Security Center Service turns itself off

GoodOldDad said:

Hi, I have searched for an answer here and other forums and have not found an answer to my specific problem, although some were close.

Quite often, perhaps daily, in the system tray I see the flag with a red "x". When I click, the pop up message says, in part "Turn on Windows Security Center service (Important)". I click on the message and the red "x" goes away. But it comes back, sometimes same day or next morning. In Services, Security Center is set to Startup Type - Automatic (Delayed). I have run full scans with VIPRE, Microsoft Security Essentials, and Malwarebytes Anti-Malware, with no positives.

I'm not sure what else to look at. I'm not even sure if I should be concerned about it. I look forward to your comments.

Check services.msc and see if "Security Center" is really not started. If not started ... look in eventlog why it crashed

It wouldn't hurt to run TDSSKiller just to be sure a rootkit isn't causing the shut offs (there seem to be quite a few rootkits around lately). This sounds like it could be a virus behavior, better to be safe.

TDSSKiller Download

As Kaktussoft suggested, looking at the event viewer will give you an insight to what is causing these crashes.

Just a thought. How many active anti virus and firewall programs are you using?

GoodOldDad,

Let's see if we can get to the root of the problem...

Press on with Downloading Farbar Service Scanner


Save to the Desktop.

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows DefenderPress: Scan

FSS creates a log, FSS.txt, on the Desktop.
Please provide the FSS.txt in your reply.

Hmmmm...

No problems reported with Action Center.

Security Center service wscsvc is not reported as having a problem or not started.

If the problem happens again, is there an error code the Service is failing with?
To find out, go to the Services Management Console:

To access the console, press the Windows key and the R key at the same time.
In the Open area, type services.msc, and press: OK
In the Services Management Console, locate the Security Center service, right-click it, and select: Start
If the service fails to start, an on-screen error message appears.
Please post the error information in your reply.


Also, please download SystemLook from one of the links below:
64-bit system:
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
http://images.malwareremoval.com/jpshortstuff/SystemLook_x64.exe

Save the file to the Desktop
Double-click SystemLook.exe to run it.

Copy the content inside the following quote box into the open field:

[quote]:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]


Click the Look button to start the scan.

When finished, a Notepad window opens with the results of the scan.

Please post the SystemLook.txt in your reply.

Hi, there, sorry for the delayed response. The Security Service started with no error.

SystemLook returned the following:

SystemLook 30.07.11 by jpshortstuff
Log created at 10:46 on 17/06/2013 by PAYZANPW
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
@=""
"SecuritySafe"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]


-= EOF =-

Security Service is still on - I'm going to keep an eye on it and try to catch it next time it turns off and check the eventlog.

Edit: Okay, it turned off again sometime last night, by I don't know where to look in the event log - is there a specific log I should be looking at?

The following program should pick up the event...

Event Viewer tool (VEW) by Vino Rosso is free and can help look at system event logs for error messages and other information that may be pertinent.
　
VEW download:
http://images.malwareremoval.com/vino/VEW.exe
Save to the Desktop

Right-click the icon on the Desktop (VEW.exe), and select: Run as Administrator
Click Allow at the User Account Control (UAC) prompt.


At the VEW program console:

In the Select log to query section, check:
Application
System


In the Select type to list section, check:
Critical (not XP)
Error
Warning


In the Number or date of events section, check:
Number of events
Type 20 in the 1 -20 box


Now, press the Run button.


A Notepad report opens on the Desktop when the program is done.
Please post it in your reply.