Can not turn on Windows Security Center Service

[karlsnooks]

Good People,
Why can't i turn the windows security center service on?

 

[Jaxryley]

Check in Services that it is set to auto and has started.

 

[karlsnooks]

That would be well and good but..

Already looked in services and there is no service there with that name.

 

[Corrine]

If this just happened, have you tried System Restore? Otherwise, the next question is whether your computer was recently infected. I ask based on this thread archived from the newsgroups at the Vista forums: Windows Security Service missing. - Vista Forums

Note: Jesper in that thread is the extremely knowledgeable Jesper Johansson (Jesper's Blog).

 

[karlsnooks]

Corrine,
What is the name of the service that I am missing?

Problem has existed for awhile and I've just ignored it. Have no idea for how long.

Hove run MalwareBytes and found nothing. Do you have any suggestions as to what else I can run or do you think that the bad guy left the scene of the crime a long time ago?

 

[Corrine]

Have you tried a SFC (System File Checker) scan which will check and fix any corrupted files on your system?

Steps to perform SFC scan:
1. Click the Start button
2. From the Start Menu, Click All programs > Accessories
3. In the Accessories menu, right-click on the Command Prompt option
4. From the drop down menu that appears, select the 'Run as administrator' option
5. Authorize any User Account Control (UAC) elevation request.
6. In the Command Prompt window, type: sfc /scannow (including the space rior to the backslash) and press Enter
7. A message will appear stating that 'The system scan will begin'
8. Be patient because the scan may take some time
9. If any files require replacing SFC will replace them. You may be asked to insert your DVD for this process to continue
10. If everything is okay you should, after the scan, see the following message "Windows resource protection did not find any integrity violations"
11. After the scan has completed, close the command prompt window, restart the computer and check.

If no joy, your next step would sensibly be a repair install. However, you could first try Jesper's code to see if it will work on Windows 7:

Run this command from an elevated command to create the SC:

sc create wscsvc type= share start= delayed-auto error= normal binPath=
"C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" depend=
RpcSc/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security Center"

From Jesper's post, this should provide the right security descriptor:

sc sdset wscsvc
DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLO CRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSW LOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;W D)

(Note: I've disabled smilies in this response so Jesper's code is properly displayed.)

 

[karlsnooks]

Many thanks Corrine,

Running SFC was next on my list after updating SysInternals suite and then running AutoRuns to see if I saw anything unusual, although i really think the damage has been done and the bad guy has fled the scene.

Thanks for eliminating smilies as I was uncertain as to what should be.

Now to perform the tasks at hand. Thanks

 

[karlsnooks]

Corrine,

Did a few cleanups, but the real solution, pleasantly, turned out to be SFC.

Had to reboot twice to get things to take. Did manage to run SFC and get a clean bill of health from SFC.

Although at first the error indicator was gone but Action Center still showed the security center as being off but now it was possible to turn it back on.

Another restart and now everything is as one expects. I still don't see a Windows Security Center Service in my list of services. Am I looking for the wrong thing?

 

[Corrine]

I'm glad System File Checker worked. As to locating the service, when looking in Services, you should find it under Services (Local) as Security Center. When I look at services with WinPatrol, I have the same in both Windows Vista Ultimate (32-bit) and Windows 7 Ultimate (64-bit) with C:\Windows\System32\wscsvc.dll in startup as automatic. The command is identified as svchost.exe.wscsvc.dll.

 

[Jacee]

Hi Karl, look again by typing services.msc in the start search box ... you should see this:

 

[karlsnooks]

Good People,
I manage to be able to change the start type by taking ownership of wscsvc.dll which was owned by TrustedInstaller.

That solved the problem that i couldn't change the start type in the Startup Type column of Services.MSC.

Now, though no matter which way I choose, I can start the WSCsvc (Security Center service). I keep getting following error msg:



On my Asus netbook I do not have this problem.

Anyone got any ideas?

I do appreciate the advice given. I really don't even know if and when the service in reality should be started. I've read the text shown in Services.msc but that was not written by someone in the trenches.

 

[Corrine]

Let's see if Screen317's Security Check shows anything:

Download Security Check from "http://screen317.spywareinfoforum.org/SecurityCheck.exe" or "http://screen317.changelog.fr/SecurityCheck.exe"

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

[karlsnooks]

Results of Security Check:
View attachment checkup.txt

 

[Jacee]

The log results ...

Results of screen317's Security Check version 0.99.5
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Microsoft Security Essentials
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
CCleaner
Auslogics Registry Cleaner
Java(TM) 6 Update 20
Out of date Java installed!
Adobe Flash Player 10.1.53.64
Adobe Reader 9.3.3
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware NisSrv.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)
``````````End of Log````````````

 

[karlsnooks]

The problem is and has been as posted in my first msg.

I can not turn the security center service on.

By taking ownership of wscsvc and then giving myself full control I was able to change the Startup type. However, no matter which startup mode, I could not 'Start' wscsvc.

All start attempts produced the error msg about access denied.

I've, with RevoUnstaller, removed many programs just to make sure that they weren't interfering.

 

[Jacee]

Taken from here ... Event ID 7000 Source service control manager

Service: Security Center, error: "The executable program that this service is configured to run in does not implement the service." - From a newsgroup post: "There are two registry entries you should check in order to ensure that they have the correct values.

Navigate to HKEY_LOCAL_MACHINE/ SYSTEM/CurrentControlSet/Services. Scroll to locate and single-click on wscsvc, look in the right-hand panel for the value named ImagePath. Under the Data column, it should read: %SystemRoot%\System32\svchost.exe -k netsvcs

Now, double-click on or click the + sign beside wscsvc, single-click on Parameters and look in the right-hand panel for the value named ServiceDll. Under the Data column, it should read: %SYSTEMROOT%\system32\wscsvc.dll.

If the above values are correct, then the wscsvc.dll file may be corrupted. There is a copy of this file in the Windows\System32\dllcache folder (the dllcache folder is a hidden system folder, so you'll need to set your folder options to Show hidden files and folders and uncheck the checkbox next to Hide protected operating system files). Copy the wscsvc.dll file from this folder into the Windows\System32 folder".

 

[Corrine]

Taken from here ... Event ID 7000 Source service control manager

Yup! I was just checking that!

Another thing is to make sure the dependencies to the Security Center service are running:

• Remote Procedure Call (RPC), Automatic, Log On As: Network Service
• Windows Management Instrumentation, Automatic, Log On As: Local System

 

[karlsnooks]

All suggestions have been followed.

I do recommend perhaps checking this advice against your own registry entry. I fortunately had a good machine, also not networked, to compare against.

Navigate to HKEY_LOCAL_MACHINE/ SYSTEM/CurrentControlSet/Services.  Scroll to locate and single-click on wscsvc, look in the right-hand  panel for the value named ImagePath. Under the Data column, it should  read: %SystemRoot%\System32\svchost.exe -k netsvcs

I finally gave up and used a Window Backup & Restore system image which did not exhibit the problem.

Thanks for suggestions. Hope my problem is an exception although googling indicates that I'm not alone and that many never found a solution.

 

[Jacee]

Karl, this what I found on my machine:

 

[karlsnooks]

Precisely. The ImagePath value shown does not agree with the previous text.