Spybot & Windows Security Centre.....warning

[michaelh613]

Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.

[md usa spybot fan]

michaelh613:

Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.

That may be true because I have not had any experience with dealing with Norton Security 2008 (after all it's only January 2nd).

However, in the past with Norton Security (NAV 2006 and 2007) there was a circumvention for leaving Windows Security Center active while running Norton.

I am soliciting your help. Please read the bottom of post #3 in the following thread and let me know what part of the statement is no longer true:

• I need some help with Microsoft windows securitycenter_disabled
  http://forums.spybot.info/showthread.php?t=13399

…

Symantec apparently went one step further with the introduction their 2006 and 2007 product lines. Rather than just disable the Firewall and Virus Protection alert features within Windows Security Center, they now disable Windows Security Center itself so that it doesn't even start in your system. Again, to the best of my knowledge there is no notification to the user that has been done and to the best of my knowledge they do not restore the starting of Windows Security Center if you uninstall their product. The disabling of Windows Security Center causes the following Spybot detection:

Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, nothing done) 
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2

If you go to Start > Run > type "services.msc" (no quotes) in the Open box > and then click OK the windows Services application will start. If you scroll down in the right pane until you see Security Center and either double click on Security Center or right click on Security Center and choose Properties from the context menu, the Security Center Properties window will open. You will note that:

• The Startup type is Disabled (it is normally Automatic).
• The Services Status is Stopped (it is normally Started).

__________________

All that said, down to your problem with the detections themselves.

You essentially have three options:

1. Leave everything as is and just ignore the detections when you get them during a Spybot "Check for problems".
2. Restore the functionality of Windows Security Center as follows:
   
   • Open Norton Protection Center.
   • Click Options.
   • Check "Show messages from Windows Security Center", then click OK.
3. Permanently ignore the detections within Spybot so that a "Check for problems" does not check for disabled Windows Security Center features. To exclude these items from future detections:
   
   • Run another scan.
   • Expand the detection if necessary (+ to the left of the detection).
   • Select the item (entry) that you want to exclude by left clicking on it to highlight it.
   • Then right click on highlighted detection.
   • Select either of the following from the list of options in the menu.
     
     • Exclude this detection from further searches
     • Exclude this product from further searches
   
   In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.
   
   Since the Windows Security Center detections have been separated into individual "Products" to facilitate exclusion, you can also go into Spybot > Mode > Advanced mode > settings > Ignore products > in either the All products or Security.sbi tab and check the following Windows Security Center detections:
   
   • Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
   • Microsoft.WindowsSecurityCenter.FirewallDisableNotify
   • Microsoft.WindowsSecurityCenter_disabled
   
   Note: If you can't see the full name of the product, expand the Product column of the screen by placing the cursor in the column title bar between the Product and Detail columns until the column separator move symbol appears (cross with arrow heads pointing left and right), press and hold the left mouse button and drag the column separator to the right.

[michaelh613]

Thanks for the help

[CyberWanderer]

Hello,

I have an issue that is related to this thread by being the opposite.

For a long time now, I have been receiving the alert for Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify and Microsoft.WindowsSecurityCenter.FirewallDisableNotify.

Since downloading the updates on Jan. 9, 2008 the above are no longer detected (no changes were made to Security Center or Norton settings).

In fact, the following entries are missing from Security.sbi:
Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
Microsoft.WindowsSecurityCenter.FirewallDisabled
Microsoft.WindowsSecurityCenter.FirewallDisableNotify
Microsoft.WindowsSecurityCenter.UpdateDisableNotify

Has anyone else experienced this? And are these entries supposed to be absent from Security.sbi?

Thanks in advance!

[brox1]

Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot

Good Explanation.
But please tell me why this explanation does not appear on the right side of the Spybot window where it shows descriptions of other problems that it has found?
Brox1

[tall pockets]

I'm a newbie to spybot.a greenhorn,but want to learn. After the first scan,the results show i have 175 items in the red! and no green tracks.I must be reading this wrong.I would like to keep it simple and just push the delete button but i'm afraid they might be attached to something important,there is no info. on each selected item,just a simble that says registry to the right. And are these items quarintined until i decide?

[Zenobia]

No,the items wouldn't be quarantined unless you decided to fix selected problems,depending on what they are.If the items are tracking cookies,then they aren't put into recovery(quarantined).

What version of Spybot do you have?If you're unsure,click Help,then About.

Let's see what Spybot is finding.Could you do this?

• Open SpyBot.
• Check for problems.
• When the scan completes, right click on the results list, select "Copy results to clipboard".
• Paste (Ctrl+V) those results here.

[tall pockets]

I have version 1.6.2.0.,..I right clicked on report and saved to log but dont know how to paste yet. Went to adv. settings & found log.,Sorry,exactly when do i (ctrl+v)?

[spybotsandra]

on your keyboard.

[Zenobia]

Yes,after you click Post Reply here,you press ctrl+v on your keyboard to paste the log here.
There's a website where you can practice Copying and Pasteing first,if you like:
http://www.webmasternow.com/copyandpaste.html