Need Help With SpyBot Security Risk Item

Hi All,

After downloading the latest SpyBot definitions today, I saw this in the results list in red....

Security Risks: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify!=dword:0

If I decide to fix this, will it change the dword value to 1?

I mean, would fixing this cause XP to recognize my alternate firewall that I am using, or is just alerting me to the fact that I have the MS firewall disabled?

Thanks

 

Hello James,

FWIW, I get two noticfications: one for MS update noticfications and another about AV notifications. I have both disabled.

If I decide to fix this, will it change the dword value to 1?
Yes.

I mean, would fixing this cause XP to recognize my alternate firewall that I am using, or is just alerting me to the fact that I have the MS firewall disabled?
What comes up in the Security Center? It should say WF is disabled and yours is running. If not, then have SpyBot fix that item. Keep in mind that this doesn't affect anything other than notification. If its running the way you want, then ignore it.

Do you have the tray notifications disabled? Under Resources > Change the way Security Center alerts me.

Regards - Charles

 

Hi Charles,

I have disabled Windows firewall (Been that way since I installed XP/SP2), and the security center says that I have no firewall protection.

I am running Sygate firewall, but Windows doesn't recognize it at all, and I kept getting a message saying that I had no firewall protection, when I fact I did.

The constant alert about no firewall bothered me, so I disabled it under Resources.

I was hoping that the SpyBot fix would cause XP to recognize my Sygate firewall, so that I could turn the alert back on.

Does this make sense?

 

Hi James,

I understand. I turned the tray alerts off, I know that I turned AU off and don't want to be reminded of it

BTW, I use Sygate v5.5 and the previous versions were not recognized by the SC. If you were to upgrade - this "problem" would go away.

Regards - Charles

 

My Sygate firewall came with System Suite 5 Charles.

I guess it's about the same as yours?...........Was yours free?

 

Yes, it is the free version.

Have SSD fix the item - make sure that SpyBot's Recovery option is on and make a maual System Restore point if you're using System Restore - that way you're covered if you don't like the results of the fix.

Regards - Charles

 

Thanks!

I'll give it a go.

 

Hi James,

Would appreciate a post back on the result. I think with these new SSD defs that a lot of folks will run into this and would want to know.

Regards - Charles

 

Ok

 

Charles, so far, all I can tell is that the WF notification alert was turned back on, and XP still doesn't recognize my Sygate/SS5 firewall.

I turned the notification back off again, and rebooted.

I might download your version and give it a try before long.

 

Ok, thanks Martin, it's what I thought, this is just about the tray notification (Security Center running in XP's Notification Area) and anyone that turned it off can ignore the Spybot flagged item.

Regards - Charles

 

Yesterday I found the following registry subkeys for the Windows Security Center in my registry.

Code:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall

Anyone:
Were these subkeys made by Microsoft or were they made by a 3rd party?

If these subkeys are typical XP subkeys, then if the DWORD for DisableMonitoring is set to 1, what exactly does that mean?

If these subkeys were created by a 3rd party, does anyone know who may have created them?

James: Since Sygate doesn't appear in the registry (at that location anyway), perhaps this is the reason XP doesn't recognize your firewall.

Charles: If this is the case, then I am confused by your statement from Post #4:
"BTW, I use Sygate v5.5 and the previous versions were not recognized by the SC. If you were to upgrade - this "problem" would go away. "

[Edit:] It seems the Security Center still wouldn't recognize your Sygate v5.5

 

Hi Mailman,

Charles: If this is the case, then I am confused by your statement from Post #4:
What is it that you're puzzled about?

I have the same list - the list comes with SP2's SC. It does not account for every and any security program. The app itself then has to put itself into the list. If you do a search on Symantec/Norton - use my user name, you'll find a thread on Symantec not having updated it's software to be recognized by the SC. The thread should be dated around Sept/Oct of last year.

EDIT: Found the one I was thinking of http://www.windowsbbs.com/showthread.php?t=34466&highlight=Norton

Regards - Charles

 

Would it be possible to enter a registry key for Sygate/SS5 FW manually?

If not, then I might forward this thread to VCOM.

 

Hi James,

I've never tried this, nor have I read of anyone doing so.

Give it a try, regedit has the facility to enter "new" - copy the format and substitute Sygate; just backup the registry, either by using regedit's export feature or System Restore. However, there may be more entries needed than the ones shown in the SC.

Regards - Charles

 

Hi, Charles.

What is it that you're puzzled about?

I thought that Windows SC auto-recognized security products that were in the registry list so I didn't understand what you meant when you said Sygate v5.5 would make the SC's recognition issue "go away" (since it's not already in the SC registry).

If I now understand correctly, you mean Sygate v5.5 adds itself to the SC registry list when it installs while older Sygate versions don't...and any other security product would also have to put it's SC info into the SC registry, even if it already has space "reserved" in the SC registry list.

Thanks for your explanation and link to the thread about Norton.

 

Hi Mailman,

When SC came along with SP2 last August, this sort of question came up frequently, so I became aware of this issue and saw that the reporting was an interaction between the SC and the app.

As the tenor of my post in that thread suggests, I didn't consider it a "big" problem then and I still don't The SC reporting is informational only and doesn't affect the working of the security app.

Regards - Charles