Solved Getting "Preparing Security Options"

[LevelBest]

I have been trying to solve a problem for the last four weeks and am out of ideas. Having got a virus, I decided to run a system image I created a week after I got my Samsung S3511 Laptop in 2011. I’m running Windows 7 Home Premium 64 bit, Service Pack 1, with Microsoft Office 2007 and McAfee Total Protection for anti-virus. I have successfully used this system image before so I knew it would work.

After gradually re-building the computer which included an overnight of Windows updates, installing IE11, Chrome and Windows Livemail, I began to experience a problem whereby the computer would slow to the extent of being unusable and the mouse would freeze. Hitting Alt, Ctrl Delete would, when the computer bounced back into life, show “preparing security options” on the blue Microsoft welcome/logging off screen.

I’ve read practically every post on the net about this and the problem is that there is no clear view on what is causing this; some posters think it’s a virus, others think it relates to a possible hardware problem, a conflict with Malwarebytes or a virus of explorer.exe.

What I’ve tried so far:

Microsoft’s advice on this is to run scannow which I’ve done– no issues. MS also suggest running checkdisk, I’ve done this three times now.The first time it stated problems with “Unable to locate the file name attribute of index entry” however, it fixed those.It also corrected errors in the Volume Bitmap.I ran checkdisk another two times and both times is said there were no problems.I also performed a disc clean up.

I had downloaded Malwarebytes at the beginning of there-build and scanned half a dozen times – no issues. I’ve also run McAfee half a dozen times – no issues.I’ve let McAfee scan my windows files on the C drive – no issues.

I uninstalled Malwarebytes as I thought there may be a security conflict but it has not resolved the problem.

I’ve looked at logs in the event viewer to try and track down anything suspicious but can’t find anything obvious.

A tech person I spoke to suggested I ensure that windows is activated/ authenticated as sometimes it needs to be re-activated after running a system image. However, it is authenticated so this is not an issue.

When the problem of “preparing security options” does not occur, my computer is quick and responsive, moving effortlessly between applications so my feeling is that this isn’t a hardware problem. For instance, last Sunday, I spent about six hours on the computer and during all this time, it behaved perfectly!But logged on the following day and“preparing security options” occurred twice.After it had cleared, the computer behaved well.

For added info, I did not install Windows telemetry updates or any updates for upgrading to Windows 10. I don’t believe “preparing security options”relates only to Windows 7 as I’ve seen posts saying this is happening with versions 8 and 10.

Having been trying to solve this for the last four weeks,including a couple of times where I’d taken two steps backwards but managed to save the situation with restore points (including in safemode) I’m reluctant to mess around with the computer too much now as when the problem doesn’t occur it functions well. However, it is still frustrating and I’d like to get it sorted.

Do any forum users have any further suggestions as to what I can try next or any clear consensus as to what is the cause?

 

[LevelBest]

I have been monitoring my computer over the last several days and the problem of 'preparing security options' seems to occur within the first 10 minutes or so of starting up the computer.

Does anyone have anything suggestions as to what I can do to try and resolve this, or is everyone in the dark as much as I am?

 

[torchwood]

Hi LevelBest,
How many user profiles do you have.

Roy

 

[LevelBest]

Hi Roy

Thank you so much for responding.

I've not come across the term user profile, but I'm wondering if it is similar to a user account? In either case, no one but myself has access to the computer?

I've been on the computer for the morning but will log off now and re-check tomorrow for any advice.

Thanks.

 

[torchwood]

Hi levelbest,
follow the instructions below, then can you copy/paste yours

1. type >> regedit << in the Search box, and then press ENTER.
2. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\(expand it)

yours should be like mine.

Roy

 

[LevelBest]

Hello Roy

I've put the registry screenshot below. It seems look like yours.

 

[torchwood]

Hi LB,
in the 1 5 21 section what are the last 4 digits 1000 or 1002
1000 is the admin 1002 is a user, ill post the right hand side block details of BOTH
compare and change as required.



Roy

 

[LevelBest]

Hi Roy

I hope this is the info you need.......

 

[torchwood]

Hi LevelBest,
please amend the values for
refcount to 1
state 100 (256)

the same as mine

Roy

 

[LevelBest]

Hi Roy

Can I double check what you mean? I’ve not ever entered into registry territory and am a little nervous.
The line on yours that states Ref Count which ends with 01 (1) and on mine ends with an 08 (8) – do I change both the long figure that ends with 08 and the bracketed (08)? Or does changing the long number automatically update the number in brackets?

