Solved How do I delete wscsvc.dll & wscsvc.dll.mui

[CSSlemaker]

Either McAfee security suite (when it was installed) or Dell replaced the Microsoft wscsvc functions with their own. However, they left a total of six copies of wscsvc.dll and wscsvc.dll.mui in various locations. They simply replaced the \Windows\system32\ and the restore copies by files of the same name but empty (zero bytes). I tried to delete them, with administrator privileges, but the system says I need permission from the Trusted Installer function. How can I do this? I have deleted the corresponding autostart entry, but it would be nice to delete the clutter. Can I? Thanks.

 

[UberGoober]

I really hate to tell you this, but it sounds like this happened.

 

[Laith]

Hey there! Run sfc /scannow and chkdsk /f /r.
Install the latest updates from Windows Update.

Do the exact same steps for chkdsk /f /r but instead of typing in sfc /scannow type chkdsk /f /r.
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

 

[Layback Bear]

A little infromation.

(wscsvc) = Windows Security Center service and I believe it is protected but they can get infected.

 

[torchwood]

Those services are not replaced or removed.
When windows identifies a 3rd party AV it automatically dissables them, so that they can be used again after the 3rd party AV is uninstalled.

DO NOT EVEN TRY to uninstall them.

Roy

 

[CSSlemaker]

Thanks UberGoober, but ???

I really hate to tell you this, but it sounds like this happened.

View attachment 373870

View attachment 373872

View attachment 373873

Thanks UG, but either the referenced material is way over my head (quite likely), or I'm missing important antecedent material, because I fail to see the relevance to my question. Take care - CSS

 

[torchwood]

Hi CSS,
You havnt really got a problem UG is way over the top.
As i said those services are just dissabled, and are not going to give you a problem.

Roy

 

[CSSlemaker]

Hey there! Run sfc /scannow and chkdsk /f /r.
Install the latest updates from Windows Update.

Do the exact same steps for chkdsk /f /r but instead of typing in sfc /scannow type chkdsk /f /r.
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Thanks Laith, but I'm afraid I don't understand your 2nd paragraph. I will run chkdsk /f /r (I've done so before but never found any situations requiring repair). Also, I have run sfc, both the repair option (if I recall correctly, it blew up with a BSOD) and the check only option. The latter option produced a HUGE log file and I have no idea how to filter it or search for entries indicating an error. I did find entries for the wscsvc.dll files and they failed the hash-total check. That tells me nothing of interest however - I knew the files are not the original correct files because they are null - zero bytes! Incidentally, if you know how to search the sfc log file for the error entries, I would be very thankful if you could explain how to do that. Thanks again.

 

[CSSlemaker]

Hi Roy (Torchwood) and thanks for your reply. I suspect that there is a way to delete these files - after all, at some past time, some process did at least replace them with dummy null files. Also, these dummy files had not been disabled - the system did try to start them during a reboot and it was the resulting error entries in the system event log that attracted my attention. But I have now disabled them and, as long as they don't cause any other problems, I'll just live with the clutter.

Incidentally, there is a Microsoft Windows article headed "What Happened to Windows Security Center in Windows 7?" The article states that Windows Security Center was "replaced" by the Action Center in Windows 7. But opening Action Center and looking under "Maintenance", what I see is a link to - guess what - wscsvc.dll - and it doesn't work (of course not, the file is null).

One final remark: In case you are not familiar with it, there is a Microsoft utility, Autoruns, which finds all services and other functions which start automatically. Thanks again. CSS

 

[torchwood]

Hi CSS,
Theres also a tutorial in this forum to remove it,
BUT if at any time you remove your 3rd party AV, MSE will kick back in automatically.

Roy

 

[CSSlemaker]

Hi Roy - Sorry, but what do "AV" and "MSE" mean? Sorta looks like "AV" refers to a service or other function required by a 3rd-party application, one which must be loaded automatically. But "MSE"?
CSS

 

[Layback Bear]

AV=Anti Virus

MSE=Microsoft Security Essentials.

 

[UberGoober]

Thanks UG, but either the referenced material is way over my head (quite likely), or I'm missing important antecedent material, because I fail to see the relevance to my question. Take care - CSS

Hi CSS,
You havnt really got a problem UG is way over the top.
As i said those services are just dissabled, and are not going to give you a problem.

Roy

Sorry for being unclear...if you and someone with a known-clean machine navigate the path shown in my images, I think you'll find that they are markedly different.

For instance, I have all Sharing turned off. Why are there extensive XML documents in that folder?

I think it's because the hidden, unwipeable XP Virtual Machine on my C: partition, which is my PC's "SYSTEM", put them there. But I don't know for sure, so I'd hoped someone would do a little investigating to help me and others with this problem. I'm certainly no security expert - just the curious type.

I have null folders and files all over the place after a recent Windows 7 Genuine Validation. During that a notification came up that Microsoft had done a repair to clean up and prevent "an exploit". Then my Windows 7 came up genuine, and updates could be installed.

I'm going to follow Laith's advice on Scannow, though it found no problems previously. Maybe it will after the exploit repair.