Spybot & Windows Security Centre.....warning

i did read the Before you Post thread, and i've already done everything in it. however running spybot and ad-aware, as well as some other programs, does not help.

however i will try to start my own thread at the other forum. thanks =)
 
bordello said:
I recently ran SpyBot and got the same notifications as the subject of this thread. I wanted to add some additional information for those readers who use Norton AntiVirus (and I'm sure there is something like this for McAfee) who do not want to simply disable the notifications from SpyBot in the future.

Once I got the notification, I followed the steps to see if the notifications were indeed disabled. Control Panel-->Security Center-->Looked under Resources on the left hand side, but noticed that the "Change the way Security Center alerts me" was grayed out. I thought for sure this was something that my AntiVirus software was disabling, so I opened Norton AntiVirus. Chose Options (located at the top) --> Norton Protection Center --> and then found the option to "Show messages from Windows Security Center". I made sure that box was checked, then I applied all the settings.

I could then go back into the Windows Security Center, through Control Panel, and click the "Change the way Security Center alerts me". I found that indeed both the Firewall and Virus Protection alert options were disabled, so I checked both boxes.

I then re-ran Spybot, and sure enough no more "Windows Security Center.AntiVirusDisableNotify" problems arose.
Click to expand...
that is exactly what I've done as well
 
No McAfee or Norton

I believe that you will find that the first and third items are unchecked. This is the cause of the following Spybot detections:

I checked my security notifications and all 3 were marked.
I am running Live One Care.
In the Security Panel it shows firewall disabled on left side
Has green for Firewall and further info indicates One Care firewall etc.

I backed up system and allowed the 2 items to be repaired.
On a rescan they were back.

Thank you
 
well, in my case, Spybot does detect "Microsoft.WindowsSecurityCenter_disabled" registry entry on my XP machines but I set Spybot to "exclude" that kind of detection because I know I set the Security Center service type to Manual instead of having Security Center automatically load at startup.

some for some users who are encountering Spybot detecting some stuff related to Security center, you may want to exclude those detections and Spybot will not report them anymore if you have installed a third party firewall or have set Security Center service type to either Disabled or Manual.
 
Last edited:
Well I have read a little bit of this thread, and the reason that I am here is similar, I get the same warning, but I also loose my adminasrator rights along with the controll panel, all I hafta do is run spybot and I regain everything, but the warning still pops up no matter what I do, and yes I did change the settings. It is a virus that spy bot is not able to delet, cause after rebooting it all comes back, or should I say it all goes away, can you folks come up with a solution that works?
Thanx in advance.
Rich
 
I guess I should add,,, the values are changed on 3 regestry keys, that consests of 5 values changed when I run a bot check, then If/when I reboot the values are re-changed to where my controll panel goes away, and I have no admin privelages. (sorry about the spelling)
Rich
 
Where do you start the security center service

spybotsandra said:
Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot
Click to expand...

Silly question but my security service was stopped by malware. I've now deleted all the malware and this is the only error that pops up and I can't see where to restart the service.
 
michaelh613:

Assuming that you are taking about Windows Security Center and the following detection:

Code: 
Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, nothing done) 
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2
If you fix the detection with Spybot and restart your system the Windows Security Center should start.

As an alternative:
  • Go to Start > Run > type: services.msc > OK.
  • In the right pane, scroll down until you see Security Center.
  • Right click on Security Center and choose Properties from the context menu.
  • Change the Startup type from disabled to automatic.
  • Click Apply.
  • Under Services Status click on the Start button.
  • Close Services.
 
Thanks it appear norton disables it

Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.
 
michaelh613:

michaelh613 said:
Thanks I actually had done that. Called MSFT which told me that the security center is disabled by Norton and cannot work if you use Norton Security 2008 so Spybot will always give me that 'error' now.
Click to expand...

That may be true because I have not had any experience with dealing with Norton Security 2008 (after all it's only January 2nd).

However, in the past with Norton Security (NAV 2006 and 2007) there was a circumvention for leaving Windows Security Center active while running Norton.

I am soliciting your help. Please read the bottom of post #3 in the following thread and let me know what part of the statement is no longer true:
md usa spybot fan said:
…

Symantec apparently went one step further with the introduction their 2006 and 2007 product lines. Rather than just disable the Firewall and Virus Protection alert features within Windows Security Center, they now disable Windows Security Center itself so that it doesn't even start in your system. Again, to the best of my knowledge there is no notification to the user that has been done and to the best of my knowledge they do not restore the starting of Windows Security Center if you uninstall their product. The disabling of Windows Security Center causes the following Spybot detection:

Code: 
Microsoft.WindowsSecurityCenter_disabled: Settings (Registry change, nothing done) 
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start!=W=2
If you go to Start > Run > type "services.msc" (no quotes) in the Open box > and then click OK the windows Services application will start. If you scroll down in the right pane until you see Security Center and either double click on Security Center or right click on Security Center and choose Properties from the context menu, the Security Center Properties window will open. You will note that:
  • The Startup type is Disabled (it is normally Automatic).
  • The Services Status is Stopped (it is normally Started).
__________________

All that said, down to your problem with the detections themselves.

