# Disable the Security Essentials End-of-Life Warning on Windows XP

Is it possible to disable the "Support for this operating system is ending" warning that the current version of Microsoft Security Essentials displays on Windows XP?

Based on a quick couple of searches, this warning appears to have been added in the KB2949787 update to Security Essentials, but I can't see a way to revert just that update.

Aside: Since I'm sure people are going to ask, here is why I want to do this:

• I already have a plan to migrate soon
• The warning is nagging other people who can't do anything about it
• Since the warning state uses the orange warning icon and popups, it makes real anti-virus warnings that people may need to know about harder to notice (Edit: Actually, the orange icon and popup is typically only used for less serious conditions like out of date definitions and lack of a recent quick scan, not 'real anti-virus warnings' as such.)
• There is no way to disable this warning. The actual notification alert that is separate from this can be disabled. – Ramhound Apr 5 '14 at 17:23
• I should clarify my comment. There is no way to disable this warning and have the update installed. – Ramhound Apr 5 '14 at 17:54
• Uninstall MSE and install something else? – joeqwerty Apr 5 '14 at 17:58
• @brettdj it is doing its job then. – Mr.Mindor Apr 8 '14 at 21:10
• @Mr.Mindor from a purist sense yes. But given my parents wont be updating their machine, are light users of the net mainly of newspaper sites and for flight bookings, and they are in a low risk category and what they have works for them – brettdj Apr 27 '14 at 0:38

# Workaround

The end-of-support pop-up notification can't be disabled, and downgrading isn't really an option: Microsoft Security Essentials (MSE) would upgrade itself again, sooner or later. While you could still try to prevent it from upgrading, there's no guarantee that the old MSE version would still receive updates as usual.

Considering the notification is generated by the user interface executable, you can override it with an earlier version while keeping the up-to-date engine.

### Update (May 30, 2014)

As commented by @saulius2, the registry changes were detected as a tampering threat. My previous method has been abused by malware creators for malicious purposes, and that's why MSE complained about it. To solve this issue I've since switched to a different approach. In case you applied this workaround before, just follow steps 6-7 again.

Eventually you will need to switch to a different antivirus solution, as the MSE definition signatures won't be updated anymore on Windows XP after July 14, 2015. For the time being, however, the steps below should do the trick:

1. Get a copy of version 4.4.304.0 of the MSE installer. Any language will do, see the file information below.
2. Log on with an administrator account, and extract the mseinstall.exe file using 7-Zip.
3. Open the x86 folder, and extract epp.msi though 7-Zip.
4. Rename the extracted msseces.exe file to msseces2.exe.
5. Copy msseces2.exe to the MSE install folder (e.g. C:\Program Files\Microsoft Security Client).
6. Open a command prompt, type or paste the following command, and press Enter:

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MSC" /t REG_SZ /d "\"%programfiles%\Microsoft Security Client\msseces2.exe\" -hide -runkey" /f

7. Restart Windows.

Note Although unlikely, make sure to repeat steps 6-7 should MSE upgrade in the future.

## Screenshots

### Before

Until April 8, 2014:

April 8, 2014 onwards:

### After

Click for larger view.

Microsoft Security Essentials will not be available for download on Windows XP after April 8, 2014. If you already have Microsoft Security Essentials installed, you will continue to receive anti-malware signature updates through July 14, 2015.

Source: Support for Windows XP for Enterprise Business is ending

Version 4.5.216.0 of Microsoft Security Essentials was deployed on the 26th of March, 2014. On Windows XP, the status displayed permanently became Amber/Yellow indicating "Potentially Unprotected."

After the 8th of April, the date support for Windows XP ended, the status became Red indicating "At Risk."

This is by design due to the fact that Windows XP end of support is 8 April, 2014.

• You cannot change the status of Microsoft Security Essentials to Green on Windows XP after the upgrade.
• The notification tray icon for Microsoft Security Essentials will remain Red or Amber/Yellow if no other issues are detected.

