Spybot & Windows Security Centre.....warning

[debanks]

Spyboot keeps finding two suspicious and recuring files. Windows Security Centre Firewall\Disable Notify. There is a similar one for Firewall. These files are in Settings HKEY_LOCAL_MACHINE\Software\Microsoft\SecurutyCentre\Antivirus disable Notify!=dwordO.
I delete them but they recur. In windows security centre everything is switched on. I'm running McAfee Firewall and anti Virus plus AGV free anti virus on XP Home. My questions are : Are these files dangerous, what do they mean and how can I stop them recuring.

I did have a Bagle worm that slipped through undetected.

Derek Banks

[spybotsandra]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

[loctet]

[QUOTE=spybotsandra]Hello,

In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.

I have a problem, the contextual menu does not allow this modification. The line in is dimmed (not selectable).

Thanks.
Best regards

[md usa spybot fan]

If you want to exclude the item from future detections:

• Expand the detection if necessary (+ to the left of the detection).
• Select the item (entry) that you want to exclude by left clicking on it to highlight it.
• Then right click on highlighted detection.
• Select from the list of options in the menu.

In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.

[nickW]

Bonjour loctet,

Il faut être en "Mode avancé" pour pouvoir effectuer cette manip.

Voir en haut, dans le menu Mode.

Salut.

[md usa spybot fan]

NickW:

I do not believe that you are correct. There is a difference between:

• "Exclude this detection from further searches"
  and
• "Exclude this product from further searches"

spybotsandra's original suggestion was to:

… exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans".

To the best of my knowledge you can only "Exclude this detection from further searches" after you "Check for problems" and the detection is listed on the problem detection screen.

You can exclude "products" (or un-exclude them) by going into Spybot > Mode > Advanced mode > Settings > Ignore products.

If you have excluded a single detection you can remove it from the ignore list by going into Spybot > Mode > Advanced mode > Settings > Ignore single entries.

[FredOp]

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.

The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

First, thank you for the clear and concise explanation of what is being detected and why. In fact, I found it so helpfuly, I have a Feature Request because of it. And, since I couldn't find where one puts Feature Requests, I'm putting it here. My apologies if I missed the right place to post it; I have an amazing ability to miss the obvious. Anyway, feel free to forward/move/whatever this post to the right place if I have missed where to make a feature request. That said, on to the feature request:

It would be very handy if your explanation (in some form) would be given when clicking the Information tab found on the right in Search & Destroy. This way those of us running Mcafee, Norton, etc can know this is a normal result quickly, saving us from panic, and letting us know to just exclude the result from future checks.

As I imagine that those of use safety-minded among us to be running Spybot-S&D! in the first place also run Mcafee, Norton, and the like, I think it would benefit a great number of users as well as cutting down on us having to search the forums and those of you in Support from having to explain (again) not to worry. (I'm a big fan of saving time and effort for everyone)

In any case, thanks again for the information.

FredOp
The Overly Wordy User

[averagenetperson]

Thanks this pretty much helped me and thanks for solving the issue! For better security, do you recommend I make Windows Security Center my default or Mcafee Security Center. Currently, I chose Macafee.

Don't know what happened but Spybot detected ''Webhancer'' earlier this week and deleted it but since then Spybot has caught all kinds of spyware and cookies; before that my scans were always clean. Apparently this Webhancer is a big pain and has compromised my security!

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

[19712]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

In order to exclude, Windows Security Center Firewall/DisableNotify and Windows Security Center AntiVirus/DisableNotify, you must ritht click and highlight the parts listing the HKeys. otherwise the exclude this detection is not lit up. Please confirm this since I do not want to do any damage to the registry.

[md usa spybot fan]

19712:

Correct.

From post #5 of this thread:
http://forums.spybot.info/showpost.p...51&postcount=5

If you want to exclude the item from future detections:

• Expand the detection if necessary (+ to the left of the detection).
• Select the item (entry) that you want to exclude by left clicking on it to highlight it.
• Then right click on highlighted detection.
• Select from the list of options in the menu.

In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.