Hey Alan
Hope your well
I agree with you in the older Applications there may be a problem detecting
them which is causing the alerts but AV programs can disable the alerts and
some will disable the windows security centre, Symantec and Mcafee can do
this, If you go to the security centre page then click "Change the way
Security Centre alerts me" then some will uncheck both Virus protection and
Firewall warnings and will even disable the windows security centre if they
have a security centre built into the application like the Symantec 2005
package.
This was what I meant when I said the Av applications can disable them
although this is not the problem here if they are getting Alerts, It was just
to point out that it was hard to comment why they were getting security
centre alerts without more information on if they had AV protection or
Firewall installed and to show the alerts were not connected to MS Antispy in
anyway.
Spybot was causing concerns for Symantec and Mcafee users by reporting
Firewall and Antivirus values had been changed and still detects them, if
they were changed back using the "Change the way Security Centre Alerts Me"
area they would be disabled again when the system reboots,
Spybot was detecting these entries in the scan results which mainly effected
Symantec and Mcafee users:
Windows Security Center.FirewallDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify
!=dword:0
Windows Security Center.AntiVirusDisableNotify: Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\AntiVirusDisableNotify!=dword:0
I was going to post some links to Team Spybots forum Net-Integration giving
examples of this but the forums are down at present,
Here's a quote from Spybot's Customer Support:
"Since the Detections Update from July 25, 2005, Spybot - Search & Destroy
1.4 has been detecting Security Risks (renamed to "Windows Security Center"
on July 30) associated with Microsoft Security Center Registry changes. This
is neither a false positive nor a bug. It is just an information.
Spybot-S&D only wants to bring to your attention that "someone" disabled one
or more notifications in the Windows Security Center, e.g. the notifications
that your virus protection is not active or not up-to-date. If you changed
the settings yourself you can safely tell Spybot to exclude those detections
from further scans. In order to do so please right-click each in turn, then
click "exclude this detection from future scans". That way, should any other
part of security center settings change, Spybot will still detect those.
The same is true if you have another security solution installed (like
McAfee Security Center or Norton Internet Security). These programs also
disable the Windows Security Center in order to take care of things
themselves. The reason why the changes are flagged by Spybot-S&D is that
there are also malware programs that disable the notifications so the user
doesn't take note of his security tools not being effective."
Andy
