the obvious. :rolleyes: Anyway, feel free to forward/move/whatever this post to the right place if I have missed where to make a feature request. That said, on to the feature request:

It would be very handy if your explanation (in some form) would be given when clicking the Information tab found on the right in Search & Destroy. This way those of us running Mcafee, Norton, etc can know this is a normal result quickly, saving us from panic, and letting us know to just exclude the result from future checks.

As I imagine that those of use safety-minded among us to be running Spybot-S&D! in the first place also run Mcafee, Norton, and the like, I think it would benefit a great number of users as well as cutting down on us having to search the forums and those of you in Support from having to explain (again) not to worry. (I'm a big fan of saving time and effort for everyone)

In any case, thanks again for the information.

FredOp
The Overly Wordy User

[averagenetperson]

Thanks this pretty much helped me and thanks for solving the issue! For better security, do you recommend I make Windows Security Center my default or Mcafee Security Center. Currently, I chose Macafee.

Don't know what happened but Spybot detected ''Webhancer'' earlier this week and deleted it but since then Spybot has caught all kinds of spyware and cookies; before that my scans were always clean. Apparently this Webhancer is a big pain and has compromised my security!:mad:

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

[Mcnudde]

Hi All,

My laptop is developing a serious problem. I will run Spybot and 90% of time, halfway through the run, the machine shuts down. The same problem occurs when I run the AVG antivirus software. I have tried other antivirus/antispyware products but they do not pick up anything. The one time I was able to find anything by running Spybot was this:

HKEY_LOCAL_MACHINE\Software\Microsoft\SecurutyCentre

Other times I have run Spybot, I have found nothing.

My system will also crash on certain webpages - non adult (whatever it is, it doesn't seem to like certain type of banner ads.) In all cases, the machine's fan will begin to speed up and then suddenly: BANG.

I start up again and no damage seems to be done, except my system does want to check itself for errors.

So at long last my question: what is going on? Most people I've spoken to say I've got some kind of spyware, but I've gone into safe mode, rooted around...and I've found nothing.

Is it related to the Spybot alert above ?

Hoping anyone can help.

Thanks,

Mike

[md usa spybot fan]

Mcnudde:

re: Machine shut down during Spybot and AVG antivirus scans.

This may sound strange but; Spybot is quite CPU intensive and I imagine AVG antivirus is also. Is it possible that your laptop is shutting down due to a heat related problem? Are the fans in the laptop running properly?

[Mcnudde]

Hi md usa,

Thanks for getting back... actually what you suggest does not sound strange at all. I had it on my list of probable causes, but didn't give it much thought.

The question is, if this is the cause, what do I do about it? Is there anyway I can adjust the fan on my end? (Probably not) Or do I have to ship it back to the repair shop (been there once already)...doable, since still under warranty, but a huge pain.

I'd appreciate any further insights...

Again, many thanks,

mcnudde

[md usa spybot fan]

Mcnudde:

I really don’t know how to advise you other than to suggest that:
You Google for possible similar problems including the make and model of your laptop.
You attempt to listen to the system and see if you can: Hear if the fan is running.
Hear the fan speed increase during the scan (not every chipset has a speed control capability, but most of the newer ones do).

[Mcnudde]

md usa,

Appreciate the help.

Will do as you suggest and will let you know how it works out.

Many thanks once again!

[Frank C]

The Windows Security Center and Norton Internet Security 2006 seem to have a similar problem. I Updated Norton Internet Security from 2004 to 2006 on 1/10/06.
The next time that I ran SpyBot (1/22/06) it reported “Windows Security Center Firewall Disable Notify as an error.I allowed Spybot to fix the problem. Later, Norton asked if I wanted Windows Security to be the primary firewall. I responded no. I believe that this change to the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify!=dword:0) is necessary if I want Norton to be the primary firewall and Windows Security firewall to be off. During the Install of Norton 2006 Spybot asked for approval of several registry changes. I accepted them all, one of these was likely the Notify Switch. When I had Norton 2004 it didn’t seem to conflict with Windows Security Center.
Frank C

[cheater87]

this happens to me with the anti virus but it keeps coming back and it keeps going red and i keep putting it on yellow but it just goes red again its annoying

[stevek]

I had the Windows Security disable notices come up on my scan and was not sure what to do.