Source: Microsoft Security Essentials 4.5.216.0 on Windows XP - At Risk > 9 April, 2014

## File information

As Microsoft no longer provides MSE for download on Windows XP, you need to rely on third parties who can provide the old setup package. Here are the basic details and hashes of the official US English (en-US) installer and the user interface executable (which is language neutral):

File:    mseinstall.exe
Size:    10.6 MiB (11125072 bytes)
Version: 4.4.304.0
---
CRC32:   26db621c
MD5:     f406bac9cfb876eff01314f18cda746c
SHA256:  6b5846385cd3bd3e7b9ddb2f8667c2f927ff17c47d6891b526895614539dbd02

File:    msseces.exe
Size:    926.2 KiB (948440 bytes)
Version: 4.4.304.0
---
CRC32:   8fb6f338
MD5:     03396637e1e1b4e333d00aed86178918
SHA1:    59203d5d1c5d78e30f0c3d0e9b364f37a2558cf8


While different languages have different setup packages (hence different details), all of them include identical copies of the msseces.exe file, which has to be digitally signed by Microsoft Corporation, and countersigned by Microsoft Time-Stamp Service; both signatures must be valid. You can check them by opening the file properties dialog.

You can use any of these, or find an alternate source yourself. While the actual file name could be different, the other details provided above must match exactly.

Make sure to scan the files using your antivirus, and upload a copy to VirusTotal to feel confident enough. If possible, test the program in a safe environment first. When you're done, make a backup of the executable.

## End-of-life status

[MSE] also provides a registry [value] to show the current end-of-life status of the current OS if it’s near end-of-life. [It's called] EndOfLifeState [and is stored in] HKLM\Software\Microsoft\Microsoft Antimalware.

Stage 1: OS is approaching end-of-life. At this stage, the OS is near the end of its support lifecycle. [MSE] will still work as normal.

Stage 2: Grace period. OS has reached end-of-life, but anti-malware platform service is still running and definition updates can be received. For example, for Windows XP, the Grace Period stage starts on April 8, 2014.

Stage 3: Anti-malware service stopped. You can no longer start the anti-malware service, and your computer will not receive anti-malware definition updates. Thus [MSE] will no longer help to protect your computer. For example, for Windows XP, this stage starts on July 14th, 2015.

Source: FEP and SCEP anti-malware protection support after OSes reach end-of-life

Despite what the official source says, the third stage may happen sooner than expected: as the commenter KY noted, the anti-malware service will stop as early as June 15, 2015. Whether intentional or not, this was confirmed by my tests as well.

• Stage 3: Anti-malware service stopped. You can no longer start the anti-malware service But they specifically said that things would continue to work, just not be updated and thus, potentially vulnerable. By blocking it from running it, they are countering what they promised. Their excuse is probably something like “the defs will be outdated, so letting users continue to run it would give them a false sense of security” or some BS like that. That’s BS because by now, users already know full-well that it’s old and no longer updated, not to mention even old defs still catch old viruses. ◔_◔ – Synetech Apr 6 '14 at 15:48
• @and31415, that’s my point; even without new definitions, the real-time protection can still help defend against existing threats. Not all threats are new, current ones can come up at any time, so turning it off altogether is absurd. I guess their “reasoning” is that they figure by turning it off, they force the user to get another product and/or upgrade to Windows 8.1, but of course, neither of those is likely to be true in most cases. – Synetech Apr 21 '14 at 15:25
• @ADTC As of version 9.20, 7-Zip is able to read and extract the cabinet archive embedded in epp.msi, both through the GUI and the CLI version (7z.exe); the standalone CLI version (7za.exe) won't, for some reason. Another way to extract the files is to use the Windows Installer command-line utility, e.g. msiexec /a "X:\Path\to\epp.msi" /quiet targetdir="%temp%\epp" – and31415 May 29 '14 at 9:09
• @and31415 , Thank you for a beautiful workaround:) But today I noticed MSE started detecting this change as malware action. By removing it and rebooting, MSE gets red again. "Threat's" description: microsoft.com/security/portal/threat/encyclopedia/… So I turned off the automatics in MSE and added the "threat" to whitelist. After comparing registry dumps I think now we need to import this too: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware\Threats\ThreatIDDefaultAction] "2147685200"=dword:00000006 – saulius2 May 29 '14 at 15:26
• PS: This key has no write permissions so it needs additional love:) PPS: the DWORD value data=6 means "Ignore". Check "Overrides tab" here: technet.microsoft.com/en-us/library/bb418783.aspx – saulius2 May 29 '14 at 15:34

Funny enough, Microsoft pushes the new SE-version (4.5.216, with nagging screen) through automatic updates, but still has the previous version (4.4.304) available for manual download. I would not be surprised if they've pushed the 4.5-version only to XP-users.

Anyway, the solution is:

2. Go to your configuration screen.
3. Select 'software' and uninstall Security Essentials.