Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to disable the "Support for this operating system is ending" warning that the current version of Microsoft Security Essentials displays on Windows XP?

Support ending notification

Based on a quick couple of searches, this warning appears to have been added in the KB2949787 update to Security Essentials, but I can't see a way to revert just that update.

Aside: Since I'm sure people are going to ask, here is why I want to do this:

  • I already have a plan to migrate soon
  • The warning is nagging other people who can't do anything about it
  • Since the warning state uses the orange warning icon and popups, it makes real anti-virus warnings that people may need to know about harder to notice (Edit: Actually, the orange icon and popup is typically only used for less serious conditions like out of date definitions and lack of a recent quick scan, not 'real anti-virus warnings' as such.)
share|improve this question
2  
There is no way to disable this warning. The actual notification alert that is separate from this can be disabled. – Ramhound Apr 5 '14 at 17:23
    
I should clarify my comment. There is no way to disable this warning and have the update installed. – Ramhound Apr 5 '14 at 17:54
3  
Uninstall MSE and install something else? – joeqwerty Apr 5 '14 at 17:58
2  
@brettdj it is doing its job then. – Mr.Mindor Apr 8 '14 at 21:10
1  
@Mr.Mindor from a purist sense yes. But given my parents wont be updating their machine, are light users of the net mainly of newspaper sites and for flight bookings, and they are in a low risk category and what they have works for them – brettdj Apr 27 '14 at 0:38
up vote 26 down vote accepted

Workaround

The end-of-support pop-up notification can't be disabled, and downgrading isn't really an option: Microsoft Security Essentials (MSE) would upgrade itself again, sooner or later. While you could still try to prevent it from upgrading, there's no guarantee that the old MSE version would still receive updates as usual.

Considering the notification is generated by the user interface executable, you can override it with an earlier version while keeping the up-to-date engine.

Update (May 30, 2014)

As commented by @saulius2, the registry changes were detected as a tampering threat. My previous method has been abused by malware creators for malicious purposes, and that's why MSE complained about it. To solve this issue I've since switched to a different approach. In case you applied this workaround before, just follow steps 6-7 again.

Eventually you will need to switch to a different antivirus solution, as the MSE definition signatures won't be updated anymore on Windows XP after July 14, 2015. For the time being, however, the steps below should do the trick:

  1. Get a copy of version 4.4.304.0 of the MSE installer. Any language will do, see the file information below.
  2. Log on with an administrator account, and extract the mseinstall.exe file using 7-Zip.
  3. Open the x86 folder, and extract epp.msi though 7-Zip.
  4. Rename the extracted msseces.exe file to msseces2.exe.
  5. Copy msseces2.exe to the MSE install folder (e.g. C:\Program Files\Microsoft Security Client).
  6. Open a command prompt, type or paste the following command, and press Enter:

    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MSC" /t REG_SZ /d "\"%programfiles%\Microsoft Security Client\msseces2.exe\" -hide -runkey" /f
    
  7. Restart Windows.

Note Although unlikely, make sure to repeat steps 6-7 should MSE upgrade in the future.

Screenshots

Before

Until April 8, 2014:

MSE screenshot 1 MSE screenshot 3 MSE screenshot 4

April 8, 2014 onwards:

MSE screenshot 5 MSE screenshot 6 MSE screenshot 7

After

MSE screenshot 8 MSE screenshot 10

Click for larger view.


Additional information

Microsoft Security Essentials will not be available for download on Windows XP after April 8, 2014. If you already have Microsoft Security Essentials installed, you will continue to receive anti-malware signature updates through July 14, 2015.

Source: Support for Windows XP for Enterprise Business is ending

Version updgrade

Version 4.5.216.0 of Microsoft Security Essentials was deployed on the 26th of March, 2014. On Windows XP, the status displayed permanently became Amber/Yellow indicating "Potentially Unprotected."

After the 8th of April, the date support for Windows XP ended, the status became Red indicating "At Risk."

This is by design due to the fact that Windows XP end of support is 8 April, 2014.

  • You cannot change the status of Microsoft Security Essentials to Green on Windows XP after the upgrade.
  • The notification tray icon for Microsoft Security Essentials will remain Red or Amber/Yellow if no other issues are detected.
  • You cannot uninstall the upgrade and return to the prior version as it will automatically upgrade.

Source: Microsoft Security Essentials 4.5.216.0 on Windows XP - At Risk > 9 April, 2014

File information

As Microsoft no longer provides MSE for download on Windows XP, you need to rely on third parties who can provide the old setup package. Here are the basic details and hashes of the official US English (en-US) installer and the user interface executable (which is language neutral):

File:    mseinstall.exe
Size:    10.6 MiB (11125072 bytes)
Version: 4.4.304.0
---
CRC32:   26db621c
MD5:     f406bac9cfb876eff01314f18cda746c
SHA1:    6ea36a8b108517a4dc692afc30aad122af543239
SHA256:  6b5846385cd3bd3e7b9ddb2f8667c2f927ff17c47d6891b526895614539dbd02

File:    msseces.exe
Size:    926.2 KiB (948440 bytes)
Version: 4.4.304.0
---
CRC32:   8fb6f338
MD5:     03396637e1e1b4e333d00aed86178918
SHA1:    59203d5d1c5d78e30f0c3d0e9b364f37a2558cf8
SHA256:  cf582487e856d01c960392ac658e8d36a92f2b2b4b9aea9bfc9e6f75fbad6571

While different languages have different setup packages (hence different details), all of them include identical copies of the msseces.exe file, which has to be digitally signed by Microsoft Corporation, and countersigned by Microsoft Time-Stamp Service; both signatures must be valid. You can check them by opening the file properties dialog.