You essentially have three options:
  1. Leave everything as is and just ignore the detections when you get them during a Spybot "Check for problems".
  2. Restore the functionality of Windows Security Center as follows:
    • Open Norton Protection Center.
    • Click Options.
    • Check "Show messages from Windows Security Center", then click OK.
  3. Permanently ignore the detections within Spybot so that a "Check for problems" does not check for disabled Windows Security Center features. To exclude these items from future detections:
    • Run another scan.
    • Expand the detection if necessary (+ to the left of the detection).
    • Select the item (entry) that you want to exclude by left clicking on it to highlight it.
    • Then right click on highlighted detection.
    • Select either of the following from the list of options in the menu.
      • Exclude this detection from further searches
      • Exclude this product from further searches
    In other words left click to select then right click to display options. If you don't select (highlight) the item first the options menu is for the entire detection list.

    Since the Windows Security Center detections have been separated into individual "Products" to facilitate exclusion, you can also go into Spybot > Mode > Advanced mode > settings > Ignore products > in either the All products or Security.sbi tab and check the following Windows Security Center detections:
    • Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
    • Microsoft.WindowsSecurityCenter.FirewallDisableNotify
    • Microsoft.WindowsSecurityCenter_disabled
    Note: If you can't see the full name of the product, expand the Product column of the screen by placing the cursor in the column title bar between the Product and Detail columns until the column separator move symbol appears (cross with arrow heads pointing left and right), press and hold the left mouse button and drag the column separator to the right.
Click to expand...
 
Hello,

I have an issue that is related to this thread by being the opposite.

For a long time now, I have been receiving the alert for Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify and Microsoft.WindowsSecurityCenter.FirewallDisableNotify.

Since downloading the updates on Jan. 9, 2008 the above are no longer detected (no changes were made to Security Center or Norton settings).

In fact, the following entries are missing from Security.sbi:
Microsoft.WindowsSecurityCenter.AntiVirusDisableNotify
Microsoft.WindowsSecurityCenter.FirewallDisabled
Microsoft.WindowsSecurityCenter.FirewallDisableNotify
Microsoft.WindowsSecurityCenter.UpdateDisableNotify

Has anyone else experienced this? And are these entries supposed to be absent from Security.sbi?

Thanks in advance!
 
Microsoft Security Center Registry changes

spybotsandra said:
Hello,

Since the Detections Update from July 25, 2005, Spybot - Search & Destroy 1.4 has been detecting Security Risks (renamed to "Windows Security Center" on July 30) associated with Microsoft Security Center Registry changes. This is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one or more notifications in the Windows Security Center, e.g. the notifications that your virus protection is not active or not up-to-date. If you changed the settings yourself you can safely tell Spybot-S&D to exclude those detections from further scans.
In order to do so please right-click each in turn, then click "exclude this detection from future scans". That way, should any other part of security center settings change, Spybot-S&D will still detect those.
The same is true if you have another security solution installed (like McAfee Security Center or Norton Internet Security). These programs do also disable the Windows Security Center in order to take care of things themselves.
The reason why the changes are flagged by Spybot-S&D is that there are also malware programs that disable the notifications so the user doesn't take note of his security tools not being effective.

Best regards
Sandra
Team Spybot
Click to expand...

Good Explanation.
But please tell me why this explanation does not appear on the right side of the Spybot window where it shows descriptions of other problems that it has found?
Brox1
 
To delete or not to delete?

I'm a newbie to spybot.a greenhorn,but want to learn. After the first scan,the results show i have 175 items in the red! and no green tracks.I must be reading this wrong.I would like to keep it simple and just push the delete button but i'm afraid they might be attached to something important,there is no info. on each selected item,just a simble that says registry to the right. And are these items quarintined until i decide?
 
No,the items wouldn't be quarantined unless you decided to fix selected problems,depending on what they are.If the items are tracking cookies,then they aren't put into recovery(quarantined).

What version of Spybot do you have?If you're unsure,click Help,then About.

Let's see what Spybot is finding.Could you do this?
  • Open SpyBot.
  • Check for problems.
  • When the scan completes, right click on the results list, select "Copy results to clipboard".
  • Paste (Ctrl+V) those results here.
 
Last edited:
first scan

I have version 1.6.2.0.,..I right clicked on report and saved to log but dont know how to paste yet. Went to adv. settings & found log.,Sorry,exactly when do i (ctrl+v)?
 
You must log in or register to reply here.
Back
Top