It was very nice to come here and find well written answers and explanations.

Since I have Norton(2004) I followed the instructions to exclude given here and everything is fine.

Special thanks to MD USA and Spybotsandra

[FL Guy]

Spyboot keeps finding two suspicious and recuring files. Windows Security Centre Firewall\Disable Notify. There is a similar one for Firewall. These files are in Settings HKEY_LOCAL_MACHINE\Software\Microsoft\SecurutyCentre\Antivirus disable Notify!=dwordO.
I delete them but they recur. ...
If I may suggest, this seems like a 'FAQ'. Please consider adding a bit on this topic to the product FAQ (or helpfile, or whever you find makes sense). IMHO, that would be very helpful.

(I was having the same question, and had some difficulty locating this info, almost missed this thread - found it on my third search. I did look in the FAQ and helpfiles and didn't find it. Sorry if it's there and I missed it.)

Thanks to all for the helpful info!!

[jklig]

I also had this issue with SpyBot, only with the antivirus, not the firewall. Is it related, or coincidence, that I am also getting a notification from Norton Antivirus that my subscription expired--when it hasn't yet?

[DJ_Bach]

I was receiving those two detections regarding Windows Security System everytime I used Spybot S&D. I followed the instructions to exclude these items in future detections. It worked as the detections stopped.

However, when I checked "ignore single detections", these two items were not listed. Is there something wrong or not working?

Thanks...

[DJ_Bach]

Nevermind. I found them. They were in the "ignore products" section.

[Jumpman]

What is up everyone!

I am having a similar problem as Mcnudde has with windows shutting down during a virus and spyware scan. Only this time I am using a desktop and not a laptop. My fan does increase in revolutions and then after awhile my computer just shuts down and I can hear a slight hum coming from the hard drive. I recently tried Windows Safety Live scan (Beta Version) and it picks up the threats but I cannot delete them because my system crashes before the scan is complete. And spybot S&D helps out in terms of picking up some spyware but not all of it. Also I with some non pornographic web pages, I get redirected to some spyware url: http://www.pc-aid.com (or something of that nature). Lastly seems that some trojans has slipped through McAfee's firewall and its not protecting my computer as well as it should. Can anyone help me out on this one?

Thanks and your assistance is greatly appreciated

-Henry

[md usa spybot fan]

Jumpman:

The system shutting down sounds like it could be a heat related problem and that the system is shutting down to protect the processor. If that is the cause, the following threads may help:
Spybot causes shut down
http://forums.spybot.info/showthread.php?t=2163
PC crashes while Spybot is running
http://forums.spybot.info/showthread.php?t=2230
Spybot wont run
http://forums.spybot.info/showthread.php?t=2685
If you can't resolve the shutdown problem there are other scans listed in the following thread that may be less CPU intensive and run to completion:
BEFORE you post a log, and who will advise you. Preliminary Steps
http://forums.spybot.info/showthread.php?t=288
If you are able to resolve the shutdown problem and Spybot fails to remove any malware, following instructions in the above thread and then post in this forum:
Malware Removal
http://forums.spybot.info/forumdisplay.php?f=22

[gudda96]

MD USA

I have followed you tip on Override problem and its sorted but one question.

The 3 ticks in settings/control centre/rescources/change the way.../surely if I know my Zonealarm and AVG are working, why do I need ANY ticks?

[Jumpman]

Thanks for tip. I checked out the other forum threads and all I needed to do was dust out my computer. And it worked! Everything ran to completion. Thank you for your assistance. By the was what is the name of that cartoon character you use for your profile pic?

