"No firewall is turned on" messages at login

[Robert S]

I use Sophos antivirus and the XP firewall. When I log in I usually get a
message "Your computer might be at risk - No firewall is turned on, Sophos
anti-virus is turned off". These two items are definitely switched on and
the message eventually goes away.

How do I prevent this from happening?

 

[Pegasus \(MVP\)]

I use Sophos antivirus and the XP firewall. When I log in I usually get a
message "Your computer might be at risk - No firewall is turned on, Sophos
anti-virus is turned off". These two items are definitely switched on and
the message eventually goes away.

How do I prevent this from happening?

Maybe Windows does not properly detect the status of your
Sophos software. You can turn off the warning itself here:
Control Panel / Security Settings / Change the way Windows
alerts me.

 

[R. McCarty]

Based on how your 3rd-Party applications/services load there may be
a window of time where the Sophos AV isn't initialized. If Security Ctr
is already active it would naturally report the missing AV/Firewall. Once
the services load then Security Center would be satisfied the PC has a
Firewall/AV running. You might want to download/run AutoRuns from
SysInternals to see what type of Startups run on your PC. However, it
can't control the loading sequence. I'd contact Sophos and see if they
are aware of the issue and have a patch/update.

 

[Lem]

I use Sophos antivirus and the XP firewall. When I log in I usually get a
message "Your computer might be at risk - No firewall is turned on, Sophos
anti-virus is turned off". These two items are definitely switched on and
the message eventually goes away.

How do I prevent this from happening?

I have always assumed that this sort of behavior results from the order
in which various applications and services are started at boot time.
With respect to the "no anti-virus" warning, this simply means that
Windows security center has started and performed its check before your
Sophos a/v has completed its start-up. I'm a little surprised that
Windows firewall shows this same behavior. I would have thought it
would have been better integrated into the security checking system.

As for the order of startup items, the official word is that items in
the Run, RunOnce, RunServices, RunServicesOnce registry keys and the
Startup folder load asynchronously. That is, you can't really control
or predict the sequence in which items start. See
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q179365
http://blogs.msdn.com/oldnewthing/archive/2003/12/25/45926.aspx

In my experience, this behavior may occur more frequently if there are a
lot of startup items. Thus, if after some [unspecified] system
reconfiguration, the antivirus ends up at the tail end of the startup
sequence, security center loads up, sees no a/v, complains and posts the
warning balloon. Then, the a/v loads up and a second or so thereafter,
the security center warning goes away.

If you are interested, download Autoruns see what is being started and
in what order.
http://www.microsoft.com/technet/sysinternals/utilities/Autoruns.mspx

If you are really bothered by it, write a script or batch file to
specify the startup order

 

[PA Bear]

Could be the result of a hijackware infection. Run a /thorough/ check for
hijackware, including posting your hijackthis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[johnm]

I have always assumed that this sort of behavior results from the order in
which various applications and services are started at boot time. With
respect to the "no anti-virus" warning, this simply means that Windows
security center has started and performed its check before your Sophos a/v
has completed its start-up.

exactly, I get this all the time, even on a fresh house-cleaning install of
XP, with Kaspersky AntiVirus
seems the Security Center check is faster than KAV loading - I just ignore
it, KAV always starts right after the warning