"Windows Security Centre.Antivirus Override"

[bbchai]

"Windows Security Centre.Antivirus Override"

We recently found that the Spotbot scanned the above results.

Can we delete it right now? It seem so odd as it was from Windows.

Thks for any advice.

[spybotsandra]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Some more information is also available in our forum:
http://forums.spybot.info/showthread.php?t=87

Best regards
Sandra
Team Spybot

[md usa spybot fan]

One of the two links in spybotsandra's post above is broken. I believe the correct link is:
http://net-integration.us/forums/ind...howtopic=32445

[spybotsandra]

oh yeah...sorry....:o

[LonnieHoward]

If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

So, what should I do if I get this notification, but I didn't change the settings myself (at least knowingly)? Should I 'fix the problem' or so something else to allow it? Oh, by the way, I'm using Windows Firewall and avast!4 Home Antivirus.

[md usa spybot fan]

LonnieHoward:

The detection that was originally posted in this thread was "Windows Security Centre.Antivirus Override". The name of that particular detection has been changed since this thread was started over a year ago.

Just to make sure that you and I are not talking apples and oranges, I would appreciate it if you posted a log of the actual detection(s) you are getting. To do that:

• Run another scan.
• When the scan completes, right click on the results list, select "Copy results to clipboard".
• Then paste (Ctrl+V) those results to a new post in this thread.

[newtospybot]

Is it a malware or a simple override of Norton virus- and firewall protection with Windows Security Center IF:

- one week ago, a Spybot scan indicated that the Windows Security Center was switched off
- in the same time, I was unable to run Norton virus check, it was impossible to run Live Update and had to re-install the virus protection product immediately

then, computer was offline for a week, and today

- Spybot scan indicated again that the Windows Security Center is switched off and it is impossible to switch it back on - the button is inactive
- however, Norton showed no more warning signals, I ran a complete system check yesterday, while still being offline.

What's going on, here, what do you think?
And how can I switch back the Windows Security? Even after a restart, it stays the same: inactive. Should I be worried, or not?

Thank you in advance, for any help.

[alvis]

Spybot has also detected Windows Security Overrides in respect of both my firewall and antivirus. I do have separate firewall and antivirus - and have checked that this is indicated in the Security Centre.

Just wondered - I am relatively new to computing - is it unwise to have two firewalls. I know it is unwise to have two antivirus applications, but I wondered about firewalls. I have the Windows firewall switched off because I have Zone alarm.

[stevek]

Alvis

See this post by Tashi-not a good idea to have 2 running:

http://forums.spybot.info/showpost.p...39&postcount=2

[md usa spybot fan]

alvis:

I assume that you are talking about the following detections:

• Windows Security Center.AntiVirusOverride: Settings
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
• Windows Security Center.FirewallOverride: Settings
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0

I have the Windows firewall turned off and I use ZoneAlarm as my firewall and McAfee as my anti-virus. However, I allow Windows Security Center to monitor both my firewall and anti-virus. Firstly, I do not get the detections in Spybot and more importantly Windows Security Center notifies immediately if my firewall or anti-virus are disabled.

I suggest that you reconsider not using Windows Security Center to provide this protection.

Go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Firewall" and "Virus Protection" (expanding if necessary). I believe that you have overridden the protections and that you will find a button labeled "Recommendations". If you click on the "Recommendations" button I believe that you will get a window that indicates something like:

• I have a firewall that I'll monitor myself.
  and
• I have an antivirus program that I'll monitor myself.

Note: with these setting Windows won't monitor your firewall and virus protection status and won't send you alerts if they are off or out of date.

Modify these setting to let Windows Security Center monitor your firewall and anti-virus and see how it works out (I know it will work with your ZoneAlarm).