Download links

You can use any of these, or find an alternate source yourself. While the actual file name could be different, the other details provided above must match exactly.

Make sure to scan the files using your antivirus, and upload a copy to VirusTotal to feel confident enough. If possible, test the program in a safe environment first. When you're done, make a backup of the executable.

End-of-life status

[MSE] also provides a registry [value] to show the current end-of-life status of the current OS if it’s near end-of-life. [It's called] EndOfLifeState [and is stored in] HKLM\Software\Microsoft\Microsoft Antimalware.

Stage 1: OS is approaching end-of-life. At this stage, the OS is near the end of its support lifecycle. [MSE] will still work as normal.

Stage 2: Grace period. OS has reached end-of-life, but anti-malware platform service is still running and definition updates can be received. For example, for Windows XP, the Grace Period stage starts on April 8, 2014.

Stage 3: Anti-malware service stopped. You can no longer start the anti-malware service, and your computer will not receive anti-malware definition updates. Thus [MSE] will no longer help to protect your computer. For example, for Windows XP, this stage starts on July 14th, 2015.

Source: FEP and SCEP anti-malware protection support after OSes reach end-of-life

Despite what the official source says, the third stage may happen sooner than expected: as the commenter KY noted, the anti-malware service will stop as early as June 15, 2015. Whether intentional or not, this was confirmed by my tests as well.

share|improve this answer
3  
Stage 3: Anti-malware service stopped. You can no longer start the anti-malware service But they specifically said that things would continue to work, just not be updated and thus, potentially vulnerable. By blocking it from running it, they are countering what they promised. Their excuse is probably something like “the defs will be outdated, so letting users continue to run it would give them a false sense of security” or some BS like that. That’s BS because by now, users already know full-well that it’s old and no longer updated, not to mention even old defs still catch old viruses. ◔_◔ – Synetech Apr 6 '14 at 15:48
3  
@and31415, that’s my point; even without new definitions, the real-time protection can still help defend against existing threats. Not all threats are new, current ones can come up at any time, so turning it off altogether is absurd. I guess their “reasoning” is that they figure by turning it off, they force the user to get another product and/or upgrade to Windows 8.1, but of course, neither of those is likely to be true in most cases. – Synetech Apr 21 '14 at 15:25
1  
@ADTC As of version 9.20, 7-Zip is able to read and extract the cabinet archive embedded in epp.msi, both through the GUI and the CLI version (7z.exe); the standalone CLI version (7za.exe) won't, for some reason. Another way to extract the files is to use the Windows Installer command-line utility, e.g. msiexec /a "X:\Path\to\epp.msi" /quiet targetdir="%temp%\epp" – and31415 May 29 '14 at 9:09
1  
@and31415 , Thank you for a beautiful workaround:) But today I noticed MSE started detecting this change as malware action. By removing it and rebooting, MSE gets red again. "Threat's" description: microsoft.com/security/portal/threat/encyclopedia/… So I turned off the automatics in MSE and added the "threat" to whitelist. After comparing registry dumps I think now we need to import this too: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Threats\ThreatIDDefaultAction] "2147685200"=dword:00000006 – saulius2 May 29 '14 at 15:26
1  
PS: This key has no write permissions so it needs additional love:) PPS: the DWORD value data=6 means "Ignore". Check "Overrides tab" here: technet.microsoft.com/en-us/library/bb418783.aspx – saulius2 May 29 '14 at 15:34

Funny enough, Microsoft pushes the new SE-version (4.5.216, with nagging screen) through automatic updates, but still has the previous version (4.4.304) available for manual download. I would not be surprised if they've pushed the 4.5-version only to XP-users.

Anyway, the solution is:

  1. Manually download Security Essentials here. Keep it for later use.
  2. Go to your configuration screen.
  3. Select 'software' and uninstall Security Essentials.
  4. Select 'Automatic updates' and opt for the second possibility (download and ask to install).
  5. Install your downloaded version of Security Essentials.
  6. The first time Windows Update asks you to update SE, you say no and click that you do not want to be bothered again about this update.
share|improve this answer
    
Use one of the links provided by and31415, whose solution is also better and smarter as it avoids Windows Update from offering or installing the newer version, or overwriting the EXE file. – ADTC May 29 '14 at 3:14
    
i didnt get anything whats written. what is confg screen and software button or what? What Windows update has to do with SE updates? SE seperatly asks to update and it has its own Update button witch updates itself. – Kangarooo Jun 18 '14 at 18:46

To remove an update go to Control panel. Under add and remove programs click show all windows updates. Then find your update and uninstall it. If that does not work try system restore.

share|improve this answer
    
Are you saying that Windows' Error Reporting feature has something to do with this message displayed by Security Essentials? – rakslice Apr 5 '14 at 17:58
    
Ok based on the image uploaded. Disabling error reporting service will not help. – Tim Williams Apr 5 '14 at 18:07
    
I posted an image of the notification area and the small message window with the notification. There is no entry in the Applications tab in Task Manager with the title of the notification ("Microsoft Security Essentials"). – rakslice Apr 5 '14 at 18:13
    
It still looks like error is running under Microsoft Security Essentials or Services. The error is not generated from default error reporting service. – Tim Williams Apr 5 '14 at 18:48

You must log in to answer this question.

protected by Community Apr 16 '14 at 11:26

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .