Windows 7: The Windows Security Center service can't be started.

roastbeef · 14 Mar 2011

I click on the flag to turn it on but get that message...

'The Windows Security Center service can't be started.'

Seems to have coincided with Firefox crashing REALLY FREQUENTLY too. I downloaded Malwarebytes' Anti-Malware and did a full scan. Here's the result:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6054
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8080.16413
14/03/2011 18:29:03
mbam-log-2011-03-14 (18-28-58).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 432048
Time elapsed: 1 hour(s), 19 minute(s), 14 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\Tom\Desktop\ezdrummer v1.0. vsti\update & keygen\Keygen 1.11\Keygen.exe (Malware.Packer.Gen) -> No action taken.
d:\downloads\Torrents\office 2010 activation and conversion kit 1.6.exe (Trojan.Agent.CK) -> No action taken.
d:\downloads\Torrents\office_2010_professional_plus_32bit_and_64bit.with.volumeedition activator\microsoft 2010 clean up utility.msi (Malware.Generic) -> No action taken.

Borg 386 · 14 Mar 2011

Could be a possible virus MB can't remove or an extension on FF that's not getting along with another program.

What AV are you running? Some of them take control of the security settings.

You can try installing MSE or D/L and run the Microsoft Malicious Software Removal Tool

You could also try using this tool:

Norton Power Eraser

http://security.symantec.com/nbrt/npe.asp?lcid=1033

Quote:

Because the Norton Power Eraser uses aggressive methods to detect these threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully, and only after you have exhausted other options.

Edit: Found these

Trojan-Proxy.Win32.Agent.ck [Kaspersky Lab]
BackDoor-CLK.dll [McAfee]
Troj/Cimuz-F [Sophos]
TrojanProxy:Win32/Agent.CK [Microsoft]
Trojan-Proxy.Win32.Agent.CK [Ikarus]

http://www.threatexpert.com/report.a...fc4e1a04841f47

Hopalong X · 14 Mar 2011

Quote:

c:\Users\Tom\Desktop\ezdrummer v1.0. vsti\update & keygen\Keygen 1.11\Keygen.exe (Malware.Packer.Gen) -> No action taken.
d:\downloads\Torrents\office 2010 activation and conversion kit 1.6.exe (Trojan.Agent.CK) -> No action taken.
d:\downloads\Torrents\office_2010_professional_plus_32bit_and_64bit.with.volumeedition activator\microsoft 2010 clean up utility.msi (Malware.Generic) -> No action taken.

Run Malwarebytes again and delete these items. Things might work again.
Mike

roastbeef · 14 Mar 2011

Quote: Originally Posted by Hopalong X

Quote:

c:\Users\Tom\Desktop\ezdrummer v1.0. vsti\update & keygen\Keygen 1.11\Keygen.exe (Malware.Packer.Gen) -> No action taken.
d:\downloads\Torrents\office 2010 activation and conversion kit 1.6.exe (Trojan.Agent.CK) -> No action taken.
d:\downloads\Torrents\office_2010_professional_plus_32bit_and_64bit.with.volumeedition activator\microsoft 2010 clean up utility.msi (Malware.Generic) -> No action taken.

Run Malwarebytes again and delete these items. Things might work again.
Mike

I did remove them at the end. Pretty sure they're false positives though. Keygens always come up as viruses/malware don't they?

roastbeef · 14 Mar 2011

Quote: Originally Posted by Borg 386

Could be a possible virus MB can't remove or an extension on FF that's not getting along with another program.

What AV are you running? Some of them take control of the security settings.

You can try installing MSE or D/L and run the Microsoft Malicious Software Removal Tool

You could also try using this tool:

Norton Power Eraser

http://security.symantec.com/nbrt/npe.asp?lcid=1033

Quote:

Because the Norton Power Eraser uses aggressive methods to detect these threats, there is a risk that it can select some legitimate programs for removal. You should use this tool very carefully, and only after you have exhausted other options.

Edit: Found these

Trojan-Proxy.Win32.Agent.ck [Kaspersky Lab]
BackDoor-CLK.dll [McAfee]
Troj/Cimuz-F [Sophos]
TrojanProxy:Win32/Agent.CK [Microsoft]
Trojan-Proxy.Win32.Agent.CK [Ikarus]

ThreatExpert Report: Trojan.Agent.LM, Trojan Horse, Trojan-Proxy.Win32.Agent.ck, BackDoor-CLK.dll..

I'm using NOD32. I've used it for ages though and never had this Security Center problem so something must have changed. When I go to services.msc, it's disabled. I change it to automatic, press start, and it works, for about 20 seconds before turning off again.

I'll try the malicious software removal tool but wouldn't that be unnecessary if I already have an AV program installed?

Hopalong X · 14 Mar 2011

It won't hurt to run the Malicious removal tool.

Clean out all your internet temp files. Cookies and all in firefox. Just in case since it is also giving problems. It may not be related but could be the same problem for both.

