Spybot scans registry change...

From: "Massimo"

| Hello,
|
| Spybot scan mentions this registry change:
|
| Microsoft Windows SecurityCenter.FirewallOverride
| (SBI $0C94D702) settings
| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride
| (is not) dword:0
|
| What does it mean and what would be advisable to do?
|
| Thanks,
|
| Massimo

If you are using a 3rd party FireWall application, ignore it.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

David H. Lipman wrote:
> From: "Massimo"
>
> | Hello,
> |
> | Spybot scan mentions this registry change:
> |
> | Microsoft Windows SecurityCenter.FirewallOverride
> | (SBI $0C94D702) settings
> | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride
> | (is not) dword:0
> |
> | What does it mean and what would be advisable to do?
> |
> | Thanks,
> |
> | Massimo
>
> If you are using a 3rd party FireWall application, ignore it.
>
If I recall, it just means that the Windows firewall manager cannot see
and control whatever firewall is in use.

Search and Destroy has the ability to exclude any detection if that is
the case.

Hello Lon,

On Mon, 26 May 2008 10:11:05 -0600, Lon
wrote:

>Spybot forum:
>http://forums.spybot.info/showthread.php?t=2940

Thanks for the link.

Massimo

Hello David,

On Mon, 26 May 2008 17:57:20 GMT, "David H. Lipman"
wrote:

>From: "Massimo"
>
>| Hello,
>|
>| Spybot scan mentions this registry change:
>|
>| Microsoft Windows SecurityCenter.FirewallOverride
>| (SBI $0C94D702) settings
>| HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride
>| (is not) dword:0
>|
>| What does it mean and what would be advisable to do?
>|
>| Thanks,
>|
>| Massimo
>
>If you are using a 3rd party FireWall application, ignore it.

I use Comodo firewall...
Thanks for the clear answer.

Massimo

Hello,

On Mon, 26 May 2008 12:34:11 -0600, Lon
wrote:

>David H. Lipman wrote:
>> From: "Massimo"
>>
>> | Hello,
>> |
>> | Spybot scan mentions this registry change:
>> |
>> | Microsoft Windows SecurityCenter.FirewallOverride
>> | (SBI $0C94D702) settings
>> | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride
>> | (is not) dword:0
>> |
>> | What does it mean and what would be advisable to do?
>> |
>> | Thanks,
>> |
>> | Massimo
>>
>> If you are using a 3rd party FireWall application, ignore it.
>>
>If I recall, it just means that the Windows firewall manager cannot see
>and control whatever firewall is in use.
>
>Search and Destroy has the ability to exclude any detection if that is
>the case.

Hmm. Thanks Lon.

Massimo

On Mon, 26 May 2008 15:16:51 +0200, Massimo
wrote:

> Hello,
>
> Spybot scan mentions this registry change:
>
> Microsoft Windows SecurityCenter.FirewallOverride
> (SBI $0C94D702) settings
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride
> (is not) dword:0
>
> What does it mean and what would be advisable to do?
>


I know this post is very, very late, but I just added this group.

If you are running an AntiVirus, like Symantec (aka Norton), they turn
off various Windows features because the AntiVirus handles these. The
"FirewallOveride" is just one of them.

The upshot is, with the AntiVirus installed, having these features in
Windows disabled is normal. SpyBot sees this. To prevent future
notices from SpyBot you use the set to ignore these problems as
follows:

Change to Advanced Mode
Settings (on sidebar)
Select Ignore Products
Click the Security.sb1 tab
Now use the checkboxes to set ignore for;
...Microsoft.Windows.AppFirewassBypass
...Microsoft.WindowsSecurityCenter.FirewallBypass
Change back to Default Mode

You should also set ignore for whatever else is normal for you, such
as the WindowsSecurityCenter overrides for Automatic Updates (I have
auto-updates turned off on my home system, I run Microsoft Updates
manually each Wednesday).

--
======== Tecknomage ========
Computer Systems Specialist
IT Technician
San Diego, CA