View Full Version : Spybot 2.8 - Why is it so hard to switch off the Windows Security Centre integration?
drghughes
2020-04-11, 10:25
I've just installed Spybot 2.8.67.0 free version. The installer forces you to install the Security Centre Service because there is no option to leave this out. But this means that you can't run Windows Security scans from the Windows Explorer context menu or from the command line.
If you try to stop or disable the service from Spybot's settings or from the Windows Services app, that's denied, e.g.
https://forums.spybot.info/attachment.php?attachmentid=13222&d=1586592427
So I had to edit the registry to set the service to start manually, which has solved the problem.
Malwarebytes makes it easy to remove Malwarebytes from the Windows Security Centre.
Given that its security centre "integration" stops other useful security functions, why doesn't Spybot do the same?
I hadn't realized there was a new Spybot available, so I'm glad you posted.
I had the same problem with the Security Centre Service, except in my case it wouldn't start as well at first, because of the security certificate. Trying to Start or Uninstall gave the same access denied message you had. I edited the registry and put it as disabled in my case for now since it could not start. Thanks for posting that. :)
The only way I could get the access denied message to stop was to back up, then delete the LaunchProtected d-word key in the registry that was there with the service, then reboot, unless that was just a coincidence. After that, I was then able to Start, Stop and also Uninstall the service. But I imagine that would be compromising security quite a lot, so I'm not suggesting anybody reading this does that, of course. I'm thinking this might be a bug of some sort, but of course that is just a guess on my part.
drghughes
2020-04-12, 10:21
Good to hear that you were able to reproduce the problem.
1. The Security Centre Service doesn't start immediately after installing v2.8.67.0, but it does start if you restart your PC. At least that was the case for me.
2. I'm assuming that it is the LaunchProtected key that is the problem. I can see that that should be set for the update and scan services, but hopefully it has been set by mistake for the Security Centre Service.
I will report this as a bug and see if that will get it fixed. I'm not hopeful though, as mostly when I report problems to Spybot, I get told that it's all user error.
Oh, good, I'm glad you reported it. It'll be interesting to see what happens with it. :)
Perturbance
2020-04-16, 05:08
Thanks for the info! I'm one of the odd ones that uses Spybot for the spyware protection but Windows Defender for antivirus. I found out about the new 2.8 version via KC Software's SUMo app.
When installing (upgrading from 2.7), I couldn't get the Windows Security Centre Integration service to start, no matter if I answered Yes, No or Ignore to the 'Install Live Protection' prompt during setup. How I eventually got it working on my Windows 10 machine:
Be sure to run setup with Administrator rights
After setup is complete, go in to the registry editor -> HKLM\SYSTEM\CurrentControlSet\Services\SDWSCService and change the LaunchProtected value to zero (0).
Reboot.
After logging back in to Windows, the installer asked me (a second time) if I wanted to install Live Protection. I answered No.
Now, the Spybot Security Centre Integration Service is running, but I am allowed to stop it from both the Services applet and within Spybot Settings.
Thanks for the info! I'm one of the odd ones that uses Spybot for the spyware protection but Windows Defender for antivirus. I found out about the new 2.8 version via KC Software's SUMo app.
When installing (upgrading from 2.7), I couldn't get the Windows Security Centre Integration service to start, no matter if I answered Yes, No or Ignore to the 'Install Live Protection' prompt during setup. How I eventually got it working on my Windows 10 machine:
Be sure to run setup with Administrator rights
After setup is complete, go in to the registry editor -> HKLM\SYSTEM\CurrentControlSet\Services\SDWSCService and change the LaunchProtected value to zero (0).
Reboot.
After logging back in to Windows, the installer asked me (a second time) if I wanted to install Live Protection. I answered No.
Now, the Spybot Security Centre Integration Service is running, but I am allowed to stop it from both the Services applet and within Spybot Settings.
Thank you for this! I was pretty irate to find that the free edition of Spybot S&D v2.8 had silently taken control of my Windows Security Center without providing live protection (WTF? I expected better than this) but your registry hack was exactly what I needed to fix it.
Thank you for this! I was pretty irate to find that the free edition of Spybot S&D v2.8 had silently taken control of my Windows Security Center without providing live protection (WTF? I expected better than this) but your registry hack was exactly what I needed to fix it.
And after updating to a newer release, my anti-virus is disabled again. Spybot team, please fix the installer so that the free edition doesn't try to start live protection! Thanks!
drghughes
2020-05-06, 10:18
And after updating to a newer release, my anti-virus is disabled again. Spybot team, please fix the installer so that the free edition doesn't try to start live protection! Thanks!
Please report this as a bug - https://www.safer-networking.org/support/#contactform
I have already reported it, but Spybot didn't seem to get the message, and came back asking me if I needed help!
