Disable the Security Essentials End-of-Life Warning on Windows XP

Is it possible to disable the "Support for this operating system is ending" warning that the current version of Microsoft Security Essentials displays on Windows XP?

Based on a quick couple of searches, this warning appears to have been added in the KB2949787 update to Security Essentials, but I can't see a way to revert just that update.

Aside: Since I'm sure people are going to ask, here is why I want to do this:

• I already have a plan to migrate soon
• The warning is nagging other people who can't do anything about it
• Since the warning state uses the orange warning icon and popups, it makes real anti-virus warnings that people may need to know about harder to notice (Edit: Actually, the orange icon and popup is typically only used for less serious conditions like out of date definitions and lack of a recent quick scan, not 'real anti-virus warnings' as such.)

Workaround

The end-of-support pop-up notification can't be disabled, and downgrading isn't really an option: Microsoft Security Essentials (MSE) would upgrade itself again, sooner or later. While you could still try to prevent it from upgrading, there's no guarantee that the old MSE version would still receive updates as usual.

Considering the notification is generated by the user interface executable, you can override it with an earlier version while keeping the up-to-date engine.

Update (May 30, 2014)

As commented by @saulius2, the registry changes were detected as a tampering threat. My previous method has been abused by malware creators for malicious purposes, and that's why MSE complained about it. To solve this issue I've since switched to a different approach. In case you applied this workaround before, just follow steps 6-7 again.

Eventually you will need to switch to a different antivirus solution, as the MSE definition signatures won't be updated anymore on Windows XP after July 14, 2015. For the time being, however, the steps below should do the trick:

1. Get a copy of version 4.4.304.0 of the MSE installer. Any language will do, see the file information below.
2. Log on with an administrator account, and extract the mseinstall.exe file using 7-Zip.
3. Open the x86 folder, and extract epp.msi though 7-Zip.
4. Rename the extracted msseces.exe file to msseces2.exe.
5. Copy msseces2.exe to the MSE install folder (e.g. C:\Program Files\Microsoft Security Client).

6. Open a command prompt, type or paste the following command, and press Enter:

   reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MSC" /t REG_SZ /d "\"%programfiles%\Microsoft Security Client\msseces2.exe\" -hide -runkey" /f
   

7. Restart Windows.

Note Although unlikely, make sure to repeat steps 6-7 should MSE upgrade in the future.

Screenshots

Before

Until April 8, 2014:

April 8, 2014 onwards:

After

Click for larger view.

Additional information

Microsoft Security Essentials will not be available for download on Windows XP after April 8, 2014. If you already have Microsoft Security Essentials installed, you will continue to receive anti-malware signature updates through July 14, 2015.

_{Source: Support for Windows XP for Enterprise Business is ending}

Version updgrade

Version 4.5.216.0 of Microsoft Security Essentials was deployed on the 26th of March, 2014. On Windows XP, the status displayed permanently became Amber/Yellow indicating "Potentially Unprotected."

After the 8th of April, the date support for Windows XP ended, the status became Red indicating "At Risk."

This is by design due to the fact that Windows XP end of support is 8 April, 2014.

• You cannot change the status of Microsoft Security Essentials to Green on Windows XP after the upgrade.
• The notification tray icon for Microsoft Security Essentials will remain Red or Amber/Yellow if no other issues are detected.
• You cannot uninstall the upgrade and return to the prior version as it will automatically upgrade.

_{Source: Microsoft Security Essentials 4.5.216.0 on Windows XP - At Risk > 9 April, 2014}

File information

As Microsoft no longer provides MSE for download on Windows XP, you need to rely on third parties who can provide the old setup package. Here are the basic details and hashes of the official US English (en-US) installer and the user interface executable (which is language neutral):

File:    mseinstall.exe
Size:    10.6 MiB (11125072 bytes)
Version: 4.4.304.0
---
CRC32:   26db621c
MD5:     f406bac9cfb876eff01314f18cda746c
SHA1:    6ea36a8b108517a4dc692afc30aad122af543239
SHA256:  6b5846385cd3bd3e7b9ddb2f8667c2f927ff17c47d6891b526895614539dbd02

File:    msseces.exe
Size:    926.2 KiB (948440 bytes)
Version: 4.4.304.0
---
CRC32:   8fb6f338
MD5:     03396637e1e1b4e333d00aed86178918
SHA1:    59203d5d1c5d78e30f0c3d0e9b364f37a2558cf8
SHA256:  cf582487e856d01c960392ac658e8d36a92f2b2b4b9aea9bfc9e6f75fbad6571

While different languages have different setup packages (hence different details), all of them include identical copies of the msseces.exe file, which has to be digitally signed by Microsoft Corporation, and countersigned by Microsoft Time-Stamp Service; both signatures must be valid. You can check them by opening the file properties dialog.

Download links

You can use any of these, or find an alternate source yourself. While the actual file name could be different, the other details provided above must match exactly.

Make sure to scan the files using your antivirus, and upload a copy to VirusTotal to feel confident enough. If possible, test the program in a safe environment first. When you're done, make a backup of the executable.

• http://www.filehippo.com/download_security_essentials_xp/51102
• http://www.filehorse.com/download-security-essentials-xp/15350/
• http://www.filesoul.com/software/Microsoft-Security-Essentials-XP/Security-Essentials-4-4-304-XP/
• http://orbitaldownloads.com/security-essentials-xp_4.4.304/
• http://www.fruitydownload.com/download/security-essentials-4-4-304-xp.html
• http://www.mediafire.com/download/00xkln4kaxo6t4h/MSEInstall.exe
• http://bin.ge/dl/90509/mseinstall.exe.html
• http://ulub.pl/1zYDbfBkQe/microsoft-security-essentials-xp-44304
• http://youshare.ge/?d=528326415
• http://youshare.ge/?d=532E394E5

End-of-life status

[MSE] also provides a registry [value] to show the current end-of-life status of the current OS if it’s near end-of-life. [It's called] EndOfLifeState [and is stored in] HKLM\Software\Microsoft\Microsoft Antimalware.

Stage 1: OS is approaching end-of-life. At this stage, the OS is near the end of its support lifecycle. [MSE] will still work as normal.

Stage 2: Grace period. OS has reached end-of-life, but anti-malware platform service is still running and definition updates can be received. For example, for Windows XP, the Grace Period stage starts on April 8, 2014.

Stage 3: Anti-malware service stopped. You can no longer start the anti-malware service, and your computer will not receive anti-malware definition updates. Thus [MSE] will no longer help to protect your computer. For example, for Windows XP, this stage starts on July 14th, 2015.

_{Source: FEP and SCEP anti-malware protection support after OSes reach end-of-life}

Despite what the official source says, the third stage may happen sooner than expected: as the commenter KY noted, the anti-malware service will stop as early as June 15, 2015. Whether intentional or not, this was confirmed by my tests as well.

Funny enough, Microsoft pushes the new SE-version (4.5.216, with nagging screen) through automatic updates, but still has the previous version (4.4.304) available for manual download. I would not be surprised if they've pushed the 4.5-version only to XP-users.

Anyway, the solution is:

1. Manually download Security Essentials here. Keep it for later use.
2. Go to your configuration screen.
3. Select 'software' and uninstall Security Essentials.
4. Select 'Automatic updates' and opt for the second possibility (download and ask to install).
5. Install your downloaded version of Security Essentials.
6. The first time Windows Update asks you to update SE, you say no and click that you do not want to be bothered again about this update.