Why is Microsoft Security Essentials constantly saying potentially unprotected?

The "potentially unprotected" warning seems fairly common in situations where you really are still protected. I'll cover several theories as to why it might appear.

//
Quite some time ago, I installed Microsoft Security Essentials as per your recommendation. I liked it right off the bat, but lately after turning my computer on, a small icon appears in the lower right-hand corner of the tray, telling me “Potentially unprotected” and that my virus protection is turned off and that my computer may be at risk. This happens occasionally, but now it’s happening every time. When I go to Microsoft Security Essentials, I see that my real-time protection is on and virus and spyware definitions are up-to-date. To get rid of this icon, I have to manually do an update every time. Once this is done, the icon disappears. This never used to happen until about three months ago or so. Do I have a virus in my system or malware or spyware wanting me to use their protector?

I’ve seen it, too. It seems to be fairly common.

I’ve run into several theories about why this might happen.

Potentially Unprotected Could Mean Several Things

The warning that Microsoft Security Essentials (MSE) throws is actually less than helpful.

“PC Status: Potentially unprotected” can actually happen for several different reasons:

  • A scan hasn’t been run in “a while.”
  • The malware definition database is out of date.
  • The Antimalware Service isn’t running.

More often than not, it’s actually one of the first two.

Theory #1: Malware

Yes, there’s a small possibility that this is a side effect of malware on your machine. Based on how often I see this symptom on clean machines (including my own), I’m skeptical that this is the case.

On the other hand, it’s also better to be safe than sorry, so running up-to-date anti-malware scans might be the first thing to do. Because that is exactly what you’ve been doing and it still returns Microsoft Security Essentials (MSE) to it’s green/Protected state,  my opinion is that this is not the case for you.

If the status remains Unprotected or the scans never complete, then I’d absolutely have you take the appropriate steps to remove malware from your machine, as well as uninstalling and re-installing MSE.

Theory #2: CCleaner

There are options in the “Applications” section of the CCleaner computer cleaning tool to clean MS AntiMalware, which I believe means that when selected, CCleaner may delete information that confuses MSE. In fact, it may be as simple as CCleaner removing MSE’s own log files.

Potentially UnprotectedThe result is that MSE thinks, “Oh, gosh, you’ve never run a scan, so you’re Potentially Unprotected!”

I’ve replicated this by running CCleaner and waiting a while. Eventually (at least for me), MSE reverts to that “Potentially unprotected” message, telling me that I’ve not run a scan for a while, even though it also notes that the last scan was run 25 minutes ago.

If this is the case, you can safely ignore it or configure CCleaner to not clean up the files relating to MS AntiMalware.

Theory #3: Other Anti-malware tools

We do often recommend that you run only one anti-malware tool at a time. Normally, this refers to the real-time scanning capabilities of each coming into conflict. In this case, the theory is that another anti-malware tool is somehow interfering with MSE’s ability to run or remember that it has been run unrelated to real-time scans.

Depending on the other package, it may be as simple as deselecting some of its scanning or privacy options or as extreme as uninstalling the other software completely.

Theory #4: Miscommunication

I believe that there is also the potential for miscommunication between your system and Microsoft’s servers. MSE thinks it’s out of date when it’s not. It could be as simple as the time of day or date being wrong such that MSE gets the automatic update sequence a little confused.

Just update and scan

Because you can run a manual scan to make that notification go away, that might be the simplest solution of all. I know that running a scan just to do this might be time consuming. That’s why I wanted to reassure you that, in all likelihood, everything is actually okay.

Note that the error message is not saying you are unprotected. It’s saying you may be unprotected. In most all of the cases above, you are indeed protected and MSE is just a little confused.

The other approach is simply to ignore it and give it time. MSE should eventually get itself up-to-date and run a scan on its own. It’ll stop complaining about being potentially unprotected … until, of course, whatever causes the issue reoccurs.

Like I said, my belief is that this not a huge issue. I hate to be training people to ignore that “Potentially unprotected” warning, but this time, I believe that might be the most practical solution.

There are 13 comments:

  1. Bob Reply

    I used to see this regularly.
    I set up MSE to do a weekly scan (at a time that was not intrusive) and still occasionally saw the message – until I changed one of my habits.
    Now, when I get the ‘windows has updates’ dialog, I check the Optional updates – if there is one for MSE I tick it. Since I started doing this, I don’t get the orange ‘potentially at risk’ icon. The other way (if you have permanent internet access, which I don’t) is to tick the box that says ‘check for up to date definitions before scanning’ on your scheduled scan.