Secondly, on yours on the state line which ends with 100 (256) and mine says 000 (0), you want me to change those numbers?

Thirdly, can I reverse this via a restore point if something goes wrong or would I need to go back into the registry and manually change it?

Many thanks.

 

[torchwood]

I forget people get nervous,
There are registry back up progs, most use Erunt. ERUNT Download
ONLY change the first field values (8 and 0 on yours to 1 and 100 mine)
RIGHT click on the field name>>then on Modify , a smaller window will appear with the current value in it just input the new value

reboot to update the registry

And they are reversable values

Roy

 

[LevelBest]

Hello Roy

I've gone ahead and changed the registry entries.

The first gif shows the new registry numbers altered to the new value. I immediately re-booted the machine but when I went back to check, the entries had changed, the Refcount showing 2 and State had gone back to 00000. Is this normal? Or should the values stay to what I changed them to?

 

[torchwood]

Hi LevelBest,
NO they should not change back.
When you ran Malwarebytes, did you have the Rootkit option ticked?
if not please rerun it with it checked, would you also run ESET on-line scan, dissable Mcafee first.

Can you also check in Mcafee's logs to see a if it stopped the change, or any other reference to a registry change or permissions/user rights

Roy

 

[LevelBest]

Hi Roy

I downloaded and ran Malwarebytes as it came, I didn't make any changes to what it was scanning. I've since uninstalled Malwarebytes but I'll download it again.

I've found ESET and will run. Do you want me to run both ESET and Malwarebytes?

Where do I access McAfee logs? (via event viewer?)

I'll need to leave all this now until the weekend when I'll have more time.

I've also seen on the net about changing the permissions of registry entries - would this be a way forward or are we trying to determine whether preparing security options is a virus?

Many thanks for your continuing help.

 

[Bertison]

Not intruding Torchwood, your advice is exactly what I would have given, but just a note for LevelBest: -

Malwarebytes was designed NOT to cause conflicts with any other AV product. For example: I run Kasperky Total Security and Hitman Pro, with Malwarebytes Pro and have no conflicts whatsoever. I also ran Bitdfender in the past for 3 years with Malwarebytes Pro and never had a conflict. So I am almost certain that your problem is not a conflict between AV/anti Malware programmes, unless McAfee does cause conflicts.

EDIT: I found this: https://tinyurl.com/gr6vkcj

You will have to delve into the Malwarebytes Exclusion folder and add 3 files as shown by the link. If there are conflicts, this will prevent them. Were I you, at McAfee upgrade time, I would drop it and buy a better AV product. Just my poinion, I do not like McAfee or Norton.

 

[Layback Bear]

This is how I use Malwarebytes settings.

 

[LevelBest]

I came home a little early from work, so am getting started on Roy's list.

The reason I uninstalled Malwarebytes was because I thought that was causing the PSO problem. However, I'm still getting it, so I was intending to reinstall at some point, so this has given me the opportunity to do that. Thank you, Layback Bear, I found the rootkit option. I've performed a MB scan without the rootkit option ticked and I am re-running again with the rootkit option ticked.

I'm going to need some guidance with delving into the McAfee logs. I've located them in the C drive programmes but there is a large list of folders (gif attached) and I don't know which one/s I should be looking at. I'll await Roy's guidance on that one.

I'll also await Roy's response or whether it's an idea to change the registry permission settings.

Many thanks for all of your inputs.

 

[LevelBest]

Hi Roy

As above post, I've done two scans with MB, the second one with the root kit option ticked. No issues.

Could you please help with what McAfee logs to look at.

I'll leave the scan with ESET to another time (bit nervous about disabling McAfee!)

I'm logging off now for the evening but many thanks for your continued support.

 

[Layback Bear]

I know nothing about McAfee. I haven't use it in 10 years or so.
I hear or read nothing good about McAfee.

 

[torchwood]

Hi LevelBest,
follow this link, (states W8 but that doesn't matter coz its a Mcafee prog)
https://www.google.co.uk/url?sa=t&r...tart=0&usg=AFQjCNEQPxB78QsJm-VTCGiVpqqkM7uCHw

There will not be a problem running the ESET on line scan with Mcafee dissabled as your only in thier site.

Roy