Do I have two real "security threats"?

[Gilbert Shaver]

Wednesday, July 27, 2005

I have a question. First, here's the background to the
question:

I have Microsoft AntiSpyware (Beta) running actively on
my computer, so it's always checking my system. I always
keep current with all the updates.

I also have SpyBot S&D (current version) which I do not
run actively on my computer but I do keep current with
SpyBot's updates.

I run each program to scan my computer at least twice a
week.

Here is my question:

Today, I ran SpyBot S&D and it "detected" two "security
risks" which I have copied here below. A few minutes
later, I ran Microsoft AntiSpyware to scan my computer.
Microsoft AntiSpyware did not detect any threats on my
computer.

This now leads me to my big question: Can anyone tell me
whether the two "changes" made to my registry (see below)
are part of Microsoft's AntiSpyware program and updates?
Or, has SpyBot actually detected two threats that I
should have SpyBot quarantine? I obviously don't want any
real threats lurking on my computer. At the same time, I
don't want to quarantine or remove false-positive
registry items, especially if these rightly belong to the
Microsoft AntiSpyware (Beta) program and have been
installed in the latest update.

Can anyone advise me? What do you think I should do? I
will appreciate knowledgeable feedback.

Thanks,

GS
(e-mail address removed)


Security Risks: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\FirewallDisableNotify!=dword:0

Security Risks: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\AntiVirusDisableNotify!=dword:0


--- Spybot - Search & Destroy version: 1.4 (build:
20050523) ---

2005-05-31 blindman.exe (1.0.0.1)
2005-05-31 SpybotSD.exe (1.4.0.3)
2005-05-31 TeaTimer.exe (1.4.0.2)
2005-06-18 unins000.exe (51.41.0.0)
2005-05-31 Update.exe (1.4.0.0)
2005-05-31 advcheck.dll (1.0.2.0)
2005-05-31 aports.dll (2.1.0.0)
2005-05-31 borlndmm.dll (7.0.4.453)
2005-05-31 delphimm.dll (7.0.4.453)
2005-05-31 SDHelper.dll (1.4.0.0)
2005-05-31 Tools.dll (2.0.0.2)
2005-05-31 UnzDll.dll (1.73.1.1)
2005-05-31 ZipDll.dll (1.73.2.0)
2005-04-26 Includes\Cookies.sbi (*)
2005-07-22 Includes\Dialer.sbi (*)
2005-07-22 Includes\Hijackers.sbi (*)
2005-06-23 Includes\Keyloggers.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2005-07-22 Includes\Malware.sbi (*)
2004-08-11 Includes\plugin-ignore.ini
2005-07-22 Includes\PUPS.sbi (*)
2005-04-27 Includes\Revision.sbi (*)
2005-07-22 Includes\Security.sbi (*)
2005-07-19 Includes\Spybots.sbi (*)
2005-02-17 Includes\Tracks.uti
2005-07-22 Includes\Trojans.sbi (*)

 

[Robin Walker [MVP]]

Today, I ran SpyBot S&D and it "detected" two "security
risks" which I have copied here below. A few minutes
later, I ran Microsoft AntiSpyware to scan my computer.
Microsoft AntiSpyware did not detect any threats on my
computer.

Security Risks: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\FirewallDisableNotify!=dword:0

Security Risks: Settings (Registry change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security
Center\AntiVirusDisableNotify!=dword:0

These are two new checks recently added to SpyBot. All they are saying is
that either (a) you have disabled some of the reporting features of the
Windows Security Center, or (b) some other program has turned them off
behind your back. It is known that the McAfee suite turns off these
features in Windows, because the McAfee suite has other ways of reporting to
you.

If you have McAfee on your PC, you can regard the findings above as a slight
incompatibility between SpyBot and McAfee.

 

[Q]

Dont worry about this, This is just a added protection to
see if your antivirus and firewall is running. It is for
the Microsoft Security Center. It was changed by your anti
virus to keep you from getting dual notices that your 3rd
party antivirus and firewall was off. (One warning from
your antivirus and one from Security Center.) It could be
helpful as second line of defense in case a virus would
try to turn off your antivirus. It would pop up a Security
Center warning that your antivirus is turned off.