    • Bob Reply

      Recently i had similar problem. dont know exactly which solution of the preceding it was like,
      but it seems like if u set up the MSE so it feels like it has been updated,
      and/or make it feel ‘comfortable’ by having an update/scan scheduled, it went back to the nice little green icon in the system tray.
      i do know that back in early 2000’s I had attacks on Norton that would try to trick me to turn off protection. After some issues were settled, Norton Updates assured, and Black Ice Defender firewall was installed, problems dropped to nil Sadly, the developer of BlackIce, who principally did anti-malware work for big corporate clients and used his experience to make BlackIce Defender ( a consumer level product), a very advanced consumer firewall, sold out to IBM for $50 mil. IBM quickly withdrew the program from the market and curtailed software support. Sound familiar?
      Bob

  2. Allen Jost Reply

    I use Microsoft Security Essentials and have done so since its inception. I am very happy with it but instead of running Malicious Malware and CCleaner I have downloaded and installed Advanced System Care 6 from IOBit.com and also BitDefender. It is amazing how often each of them will pick up a virus, malware or other intruder missed by the others. After using the IOBit program for some time I decided to get the Pro and it only cost about $12 and gave me about a dozen additional tools to use so I currently am running it in Simple Mode Weekly and Expert Mode about once a month. My computer has been so trouble free since I started this regimen that I have to pass it on for others to try.

  3. Ken B Reply

    I’ve seen similar notifications at times which I’m pretty sure is just a matter of timing. My theory is that, during bootup, the program which checks whether you have anti-malware/anti-virus programs running does its check before the AM/AV program has finished loading. After a couple of seconds, the red “alert” icon in the notification tray goes away.

  4. Bob second Reply

    Seems like about the time I get some issue with a program, leo and friends have just covered it.
    And unless especially adept, like MSE I hope, I would rather pay $50 a year or so for pretty reliable program like Norton, than risk little things that could turn rotten.
    Have recommendations regarding power supply protection. 1 / use high quality, all metal isolation protector on the front end of your AC power. 2/ use a real UPS Uninterruptable Power Supply (no switching) with adequate capacity and AVR Automatic Voltage Regulation , following. 3/ I have a little 120 AC range inline voltmete monitoing power leaving the UPS. My $50 US made Isobar sacrificed itself and savd my $3,500 system. . Only 2 desktops in 11 years. AVR keeps the voltage smooth thru sags/brownouts, etc Remember that you probably wont need to go far for a costly replacement battery for UPS. Total cost off the retail shelf for the isobar, AVR UPS and voltmeter was under $200 including tax. Cheap protection if you consider your time valuable. I bought my replacement battery locally for about $30, or good online firms should have one for about $40 including shipping. ( A lot of UPS with different outputs use the same battery.) Safe computing!

  5. Ron Reply

    I have had the same problem, but a much easier workaround. When the red Potentially Unprotected icon appears, open Security Essentials. Click on the Settings tab. Find click on Real-Time Protection, in the bar on the left. Turn on real time protection check box appears. Un-check the box then Save Changes. Re-check the box and Save Changes again. Security Essentials should turn green again and the Windows red warning should go away. I believe when Windows checks for virus SW, Security Essentials just isn’t ready yet. I hope this helps.

  6. Euphrosene Labon Reply

    Thanks Ron :)

    7 scans, 2 re-boots, one CCleaner later, the only thing that seems to have worked is your neat fix. So far.

  7. Liz Reply

    Thanks for this helpful information.
    After digesting it all, I came to the conclusion that for my PC …. I had not run a full scan for a while, and only allowed a quick scan, due to user impatience! Therefor a full normal scan was in need to rectify the problem of the status of MSE being in potentially unprotected mode. Running a full scan, “AFTER” doing updates manually, resolved the issue for me. I hope this also helps somebody else.

  8. Ken Reply

    Dear Leo thank you very much. I used theory #2, re configued MS Antimalware and
    haven’t seen the little orange house since. Funny thing too, my auto-updates are working again. Wonder if that had anything to do with it? Thanks again til the next
    time, Ken

  9. Mark Jacobs Reply

    My theory: Same as Ken B. When you are starting up Windows, the message comes up before the antivirus program has had a chance to load. I’ve seen this happen on several occasions. Someone comes up to me panicking that they’re potentially unprotected, because Windows detected that their AV wasn’t running. By the time I get to look at their computer, their AV is up and running. So, if you get this message, sometimes it’s good to wait a couple of minutes to see if the AV eventually is loaded.

  10. Rajdeep Singh Reply

    Most of the times my MSE updates but forgets to scan . After going through this article, I checked on CCleaner to look for MS Anti Malware. In my version of CCleaner [ ver. 4.04.4197 64 bit ] MS Anti Malware in Windows is not featured. Is there anything else I have to uncheck in CCleaner to ensure that Scans are done regularly.

Leave a reply:

Before commenting please:

  • Read the article. Seriously. You'd be shocked at how many people make comments that prove they didn't.
  • Comment only on the article. If you have a new, unrelated question start with the search box at the top of the page.
  • Don't post personal information. Email addresses, phone numbers and such will be removed.

VERY IMPORTANT: because of a rise an comment spam that's making it through our filters any comments that do not add to the discussion - typically off topic or content-free comments - run a very high risk of being flagged as spam and removed.

If you have a new question unrelated to the article above, ask it on the Ask Leo! ask-a-question page.