Maybe if some more people report it, they will get the message.
Some initial clarification: the LaunchProtected key is, as is the installation as it is, tied to a requirement from Microsoft. Plus the service is tied to the Early Launch AntiMalware (ELAM) driver, which again is a requirement.
We're not "taking control" of Security Center, we're doing what is expected from us by Microsoft, which is adding Spybot there. For Anti-Malware only in the Free Edition, for AM and AV in the paid editions.
So one very important thing to this discussion: please mention if you're referring to the Free Edition or a paid one.
As I said in my previous post, there are requirements by Microsoft (I'm not sure how the mentioned MalwareBytes handles them). Lets head back a few steps though to look at the actual problems instead of talking about one possible solution.
1. Useful functions are stopped. What can we do about this? What else can you maybe do about this (e.g. is it possible to change the primary AV to Windows Defender to get them back)?
2. What else?
drghughes
2020-05-06, 12:27
Sorry PepiMK, but I have little idea what you're talking about here.
I made it clear that this was the free version from the very start, so not sure what your comment about mentioning that is all about.
Here's how it looks to me: The free version doesn't replace an anti-virus since there is no real time scanning, so there is no reason for the Security Centre integration. If there is some Microsoft requirement, just don't install the Security Centre integration with the free version. In the previous version there was an option to do this in the installer (that didn't work, if I remember correctly), so let's go with that solution.
Sven Viking
2020-08-02, 08:58
Just replying to say this is still the case as of v2.8.68.0. Whatever the intention, the result is that installing the free version of Spybot provides no virus protection but disables Windows Defender's real-time "Virus and threat protection" and prevents it from being re-enabled without uninstalling Spybot or using the registry editor to change an obscure value. All this happens without the user being informed, so most people would be unaware. 13245
Whatever Microsoft's intention is, I doubt this is it. Something like the free version of Malwarebytes (which does provides manual virus scanning but not real-time virus protection) does not integrate with Windows Security Center to disable real-time virus protection, so it does not seem to be entirely unavoidable.
Reference the thread titled "Windows Defender w/ RTP inside WSSC & Spybot S&D w/ LP outside WSSC" in this forum for some helpful information.
Sven Viking
2020-08-10, 01:05
Thanks - I personally already did find that thread and the problem is solved for me via a registry edit, but the problem remains for other people who don't find the forum thread, install Spybot Free, and don't even realise it has disabled their virus protection behind the scenes.
I'm linking my thread to this thread as it looks to me that my problem is related to this SDSpybotLab.exe file too...
https://forums.spybot.info/showthread.php?77512-Safer-Networking-folder-in-the-root-of-C-drive&p=485437#post485437
Although I'm not getting any popup it appears that this file is still running at boot times and creating a log in my root directory. I would like this stopped!
edit the registry to set the service to start manually
Hello,
I'm wondering if you could explain step-by-step how you edited to the registry to fix this problem? I'm not super tech-savvy but I can follow instructions! I would really appreciate it, as this problem is driving me nuts. Thank you!
drghughes
2022-01-24, 10:15
I'm wondering if you could explain step-by-step how you edited to the registry to fix this problem?
Since you can cause big problems if you make a mistake when editing the registry, I made the choice not to provide any instructions.
However, others don't take the same view, so you will find some instructions in this thread at https://forums.spybot.info/showthread.php?77424-Spybot-2-8-Why-is-it-so-hard-to-switch-off-the-Windows-Security-Centre-integration&p=484596&viewfull=1#post484596
I'd advise creating a restore point before making any changes so that you can go back to a working system if things go wrong.
Should the referenced Regedit key be returned to it's initial state after turning off Spybot Security Center Service or will that return the problem?
drghughes
2022-03-28, 18:11
Should the referenced Regedit key be returned to it's initial state after turning off Spybot Security Center Service or will that return the problem?
I have left the key with a value of 0.
Since I have not turned off the Spybot in the WSSC I have not changed its Regedit Key from Zero (0) which is a workaround to the problem which is described in my Windows Defender w/ RTP inside WSSC & Spybot S&D w/ LP outside WSSC thread.
As far as I know, the problem has not yet been permanently fixed yet.
If anyone knows any differently, please let me know?
Thanks!
drghughes
2022-03-30, 11:26
In case anyone else is looking for it, here is DonZ01's earlier post https://forums.spybot.info/showthread.php?77456-Windows-Defender-w-RTP-inside-WSSC-amp-Spybot-S-amp-D-w-LP-outside-WSSC.
This remains a problem, which I have just discovered to my horror. I don't know when it happened but I assume with a recent W10 update.
After recommending Spybot (free edition) to all kinds of people for years (and installing it for them if they weren't tech-savvy) now I'm suddenly regretting it.