cancel
Showing results for 
Search instead for 
Did you mean: 

Spybot: AntiVirusDisableNotify

RobDickson
Grafter
Posts: 632
Thanks: 2
Registered: 06-08-2007

Spybot: AntiVirusDisableNotify

Despite having a NAT firewall, having NIS2004, SpyBot, SpywareBlaster, and AdAware installed on my PC, and having PlusNet filter my e-mails for Spam and viruses, I seem to have a problem.

I've just run Spybot, and it's found two registry changes:
* AntiVirusDisableNotify!=dword:0
* FirewallDisableNotify!=dword:0

in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\ directory. These weren't found when I ran a scan about 2 weeks ago.

I've checked the MS Security Center and it seems to be running OK. I've run a virus scan and I'm not infected by a Reatle or Rants virus (or any other virus), and AdAware doesn't show any problems either.

I've got all the latest MS Security Updates, and have not made any changes to the MS Security Center recently, although NIS might have done so on my behalf.

Before I ask Spybot to fix the registry changes, I just wondered whether anybody else has experienced this problem.
6 REPLIES
RobDickson
Grafter
Posts: 632
Thanks: 2
Registered: 06-08-2007

Spybot: AntiVirusDisableNotify - UPDATE

I've just run SpyBot on another PC. As a check, I ran it once without downloading the latest updates, and it didn't find anything. I then downloaded the latest updates (25/07/05), and it's also coming up with the same two security risks. Has anybody else run SpyBot with yesterday's updates?
RobDickson
Grafter
Posts: 632
Thanks: 2
Registered: 06-08-2007

Spybot: AntiVirusDisableNotify

It seems that Spybot is just telling me that I've disabled the Security Center notification of virus checker and firewall. It's just unfortunate that it refers to it as a "registry change".

Spybot Forum
N/A

Spybot: AntiVirusDisableNotify

Well, it is effectivly a registry change, as this is where they are stored.
RobDickson
Grafter
Posts: 632
Thanks: 2
Registered: 06-08-2007

Spybot: AntiVirusDisableNotify

In my opinion, a registry change should refer to a situation where the registry has been changed since the last SpyBot scan, rather than where SpyBot thinks that a registry setting is wrong.

Still, it doesn't really matter. I'll just upgrade to V1.4, and then tell it to ignore these two "problems".
N/A

Spybot: AntiVirusDisableNotify

There are two types of registry change.

Non-critical (in the eyes of spybot) and critital.

A non-critical one, is where a change takes place that doesn't always mean that a virus or spyware package is going to interfear with the system. It doesn't however mean that such changes won't cause problems with your system

A critical change, is where a virus or spyware may possibly attempting to prevent detection. An example is one that disabled the anti-virus or firewall, then prevents the system warning you that now AV or FW is active.
RobDickson
Grafter
Posts: 632
Thanks: 2
Registered: 06-08-2007

Spybot: AntiVirusDisableNotify

Thanks for your reply. It looks like we both posted comments at the same time, and missed the other's comment.

The registry will be changed pretty much continuosly whenever a PC is running, so, as you say, warning about every registry change is pointless. As you also point out, warning about virus and firewall registry changes is important.

The problem is - this isn't a registry change. The settings that these two variables hold are the same now as they were a month ago. Nothing has changed since I changed these settings several months ago.

Anyway, it doesn't really matter - the problem's solved. Thanks for your help.