"Windows Security Centre.Antivirus Override"

[bbchai]

"Windows Security Centre.Antivirus Override"

We recently found that the Spotbot scanned the above results.

Can we delete it right now? It seem so odd as it was from Windows.

Thks for any advice.

[spybotsandra]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Some more information is also available in our forum:
http://forums.spybot.info/showthread.php?t=87

Best regards
Sandra
Team Spybot

[md usa spybot fan]

One of the two links in spybotsandra's post above is broken. I believe the correct link is:
http://net-integration.us/forums/ind...howtopic=32445

[spybotsandra]

oh yeah...sorry....:o

[alvis]

Spybot has also detected Windows Security Overrides in respect of both my firewall and antivirus. I do have separate firewall and antivirus - and have checked that this is indicated in the Security Centre.

Just wondered - I am relatively new to computing - is it unwise to have two firewalls. I know it is unwise to have two antivirus applications, but I wondered about firewalls. I have the Windows firewall switched off because I have Zone alarm.

[stevek]

Alvis

See this post by Tashi-not a good idea to have 2 running:

http://forums.spybot.info/showpost.p...39&postcount=2

[md usa spybot fan]

alvis:

I assume that you are talking about the following detections:

• Windows Security Center.AntiVirusOverride: Settings
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride!=dword:0
• Windows Security Center.FirewallOverride: Settings
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride!=dword:0

I have the Windows firewall turned off and I use ZoneAlarm as my firewall and McAfee as my anti-virus. However, I allow Windows Security Center to monitor both my firewall and anti-virus. Firstly, I do not get the detections in Spybot and more importantly Windows Security Center notifies immediately if my firewall or anti-virus are disabled.

I suggest that you reconsider not using Windows Security Center to provide this protection.

Go into Start > Control Panel > Security Center > look at the right hand side of the window and check the settings under "Firewall" and "Virus Protection" (expanding if necessary). I believe that you have overridden the protections and that you will find a button labeled "Recommendations". If you click on the "Recommendations" button I believe that you will get a window that indicates something like:

• I have a firewall that I'll monitor myself.
  and
• I have an antivirus program that I'll monitor myself.

Note: with these setting Windows won't monitor your firewall and virus protection status and won't send you alerts if they are off or out of date.

Modify these setting to let Windows Security Center monitor your firewall and anti-virus and see how it works out (I know it will work with your ZoneAlarm).

[alvis]

I have checked the options that I have both a firewall and antivirus protection which I will monitor myself. Is this what you meant?

If I uncheck these options I receive messages (in the system tray) that I am unprotected - when I know I am.

Sorry to be so computer-illiterate.

[md usa spybot fan]

I'm sorry that it isn't working on your system. I don't quite understand it because it works fine on my system. As I indicated, I have McAfee anti-virus and ZoneAlarm firewall which are being monitored by Window Security Center.

Window Security Center should be able to monitor at lease the following products:

• Ahnlab AntiVirus
  ComputerAssociates AntiVirus
  Kaspersky AntiVirus
  McAfee AntiVirus
  Panda AntiVirus
  Sophos AntiVirus
  Symantec AntiVirus
  Trend AntiVirus
• McAfee Firewall
  Panda Firewall
  Symantec Firewall
  Tiny Firewall
  Trend Firewall
  ZoneLabs Firewall

I guess you'll have to return the settings back to the way they were.

[alvis]

I have AVG 7.1 Professional and Zone Alarm and have indicated that I have these on the Windows Security Centre.

As recommended on http://www.spybot.info/en/faq/46.html I have now "excluded the detection from future scans" of these overrides. Before doing this I tried turning off both the AVG and Zone Alarm and was immediately warned by Windows Security that my computer was unprotected by antivirus and a firewall. However, this will not now happen and if either my anti-virus or firewall is accidentally turned off for some reason, I will not be warned. Is there some way round this?