Solved Security Center Service turns itself off

[GoodOldDad]

Hi, I have searched for an answer here and other forums and have not found an answer to my specific problem, although some were close.

Quite often, perhaps daily, in the system tray I see the flag with a red "x". When I click, the pop up message says, in part "Turn on Windows Security Center service (Important)". I click on the message and the red "x" goes away. But it comes back, sometimes same day or next morning. In Services, Security Center is set to Startup Type - Automatic (Delayed). I have run full scans with VIPRE, Microsoft Security Essentials, and Malwarebytes Anti-Malware, with no positives.

I'm not sure what else to look at. I'm not even sure if I should be concerned about it. I look forward to your comments.

 

[macgig]

never had this issue myself, but I would run spybot SD. I have found spybotSD often finds things that malwarebytes and other anti spyware programs won't find. also look closely at your installed programs, make sure nothing suspicious is installed that you don't recognize or remember installing, like toolbars.

 

[Kaktussoft]

Hi, I have searched for an answer here and other forums and have not found an answer to my specific problem, although some were close.

Quite often, perhaps daily, in the system tray I see the flag with a red "x". When I click, the pop up message says, in part "Turn on Windows Security Center service (Important)". I click on the message and the red "x" goes away. But it comes back, sometimes same day or next morning. In Services, Security Center is set to Startup Type - Automatic (Delayed). I have run full scans with VIPRE, Microsoft Security Essentials, and Malwarebytes Anti-Malware, with no positives.

I'm not sure what else to look at. I'm not even sure if I should be concerned about it. I look forward to your comments.

Check services.msc and see if "Security Center" is really not started. If not started ... look in eventlog why it crashed

 

[Borg 386]

It wouldn't hurt to run TDSSKiller just to be sure a rootkit isn't causing the shut offs (there seem to be quite a few rootkits around lately). This sounds like it could be a virus behavior, better to be safe.

TDSSKiller Download

As Kaktussoft suggested, looking at the event viewer will give you an insight to what is causing these crashes.

 

[Layback Bear]

Just a thought. How many active anti virus and firewall programs are you using?

 

[cottonball]

GoodOldDad,

Let's see if we can get to the root of the problem...

Press on with Downloading Farbar Service Scanner


Save to the Desktop.

Make sure the following options are checked:

• Internet Services
• Windows Firewall
• System Restore
• Security Center
• Windows Update
• Windows DefenderPress: Scan

FSS creates a log, FSS.txt, on the Desktop.
Please provide the FSS.txt in your reply.

 

[GoodOldDad]

FSS Log

FSS log is attached.

Thanks to everyone for the suggestions. Ran Spybot yesterday and it found some minor malware and removed it (after I switched to safe mode). TDSSKiller found nothing. Booted the computer today and "no current issues detected" so I thought it was licked, but an hour later the little red x was there again. I cleared it before I came on here, so I didn't get a chance to do the check suggested by Kaktussoft, but I will the next time it happens.

 

[cottonball]

Hmmmm...

No problems reported with Action Center.

Security Center service wscsvc is not reported as having a problem or not started.

If the problem happens again, is there an error code the Service is failing with?
To find out, go to the Services Management Console:

To access the console, press the Windows key and the R key at the same time.
In the Open area, type services.msc, and press: OK
In the Services Management Console, locate the Security Center service, right-click it, and select: Start
If the service fails to start, an on-screen error message appears.
Please post the error information in your reply.


Also, please download SystemLook from one of the links below:
64-bit system:
http://jpshortstuff.247fixes.com/SystemLook_x64.exe
http://images.malwareremoval.com/jpshortstuff/SystemLook_x64.exe

Save the file to the Desktop
Double-click SystemLook.exe to run it.

Copy the content inside the following quote box into the open field:

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]


Click the Look button to start the scan.

When finished, a Notepad window opens with the results of the scan.

Please post the SystemLook.txt in your reply.

 

[GoodOldDad]

Hi, there, sorry for the delayed response. The Security Service started with no error.

SystemLook returned the following:

SystemLook 30.07.11 by jpshortstuff
Log created at 10:46 on 17/06/2013 by PAYZANPW
Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones]
@=""
"SecuritySafe"= 0x0000000001 (1)

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]


-= EOF =-

Security Service is still on - I'm going to keep an eye on it and try to catch it next time it turns off and check the eventlog.

Edit: Okay, it turned off again sometime last night, by I don't know where to look in the event log - is there a specific log I should be looking at?

 

[cottonball]

The following program should pick up the event...

Event Viewer tool (VEW) by Vino Rosso is free and can help look at system event logs for error messages and other information that may be pertinent.
　
VEW download:
http://images.malwareremoval.com/vino/VEW.exe
Save to the Desktop

Right-click the icon on the Desktop (VEW.exe), and select: Run as Administrator
Click Allow at the User Account Control (UAC) prompt.


At the VEW program console:

In the Select log to query section, check:
Application
System


In the Select type to list section, check:
Critical (not XP)
Error
Warning


In the Number or date of events section, check:
Number of events
Type 20 in the 1 -20 box


Now, press the Run button.