-Jumpman

[bordello]

I recently ran SpyBot and got the same notifications as the subject of this thread. I wanted to add some additional information for those readers who use Norton AntiVirus (and I'm sure there is something like this for McAfee) who do not want to simply disable the notifications from SpyBot in the future.

Once I got the notification, I followed the steps to see if the notifications were indeed disabled. Control Panel-->Security Center-->Looked under Resources on the left hand side, but noticed that the "Change the way Security Center alerts me" was grayed out. I thought for sure this was something that my AntiVirus software was disabling, so I opened Norton AntiVirus. Chose Options (located at the top) --> Norton Protection Center --> and then found the option to "Show messages from Windows Security Center". I made sure that box was checked, then I applied all the settings.

I could then go back into the Windows Security Center, through Control Panel, and click the "Change the way Security Center alerts me". I found that indeed both the Firewall and Virus Protection alert options were disabled, so I checked both boxes.

I then re-ran Spybot, and sure enough no more "Windows Security Center.AntiVirusDisableNotify" problems arose.

[19712]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

In order to exclude, Windows Security Center Firewall/DisableNotify and Windows Security Center AntiVirus/DisableNotify, you must ritht click and highlight the parts listing the HKeys. otherwise the exclude this detection is not lit up. Please confirm this since I do not want to do any damage to the registry.

[md usa spybot fan]

19712:

Correct.

From post #5 of this thread:
http://forums.spybot.info/showpost.php?p=451&postcount=5


If you want to exclude the item from future detections:
Expand the detection if necessary (+ to the left of the detection).
Select the item (entry) that you want to exclude by left clicking on it to highlight it.
Then right click on highlighted detection.
Select from the list of options in the menu.
In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.

[jimgil]

I have just started experiencing these warnings but I think the reply was for Windows XP, i have 2000 pro and am having difficulty accessing the repair.
Thus, the person who said:
"If you go into Start > Control Panel > Security Center > Resources (on the left hand side of the window – expand if necessary) > click "Change the way Security Center alerts me". This brings up an "Alert Setting" window."

I think it must be a different procedure.

Can anyone advise, thanks?

[renegade]

i've also been having trouble with the windows security center problems in spybot. i scanned through this thread but it didn't seem to help me because my computer currently *does* have malware (SurfSideKick) and we're having some problems with that =(

when i run spybot all 7 of the security centers come up. lately only 2 have come up, and i tried nearly everything already put on this thread. however when i got to the control panel > security center, it says that my firewall is off. when i go to recommendations and select "enable now" it says something like "We're sorry, windows security center cannot turn on the firewalls. please try to turn them on yourself by...."

so i go back to the security center home and select "windows firewall", but heres where the problem occurs. the entire "general" tab is dimmed, so i cannot turn the firewall off.

lastly, when i go to my registry editor, to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center

there are the problems, the firewall.override, etc. etc.

i try to delete them, and they do delete, but then whenever i try to access the security center again, they pop back up in the registry editor.

i am at wits end on what to do... any help is greatly appreciated. thanks =)

[tashi]

i scanned through this thread but it didn't seem to help me because my computer currently *does* have malware (SurfSideKick) and we're having some problems with that =(
renegade
Please follow the instructions in this sticky topic:
BEFORE you post and who will advise you. Preliminary Steps (http://forums.spybot.info/showthread.php?t=288)

Then start your own topic in:
The Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22)

A helper will advise you as soon as available. :)

[renegade]

i did read the Before you Post thread, and i've already done everything in it. however running spybot and ad-aware, as well as some other programs, does not help.

however i will try to start my own thread at the other forum. thanks =)

[tashi]

renegade posted here:
http://forums.spybot.info/showthread.php?p=35251#post35251

[trassey]

I recently ran SpyBot and got the same notifications as the subject of this thread. I wanted to add some additional information for those readers who use Norton AntiVirus (and I'm sure there is something like this for McAfee) who do not want to simply disable the notifications from SpyBot in the future.

