Windows SecurityCenter doesn't detect my AV

Baejung92 · 02-28-2009, 02:36 PM

I've been using McAfee for my antivirus for a while, and generally had no problems with it (I know it's not the best solution out there though :/). Last night, though, my computer got infected with something, and I had to remove it with MBAM. The computer's running without any noticeable problems right now, and so that's not my concern.

The problem is, now I get a Windows SecurityCenter alert saying that I don't have any AV or Firewall installed. This had never happened before (I'm guessing McAfee was even able to send information to Security Center, because I got reports in the form of "McAfee reports that..." when I turned a component off), and McAfee itself is operating fine--I can update it and scan with it, and the Firewall's operating normally. What might be the problem here? Thanks in advance for any clarification or advice!

tetonbob · 02-28-2009, 04:10 PM

Check these values:

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000000

Baejung92 · 02-28-2009, 08:32 PM

It looks like both dword values are set to 0x00000001 (1).

tetonbob · 02-28-2009, 09:18 PM

That means Windows Security Center is not monitoring McAfee.

Baejung92 · 02-28-2009, 10:23 PM

Ahh that's what it was. How can I change it back?
And also... that infection has returned (I posted a thread in the malware removal forum), so until I can get that fixed I probably won't be able to touch the registry.

tetonbob · 02-28-2009, 10:41 PM

It's more likely you've been reinfected, not that the infection returned, after this length of time. One has to be mindful of the sites one visits on the internet today, and take measures to prevent infection, such as those TheBruce1 outlined for you in your previous topic. Unlike the other sections of the forum, we generally don't like seeing "repeat customers" in the malware removal section, particularly so soon after a disinfection.

It means something is being done wrongly on this machine, and the previous volunteer's efforts (and yours) have been wasted. As we indicate in our pre-posting topic:

Quote:

It is not our intent to repeatedly remove malware from the same member's machines. The intent of this free service performed by volunteers is to help remove malware from your machine, educate you on how it may have happened, and how to prevent that from happening again. To this end, we provide links to articles and tools which should make your visit to the Virus/Trojan/Spyware Help section of TSF a one time event. Please do enjoy the rest of Tech Support Forum as many times as you like!

You're right, there's no sense changing that in the registry while the machine is infected. You'll have to wait for one of the helpers to reply.

I see that you were not able to run GMER. This is often an indication of a rootkit.

See if this file will run for you, and post the log in your other topic, NOT here.

http://www.techsupportforum.com/atta...start-omer.zip

Logs should be from Normal mode, NOT Safe mode, unless otherwise specified.

Baejung92 · 03-01-2009, 11:27 AM

Do you mean that I've been reinfected by the thing from two days ago, or the one from my first visit to this forum in December? I really did my best to follow all those steps outlined in TheBruce1's last post (using the browser plugins, scanning with alternate antispyware products, generally staying away from suspicious sites) but I guess I made a mistake somewhere. Also, I know this sounds like an excuse but I'm not the only one that uses this computer

I really appreciate the help of everyone on this forum. I'll try and make sure to not have to return to that particular board again.

I checked my other thread before this one, so I was able to run and post a log of GMER in that one with Ried's instructions... it did find signs of a rootkit.

02-28-2009, 02:36 PM	#1 (permalink)
Baejung92 Registered User Join Date: Dec 2008 Posts: 173 OS: Windows XP SP3	Windows SecurityCenter doesn't detect my AV I've been using McAfee for my antivirus for a while, and generally had no problems with it (I know it's not the best solution out there though :/). Last night, though, my computer got infected with something, and I had to remove it with MBAM. The computer's running without any noticeable problems right now, and so that's not my concern. The problem is, now I get a Windows SecurityCenter alert saying that I don't have any AV or Firewall installed. This had never happened before (I'm guessing McAfee was even able to send information to Security Center, because I got reports in the form of "McAfee reports that..." when I turned a component off), and McAfee itself is operating fine--I can update it and scan with it, and the Firewall's operating normally. What might be the problem here? Thanks in advance for any clarification or advice! Last edited by Baejung92; 02-28-2009 at 02:45 PM.

02-28-2009, 04:10 PM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,555 OS: 2000 Pro; XP Pro; XP Home	Re: Windows SecurityCenter doesn't detect my AV Check these values: [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000000 __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-28-2009, 08:32 PM	#3 (permalink)
Baejung92 Registered User Join Date: Dec 2008 Posts: 173 OS: Windows XP SP3	Re: Windows SecurityCenter doesn't detect my AV It looks like both dword values are set to 0x00000001 (1).

02-28-2009, 09:18 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,555 OS: 2000 Pro; XP Pro; XP Home	Re: Windows SecurityCenter doesn't detect my AV That means Windows Security Center is not monitoring McAfee. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-28-2009, 10:23 PM	#5 (permalink)
Baejung92 Registered User Join Date: Dec 2008 Posts: 173 OS: Windows XP SP3	Re: Windows SecurityCenter doesn't detect my AV Ahh that's what it was. How can I change it back? And also... that infection has returned (I posted a thread in the malware removal forum), so until I can get that fixed I probably won't be able to touch the registry.

03-01-2009, 11:27 AM	#7 (permalink)
Baejung92 Registered User Join Date: Dec 2008 Posts: 173 OS: Windows XP SP3	Re: Windows SecurityCenter doesn't detect my AV Do you mean that I've been reinfected by the thing from two days ago, or the one from my first visit to this forum in December? I really did my best to follow all those steps outlined in TheBruce1's last post (using the browser plugins, scanning with alternate antispyware products, generally staying away from suspicious sites) but I guess I made a mistake somewhere. Also, I know this sounds like an excuse but I'm not the only one that uses this computer I really appreciate the help of everyone on this forum. I'll try and make sure to not have to return to that particular board again. I checked my other thread before this one, so I was able to run and post a log of GMER in that one with Ried's instructions... it did find signs of a rootkit.