On Vista(without SP1), if user turn off the MS Defender, the WMI class AntiSpywareProduct(root\SecurityCenter) will show product enabled = false; but after SP1 is installed, the status won't change according user's settings. Any one help me? Thanks