Norton Internet Security / Norton AntiVirus

[joen]

NIS 2011 18.1.0.37
XP Pro + SP3 + updates

Yesterday (12/1) I ran an NIS full scan on this computer.  Found nothing.

Today (12/2) I ran an NIS quick scan, found nothing.

Then I ran a full scan with MalwareBytes 1.50 and it found two registry entries:  pum.disabled.securitycenter.

MB's website doesn't say a whole lot about it.
"First seen 12/1/10"

And I just ran a MB quick scan, and their quick scan finds it also.

Anyone heard of this?

[aviben1994]

Nope but sounds like a rogue or Adware like

[Tywin7]

From what I can tell, the security center registery keys is that something have disabled the security center and MBAM wants to remove these keys so that security center can work again.  From my experience, Norton used to disable security center so unless Norton/MBAM detects something or there is other suspecious behavior, you could remove these threats.

[mdturner]

---

Tywin7 wrote:

From my experience, Norton used to disable security center so unless Norton/MBAM detects something or there is other suspecious behavior, you could remove these threats.

---

The Windows Security Center has never been disabled by Norton.

[Tywin7]

NIS06 disables the security center.

[JoePainter]

I have been dealing with this issue for a few days now and have ran MB that discovered it. I then looked up the HOT_KEY for it and found it in the registry. I then FIXED it with MB but DID NOT let MB reboot my computer. I then reran MB and the PUM.disabled.securitycenter was gone along with the HOT_KEY. So I'm going to run my computer as is until I have to reboot it and then I will run MB again without rebooting. I will do this until I find a permanent fix.

[SendOfJive Norton Fighter]

Hi joen,

Are these the entries you are referring to?:

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

If so, these are not indications of any infection.  PUM stands for Potentially Unwanted Modifications.  These two entries simply indicate that settings have been changed so that Windows Security Center will not notify you if your antivirus and firewall, respectively, have been turned off.  Norton turns these settings off to prevent duplicate notifications, since Norton will also alert you to these events.  Letting Malwarebytes' fix these will result in a Windows warning along with a Norton warning whenever your anitvirus and/or firewall is disabled.  So the choice to fix these or ignore them is a mattter of personal preference.  I set mine to have Windows also alert me, just in case Norton becomes completely disabled and is unable to flash a notice.

Note that Norton does not, and never has, disabled the Windows Security Center.  It does turn off notifications, that is all.

There is a discussion of some of these newly named Malwarebytes' detections at Wilders:

http://www.wilderssecurity.com/showthread.php?p=1791191

[Tywin7]

---

SendOfJive wrote:

Hi joen,

Are these the entries you are referring to?:

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

If so, these are not indications of any infection.  PUM stands for Potentially Unwanted Modifications.  These two entries simply indicate that settings have been changed so that Windows Security Center will not notify you if your Antivirus and firewall, respectively, have been turned off.  Norton turns these settings off to prevent duplicate notifications, since Norton will also alert you to these events.  Letting Malwarebytes' fix these will result in a Windows warning along with a Norton warning whenever your anitvirus and/or firewall is disabled.  So the choice of whether to fix these or ignore them is a mattter of personal preference.  I set mine to have Windows also alert me, just in case Norton becomes completely disabled and is unable to flash a notice.

Note that Norton does not, and never has, disabled the Windows Security Center.  It does turn off notifications, that is all.

---

Actually that what was what I was talking about earlier.

[SendOfJive Norton Fighter]

It may be what you were thinking, but twice you posted that Norton disables the Windows Security Center which would be an entirely different matter.  Please consider what you intend to say before posting.

[joen]

Thanks, everyone, for your responses.

SOJ, yes those are the registry entries.  I appreciate your explanation.  Today I added those entries to mbam's ignore list and a subsequent quick scan does not show them.

> Norton does not, and never has, _disabled_ the Windows Security Center.  It does turn off notifications, that is all.

This particular computer is XP Pro, NIS 2011, and mbam 1.5.  This is the _only_ one that mbam alerts those two registry entries.

Two other computers (Vista, Win 7) with NIS 2010 and the same mbam 1.5 do _not_ flag them.

I'm wondering if it's the different OS, the different NIS, or something else.

In any case, putting them on mbam's ignore list appears to have solved the issue.