Once I got the notification, I followed the steps to see if the notifications were indeed disabled. Control Panel-->Security Center-->Looked under Resources on the left hand side, but noticed that the "Change the way Security Center alerts me" was grayed out. I thought for sure this was something that my AntiVirus software was disabling, so I opened Norton AntiVirus. Chose Options (located at the top) --> Norton Protection Center --> and then found the option to "Show messages from Windows Security Center". I made sure that box was checked, then I applied all the settings.

I could then go back into the Windows Security Center, through Control Panel, and click the "Change the way Security Center alerts me". I found that indeed both the Firewall and Virus Protection alert options were disabled, so I checked both boxes.

I then re-ran Spybot, and sure enough no more "Windows Security Center.AntiVirusDisableNotify" problems arose.that is exactly what I've done as well

[llort0]

I believe that you will find that the first and third items are unchecked. This is the cause of the following Spybot detections:

I checked my security notifications and all 3 were marked.
I am running Live One Care.
In the Security Panel it shows firewall disabled on left side
Has green for Firewall and further info indicates One Care firewall etc.

I backed up system and allowed the 2 items to be repaired.
On a rescan they were back.

Thank you

[noel-pr7]

well, in my case, Spybot does detect "Microsoft.WindowsSecurityCenter_disabled" registry entry on my XP machines but I set Spybot to "exclude" that kind of detection because I know I set the Security Center service type to Manual instead of having Security Center automatically load at startup.

some for some users who are encountering Spybot detecting some stuff related to Security center, you may want to exclude those detections and Spybot will not report them anymore if you have installed a third party firewall or have set Security Center service type to either Disabled or Manual.

[Richie]

Well I have read a little bit of this thread, and the reason that I am here is similar, I get the same warning, but I also loose my adminasrator rights along with the controll panel, all I hafta do is run spybot and I regain everything, but the warning still pops up no matter what I do, and yes I did change the settings. It is a virus that spy bot is not able to delet, cause after rebooting it all comes back, or should I say it all goes away, can you folks come up with a solution that works?
Thanx in advance.
Rich

[Richie]

I guess I should add,,, the values are changed on 3 regestry keys, that consests of 5 values changed when I run a bot check, then If/when I reboot the values are re-changed to where my controll panel goes away, and I have no admin privelages. (sorry about the spelling)
Rich

[michaelh613]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

Silly question but my security service was stopped by malware. I've now deleted all the malware and this is the only error that pops up and I can't see where to restart the service.

[md usa spybot fan]

michaelh613:

Assuming that you are taking about Windows Security Center and the following detection:


Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2
If you fix the detection with Spybot and restart your system the Windows Security Center should start.

As an alternative:
Go to Start > Run > type: services.msc > OK.
In the right pane, scroll down until you see Security Center.
Right click on Security Center and choose Properties from the context menu.
Change the Startup type from disabled to automatic.
Click Apply.
Under Services Status click on the Start button.
Close Services.

[michaelh613]

Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.

[md usa spybot fan]

michaelh613:


Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.

That may be true because I have not had any experience with dealing with Norton Security 2008 (after all it's only January 2nd).

However, in the past with Norton Security (NAV 2006 and 2007) there was a circumvention for leaving Windows Security Center active while running Norton.

