Pum.disabled.securitycenter

[tman80]

I am making sure my HD is up to date and clean so I can clone it to another HD. I do this about every two weeks.
I updated Mbam and ran it and it came up with these three problems. Can anyone tell me what they are?

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5235

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

12/2/2010 9:32:51 PM
mbam-log-2010-12-02 (21-32-51).txt

Scan type: Full scan (C:\|)
Objects scanned: 220141
Time elapsed: 56 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[jholland1964]

PUM stands for Potentially Unwanted Modifications. From what I have found these entries indicate that the default settings have been changed so that Windows Security Center will not notify you if your antivirus, firewall or automatic updates have been turned off. When MBA-M sees this then by allowing it to fix them then it will allow the Security Center to tell you that these three programs are turned off. Do you have any of these items turned off? Do you have the notifications turned off? If so did YOU turn off the programs or turn off the automatic notifications? If you did then you can tell MBA-M to ignore these, however, if you didn't turn off the notifications yourself then this could be a sign of malware on the computer and other scans should be run.

[tman80]

Originally Posted by jholland1964

PUM stands for Potentially Unwanted Modifications. From what I have found these entries indicate that the default settings have been changed so that Windows Security Center will not notify you if your antivirus, firewall or automatic updates have been turned off. When MBA-M sees this then by allowing it to fix them then it will allow the Security Center to tell you that these three programs are turned off. Do you have any of these items turned off? Do you have the notifications turned off? If so did YOU turn off the programs or turn off the automatic notifications? If you did then you can tell MBA-M to ignore these, however, if you didn't turn off the notifications yourself then this could be a sign of malware on the computer and other scans should be run.

Thanks Judy, Yes, I do have/had these turned off. This is the first time MBA-M picked it up. I thought that was what it was, but wanted to be sure. Wonder way it picked them up now as I have not changed anything?

[jholland1964]

Probably picked this up this time because this is a new version of MBA-M. I know I had a similar finding back when MBA-M first updated to version 1.46 because I too have notifications turned off and I have the Window auto updates turned off, I do mine manually.

To allay any fears why now also do the ESET Online scan.
http://www.eset.com/onlinescan/scanner.php?i_agree=14
* You can use Internet Explorer to complete this scan and you will need to allow an Active X to be installed or you may use Firefox
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt.

If it finds something have it remove. If it doesn't find anything then it probably is because of this new version update with MBA-M.
When looking for info on this it seems to have just begun showing yesterday and the findings have, thus far, been with MBA-M.

Some might call these a false positive, which in a way I guess they could be, but also it is MBA-M doing it's job because there are some types of infections that will turn these off so that they can then turn off your anti-virus program and firewall. If the notifications are on of course you should receive notification that your security programs are turned off. MBA-M has settings that look for these during the scans. Like I said, if this is something YOU personally turned off then tell MBA-M to ignore these findings, otherwise the way MBA-M fixes these is by turning them back on and removing the registry entry that says, turn off.

[tman80]

Judy, It was the new update to MBA-M. I have reset everything and all is alright now. I even ran eset just to be sure and it is clean. Maybe this might help someone else who has the same problem.
Thanks for responding.

[jholland1964]

Thanks tman. Thought that was the likely cause. It isn't that uncommon really and truly nothing wrong with MBA-M either. It is just doing the job it was designed to do. You very likely had the older version set to ignore this and with the new version this finding was turned back on.
But anytime you get an unusual finding such as that one it is always better to do some investigation.