Also run Disk Cleanup - Open and Use
Make sure to run as administrator.
Clean temp files but I'd leave Windows Error files unchecked. Leave them intact for future use if needed.

None of this may help but won't hurt to clean out the junk just in case.

After that you can try this to see if a registry error is possibly the problem.
SFC /SCANNOW Command - System File Checker

If it finds errors but states it can't repair them all leave the CMD window open and type it in again. Run it up to three times to fix errors.
Sometimes it just can't get them all in one pass.
If it shows none we will go from there.
Post back.

Somone else may come up with some other ideas also.
Mike

roastbeef · 14 Mar 2011

Quote: Originally Posted by Hopalong X

It won't hurt to run the Malicious removal tool.

Clean out all your internet temp files. Cookies and all in firefox. Just in case since it is also giving problems. It may not be related but could be the same problem for both.

Also run Disk Cleanup - Open and Use
Make sure to run as administrator.
Clean temp files but I'd leave Windows Error files unchecked. Leave them intact for future use if needed.

None of this may help but won't hurt to clean out the junk just in case.

After that you can try this to see if a registry error is possibly the problem.
SFC /SCANNOW Command - System File Checker

If it finds errors but states it can't repair them all leave the CMD window open and type it in again. Run it up to three times to fix errors.
Sometimes it just can't get them all in one pass.
If it shows none we will go from there.
Post back.

Somone else may come up with some other ideas also.
Mike

Okay, thanks. I'm running the SFC scannow program now.

I downloaded the Malicious Software Removal Tool but nothing happens when I run it. It shows that it's being extracted but then disappears.

Also discovered that System Restore has been turned off. I certainly didn't do that.

Seems slightly more serious than I initially thought...

Hopalong X · 14 Mar 2011

I'm also going to see if I can get some more help maybe they might have more ideas on the security not working properly.

So keep the below in mind but let me see if I can get one of the Security Aces before you go with below.
-----------------------------------------------------------------------------------------------

If you made a back-up image you can restore the image.
Windows version or Macrium etc.
If not oops!
Make one after you get things fixed for next time.

--------------------------------------------------------------
From your specs I'm going to guess you have a Windows installation disk.

As a last resort this may be the way to go.
Repair Install

It will repair the registry but will not loose any of your files and pics etc.
It takes the registry read straight off the disk for the repair.

Something to consider if no one else comes up with beter solutions.

That is if sfc /scannow doesn't work.

Mike

Anak · 14 Mar 2011

Quote: Originally Posted by roastbeef

I downloaded the Malicious Software Removal Tool but nothing happens when I run it. It shows that it's being extracted but then disappears.

What is happening is the nasties in your machine are reading the name of the anti-malware, and preventing it from running.

You need to change the name to something innocuous like mydoghasfleas before you extract it, then you will have to go into the extracted files and change the name of the .exe Application file before you open it.

I am surprised mbam ran at all!

Quote: Originally Posted by roastbeef

Also discovered that System Restore has been turned off. I certainly didn't do that.

Seems slightly more serious than I initially thought...

You will also need to go into System Restore, and delete all those restore points because the nasties will be in there also.

You could run HiJackThis! but someone other than me should read it for you so you do not delete a valuable file. Someone like Jacee.
Save it also like mydoghasfleas.

You can try running Superantispyware, save it also like mydoghasfleas to your desktop.
I used this the other week to free up my niece's machine of 1,247 nasties.
It is not programed to run on x64, but did a nice job on hers.
What happens is it only reads the x32 side of your machine, but luckily most nasties are x32.

You can try Combofix, but again someone other than me should read it for you so you do not delete a valuable file. Someone like Jacee.

If your going to continue to run torrents you should set up your browser to scan immediately for viruses after the download.

I have the bitdefender quickscan add-on for my FF. Speaking of which, I would just go ahead and un-install it, and start over. I would not be sure if your profile would be okay after clean-up or not.

roastbeef · 14 Mar 2011

Thanks Anak. I got the Malicious Software Removal to run, but it found nothing.

Here's my hijackthis results, for anyone that can help.

Code:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 03:38:47, on 15/03/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8080.16413)
Boot mode: Normal

Running processes:
C:\Windows\SOUNDMAN.EXE
C:\Program Files (x86)\NETGEAR\WN111\wn111.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files (x86)\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Winamp\winamp.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
D:\Downloads\mydoghasfleas.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [DivX Download Manager] "C:\Program Files (x86)\DivX\DivX Plus Web Player\DDmService.exe" start
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [messenger.exe] C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\Tom\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WLAN Optimizer] C:\Users\Tom\AppData\Local\Temp\Rar$EX00.509\WLAN Optimizer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Update.lnk = C:\Windows\System32\rundll32.exe
O4 - Global Startup: NETGEAR WN111 Smart Wizard.lnk = C:\Program Files (x86)\NETGEAR\WN111\wn111.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Unknown owner - C:\Program Files (x86)\NETGEAR\WN111v2\jswpsapi.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 11125 bytes

Windows 7: The Windows Security Center service can't be started.

The Windows Security Center service can't be started. problems?