I am soliciting your help. Please read the bottom of post #3 (http://forums.spybot.info/showpost.php?p=83603&postcount=3) in the following thread and let me know what part of the statement is no longer true:
I need some help with Microsoft windows securitycenter_disabled
http://forums.spybot.info/showthread.php?t=13399

…

Symantec apparently went one step further with the introduction their 2006 and 2007 product lines. Rather than just disable the Firewall and Virus Protection alert features within Windows Security Center, they now disable Windows Security Center itself so that it doesn't even start in your system. Again, to the best of my knowledge there is no notification to the user that has been done and to the best of my knowledge they do not restore the starting of Windows Security Center if you uninstall their product. The disabling of Windows Security Center causes the following Spybot detection:


Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2
If you go to Start > Run > type "services.msc" (no quotes) in the Open box > and then click OK the windows Services application will start. If you scroll down in the right pane until you see Security Center and either double click on Security Center or right click on Security Center and choose Properties from the context menu, the Security Center Properties window will open. You will note that:
The Startup type is Disabled (it is normally Automatic).
The Services Status is Stopped (it is normally Started).
__________________

All that said, down to your problem with the detections themselves.

You essentially have three options:
Leave everything as is and just ignore the detections when you get them during a Spybot "Check for problems".
Restore the functionality of Windows Security Center as follows:
Open Norton Protection Center.
Click Options.
Check "Show messages from Windows Security Center", then click OK.
Permanently ignore the detections within Spybot so that a "Check for problems" does not check for disabled Windows Security Center features. To exclude these items from future detections:
Run another scan.
Expand the detection if necessary (+ to the left of the detection).
Select the item (entry) that you want to exclude by left clicking on it to highlight it.
Then right click on highlighted detection.
Select either of the following from the list of options in the menu.
Exclude this detection from further searches
Exclude this product from further searches
In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.

Since the Windows Security Center detections have been separated into individual "Products" to facilitate exclusion, you can also go into Spybot > Mode > Advanced mode > settings > Ignore products > in either the All products or Security.sbi tab and check the following Windows Security Center detections:
Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
Microsoft.WindowsSecurityCenter.FirewallDisableNotify
Microsoft.WindowsSecurityCenter_disabled
Note: If you can't see the full name of the product, expand the Product column of the screen by placing the cursor in the column title bar between the Product and Detail columns until the column separator move symbol appears (cross with arrow heads pointing left and right), press and hold the left mouse button and drag the column separator to the right.

[michaelh613]

Thanks for the help

[CyberWanderer]

Hello,

I have an issue that is related to this thread by being the opposite.

For a long time now, I have been receiving the alert for Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify and Microsoft.WindowsSecurityCenter.FirewallDisableNotify.

Since downloading the updates on Jan. 9, 2008 the above are no longer detected (no changes were made to Security Center or Norton settings).

In fact, the following entries are missing from Security.sbi:
Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
Microsoft.WindowsSecurityCenter.FirewallDisabled
Microsoft.WindowsSecurityCenter.FirewallDisableNotify
Microsoft.WindowsSecurityCenter.UpdateDisableNotify

Has anyone else experienced this? And are these entries supposed to be absent from Security.sbi?

Thanks in advance!

[brox1]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

Good Explanation.
But please tell me why this explanation does not appear on the right side of the Spybot window where it shows descriptions of other problems that it has found?
Brox1

[tall pockets]

I'm a newbie to spybot.a greenhorn,but want to learn. After the first scan,the results show i have 175 items in the red! and no green tracks.I must be reading this wrong.I would like to keep it simple and just push the delete button but i'm afraid they might be attached to something important,there is no info. on each selected item,just a simble that says registry to the right. And are these items quarintined until i decide?

[Zenobia]

No,the items wouldn't be quarantined unless you decided to fix selected problems,depending on what they are.If the items are tracking cookies,then they aren't put into recovery(quarantined).

What version of Spybot do you have?If you're unsure,click Help,then About.

Let's see what Spybot is finding.Could you do this?

Open SpyBot.
Check for problems.
When the scan completes, right click on the results list, select "Copy results to clipboard".
Paste (Ctrl+V) those results here.

[tall pockets]

I have version 1.6.2.0.,..I right clicked on report and saved to log but dont know how to paste yet. Went to adv. settings & found log.,Sorry,exactly when do i (ctrl+v)?