A Notepad report opens on the Desktop when the program is done.
Please post it in your reply.

 

[GoodOldDad]

Okay, VEW.txt is attached.

 

[cottonball]

:info: Please download Malwarebytes' Anti-Malware:
http://www.malwarebytes.org/mbam-download-exe.php
Save to the Desktop.


MBAM may make changes to the Registry as part of its disinfection routine.
If using other security programs that detect Registry changes, they may interfere or alert you.
Temporarily disable such programs as shown, or permit them to allow the changes:
http://www.bleepingcomputer.com/forums/topic114351.html


Right-click the MBAM file, and select: Run as Administrator
When the installation begins, follow the prompts.


At the last prompt of the Setup routine, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware

However, uncheck: Enable free trial of Malwarebytes Anti-Malware PRO
Click: Finish


MBAM automatically starts and you are asked to update the program.
If an update is found, the program automatically updates itself.
Press the OK button to close the box and continue.


On the Scanner tab:
Make sure the Perform Full Scan option is selected.
Then click on the Scan button.


If asked to select the drives to scan, leave all the drives selected.
Click on the Start Scan button.


The scan may take some time to complete, so please be patient.


When the scan is finished, a message box shows The scan completed successfully. Click 'Show Results' to display all objects found
Click OK to close the message box and continue with the removal process.


Back at the main Scanner screen:
Click on the Show Results button to see a list of any malware found.

Make sure everything is checked, and click: Remove Selected


When removal is completed, a report opens in Notepad.

The log is automatically saved and is viewed by clicking the Logs tab.


Please copy/paste the entire contents of the MBAM report in your reply.
Exit MBAM when done.


Note: If MBAM encounters a file that is difficult to remove, you are asked to reboot the computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) prevents MBAM from removing all the malware.


:info: Also download Security Check:
http://screen317.spywareinfoforum.org/
Save to your Desktop.

Double-click SecurityCheck.exe


Follow the onscreen instructions inside the black box...


When done, a Notepad report opens automatically, called: checkup.txt

Please post the checkup.txt in your reply.

(Please do not take any corrective actions!)

 

[GoodOldDad]

MBAM Log:

Malwarebytes Anti-Malware 1.75.0.1300
Malwarebytes : Free anti-malware download

Database version: v2013.06.20.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
PAYZANPW :: LTUARB028 [administrator]

20/06/2013 7:05:12 PM
mbam-log-2013-06-20 (19-05-12).txt

Scan type: Full scan (C:\|E:\|G:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 610319
Time elapsed: 52 minute(s), 6 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Security Check Log:

Results of screen317's Security Check version 0.99.67
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.75.0.1300
SlimCleaner
JavaFX 2.1.1
Java 7 Update 21
Java version out of Date!
Adobe Flash Player 11.7.700.224
Adobe Reader XI
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 4%
````````````````````End of Log``````````````````````

 

[Jacee]

Let's see what's running on your computer. Download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[cottonball]

GoodOldDad,

What happens if you disable the Resident feature of Spybot-Search and Destroy?

:info: Run Spybot, select Mode > Advanced Mode
Select Tools in the navigation bar on the left
Select: Resident

Uncheck the boxes for: SDHelper and TeaTimer

Go to the Services console and set Startup type to: Automatic (Delayed start)
Make sure the Service status is set to: Started

Does Action Center/Security Center still shut off on its own?


:info: If it does, please create new Restore Point before proceeding:
http://www.sevenforums.com/tutorials/697-system-restore-point-create.html

Next, download the following Windows 7 Registry key:
http://download.bleepingcomputer.com/win-services/7/Winmgmt.reg
Save to the Desktop
Double-click on winmgmt.reg file and confirm the prompt to merge.

:info: Restart the computer.

Does Action Center/Security Center still shut off on its own?

 

[GoodOldDad]

Jacee: I took a quick look at those two logs and I don't think I want all that info publicly available. Thanks, and I don't wish to be an ingrate for your help, but I'd rather not post the logs here.

Cottonball, I'll try your Spybot suggestion and get back within the next day or two.

 

[cottonball]

GoodOldDad,

Fine. Whenever you are ready.

 

[GoodOldDad]

GoodOldDad,

What happens if you disable the Resident feature of Spybot-Search and Destroy?

:info: Run Spybot, select Mode > Advanced Mode
Select Tools in the navigation bar on the left
Select: Resident

Uncheck the boxes for: SDHelper and TeaTimer

Go to the Services console and set Startup type to: Automatic (Delayed start)
Make sure the Service status is set to: Started

Does Action Center/Security Center still shut off on its own?

Hmm . . . my version of Spybot doesn't seem to conform to your steps. See attached screenshot.

 

[cottonball]

Apparently, the new version of Spybot mad some changes.

See if the following helps:
how to disable 'resident' functionality?

 

[GoodOldDad]

Nope, everything suggested in that thread is already turned off or disabled.