[spybotsandra]

:funny:

on your keyboard. ;)

[Zenobia]

Yes,after you click Post Reply here,you press ctrl+v on your keyboard to paste the log here.
There's a website where you can practice Copying and Pasteing first,if you like:
http://www.webmasternow.com/copyandpaste.html

[tall pockets]

Sorry Sandra for the rookie questions, and thank you Zenobia for your help. Perhaps this question is more appropriate...what compatible program might i use along with spybot to cover all my security or should i just flip a coin?

[Matt]

Hi tall pockets,

:welcome: to Safer Networking Forums. I hope you will also accept some suggestions from me. ;)


Sorry Sandra for the rookie questions, and thank you Zenobia for your help. Perhaps this question is more appropriate...what compatible program might i use along with spybot to cover all my security or should i just flip a coin?

I have the following recommendations for you:

2. Keep Windows up to date

• Visit http://www.windowsupdate.com regularly (= every week)
• Keep your Operating System and other (security) tools up to date by using the following two sites:


o Secunia Software Inspector (http://secunia.com/vulnerability_scanning/online/)
o F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)



Here are some free programs I recommend that could help you, to improve your computer's security. Please never install more than one Firewall and one AntiVirus tool, but you can install two or three of the following AntiSpyware tools.

3. Sofware Firewall

• ZoneAlarm (http://www.zonealarm.com/security/en/computer-security.htm?cid=W1000281)
• Comodo (http://personalfirewall.comodo.com/download_firewall.html)
• Outpost (http://www.agnitum.com/products/outpostfree/download.php)


4. Antivirus software

• Avira AntiVir Personal - Free Antivirus (http://www.free-av.com/)
• AVG Anti-Virus Free Edition (http://www.avg.com/product-avg-anti-virus-free-edition)
• Avast Home Edition (http://www.avast.com/eng/download-avast-home.html)


5. AntiSpyware software

• Malwarebytes' Anti-Malware (http://malwarebytes.org/mbam.php)
• SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)
• SuperAntiSpyware Free Edition (http://www.superantispyware.com/superantispywarefreevspro.html)


6. Cleaners

• ATF Cleaner (http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25)
Cleans temporary files from IE and Windows, empties the recycle bin and more. It is a great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• CCleaner (http://www.ccleaner.com/)
• WinPatrol: Download (http://www.winpatrol.com/download.html) and Information (http://www.winpatrol.com/features.html)
• Install MVPS Hosts File from here (http://mvps.org/winhelp2002/hosts.htm)
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

For more information, please read the thread So how did I get infected in the first place? (http://forums.spybot.info/showthread.php?t=279) from TonyKlein.

Happy safe surfing! ;)

[md usa spybot fan]

-Matt-:

Very good post.

I would however add Online Armor Free to the list of Sofware Firewalls.




3. Sofware Firewall

• ZoneAlarm (http://www.zonealarm.com/security/en/computer-security.htm?cid=W1000281)
• Comodo (http://personalfirewall.comodo.com/download_firewall.html)
• Outpost (http://www.agnitum.com/products/outpostfree/download.php)
• Online Armor Free (http://www.tallemu.com/free-firewall-protection-software.html)

[Matt]

md usa spybot fan:

Thank you very much. :) I've learned it in the WTT Malware Classroom

Moreover, thank you for your addition regarding the software firewalls. I'll add Online Armor Free into my list. ;)

[Zenobia]

Any luck on getting the Spybot log copied and pasted here,tall pockets?

[IanHarrop]

I'd like to add one thing to you list of checking processes:

http://www.belarc.com/free_download.html

Belarc found a problem for me that other things had not caught.

I had a bad install of SP3 such that neither Windows Update nor Baseline Security Analyzer would reporting missing security updates. Nothing but Belarc was reporting that I had missing updates.

Using Belarc identified that I had a problem and based on its report I was able to track down the issue which was solved by re-installing SP3. Once SP3 was re-installed Windows Update worked properly and a large number of security updates installed correctly.