Windows Security Center won't turn on

[Jackie1]

my Windows Security Center won't turn on. And same with firewall. I've run a bunch of programs on here and one says:

Rkill 2.6.5 by Lawrence Abrams (Grinler)
Bleeping Computer - Technical Support and Computer Help
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesn't - A brief introduction to the program - Anti-Virus and Anti-Malware Software
Program started at: 04/28/2014 12:01:37 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* ALERT: ZEROACCESS rootkit symptoms found!
* C:\Program Files (x86)\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ [ZA Dir]
* C:\Program Files (x86)\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ \ [ZA Dir]
* C:\Program Files (x86)\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ \...\ [ZA Dir]
* C:\Program Files (x86)\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ \...\ﯹ๛\ [ZA Dir]
* C:\Program Files (x86)\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ \...\ﯹ๛\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ [ZA Dir]
* C:\Users\Jason\AppData\Local\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ [ZA Dir]
* C:\Users\Jason\AppData\Local\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\❤≸⋙\ [ZA Dir]
* C:\Users\Jason\AppData\Local\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\❤≸⋙\Ⱒ☠⍨\ [ZA Dir]
* C:\Users\Jason\AppData\Local\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\❤≸⋙\Ⱒ☠⍨\ﯹ๛\ [ZA Dir]
* C:\Users\Jason\AppData\Local\Google\Desktop\Install\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\❤≸⋙\Ⱒ☠⍨\ﯹ๛\{15fbac65-355f-d5ce-9a5e-8694a1ac93dc}\ [ZA Dir]
Checking Windows Service Integrity:
* Windows Firewall Authorization Driver (mpsdrv) is not Running.
Startup Type set to: Manual
* BFE [Missing Service]
* BITS [Missing Service]
* iphlpsvc [Missing Service]
* MpsSvc [Missing Service]
* PcaSvc [Missing Service]
* PolicyAgent [Missing Service]
* RemoteAccess [Missing Service]
* WinDefend [Missing Service]
* wscsvc [Missing Service]
* wuauserv [Missing Service]
* SharedAccess [Missing ImagePath]
Searching for Missing Digital Signatures:
* C:\Windows\System32\rpcss.dll : 513,024 : 11/20/2010 11:24 PM : 2270050800897a76f3f0b25cceebed1e [NoSig]
+-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll : 512,000 : 11/20/2010 11:24 PM : 5c627d1b1138676c0a7ab2c2c190d123 [Pos Repl]
Checking HOSTS File:
* No issues found.
Program finished at: 04/28/2014 12:01:45 PM
Execution time: 0 hours(s), 0 minute(s), and 7 seconds(s)


I'm not sure if this is the reason, but any help would be appreciated.

 

[cottonball]

Jackie1,

:info: Please use the Farbar Recovery Scan Tool.
Download: Farbar Recovery Scan Tool Download
Select the version that applies to your system: 64-bit
Save it to your Desktop.
Double-click the downloaded file to run it.

When the tool opens click Yes to the disclaimer.
At the program's console, press the Scan button.

When done, the tool produces a log, FRST.txt, in the same directory from which the tool is run (Desktop).
:ar: Please provide the FRST.txt in your reply.

The first time the tool is run, it also makes another log: Addition.txt
:ar: Also post the Addition.txt in your reply.


:info: Also, use the Farbar Service Scanner
Download: Downloading Farbar Service Scanner

Let's get a view of all services and dependencies scoped by the tool...
Make sure the following options are checked:
Internet Services
Windows Firewall
System Restore
Security Center
Windows Update
Windows Defender

Press: Scan

When done, FSS creates a log, FSS.txt, on the Desktop.
Please provide the FSS.txt in your reply.

Thank you.

 

[Jackie1]

It's not letting my paste it. WHen I do, it says:

1. The text that you have entered is too long (38159 characters). Please shorten it to 20000 characters long.

Which is smaller than what it's saying

 

[cottonball]

Can you attach the report?

 

[cottonball]

Do you use Dropbox, or SkyDrive, to which you can upload the reports, and provide the link to see them?

 

[Jackie1]

Well, a lot has happned since then. There were some windows updates that failed and....
When booting, windows 7 pc goes to black screen with mouse pointer. Same with every safe mode. Same with last known good configuration. Tried to get built-in repair to work, it tries, but fails. I did habe 3 system restore point before this issue, and when I try to choose that option, it says there are none! (When I had my last pc on xp, there was this disc called, "Roadstarter boot cd". I could use that to start ANY windows machine, no matter what was wrong. It was awesome. This cd is too old and doesn't support windows 7)
Is there something like this for windows 7 I can look for?
In the meantime, I used another windows 7 pc to burn a repair cd instead of using the repair tool buit into the bad pc, since it didn't work, but same issue doing it form the CD, but this one lets me get to dos.
After all this, I followed instructions here for "Method 2"

http://www.sevenforums.com/tutorials/102552-built-administrator-enable-winre.html
After I did the above, instead of getting the black screen after booting and the mouse pointer, I now get a blue screen that says, c00002e3, security accounts manager initialization failed because of the following error: device attached to system is no functioning.
error status: 0xc0000001

I also ran rkill a few days earlier, FRST/Farbar Recovery Scan Tool, combo fix, SuperAntiSpyware, etc. and computer was fine and rebooted perfect everytime before any issues started. Now, I know some of those programs backup the registry. I'm pretty sure if I can restore the registry files it will work. WHo can help with this?

For ex, FRST - Farbar recovery tool, I was able to get into the folder for it labled, HIVES, and there are 4-5 files in there, SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT, etc. I'm not sure what to do next, but if I restore those when things were good, it may fix? DO I just import those into registry?

 

[Kaktussoft]

Windows Repair (All In One) can solve a lot of your problems

 

[Kaktussoft]

Well, a lot has happned since then. There were some windows updates that failed and....
When booting, windows 7 pc goes to black screen with mouse pointer. Same with every safe mode. Same with last known good configuration. Tried to get built-in repair to work, it tries, but fails. I did habe 3 system restore point before this issue, and when I try to choose that option, it says there are none! (When I had my last pc on xp, there was this disc called, "Roadstarter boot cd". I could use that to start ANY windows machine, no matter what was wrong. It was awesome. This cd is too old and doesn't support windows 7)
Is there something like this for windows 7 I can look for?
In the meantime, I used another windows 7 pc to burn a repair cd instead of using the repair tool buit into the bad pc, since it didn't work, but same issue doing it form the CD, but this one lets me get to dos.
After all this, I followed instructions here for "Method 2"

http://www.sevenforums.com/tutorials/102552-built-administrator-enable-winre.html
After I did the above, instead of getting the black screen after booting and the mouse pointer, I now get a blue screen that says, c00002e3, security accounts manager initialization failed because of the following error: device attached to system is no functioning.
error status: 0xc0000001

I also ran rkill a few days earlier, FRST/Farbar Recovery Scan Tool, combo fix, SuperAntiSpyware, etc. and computer was fine and rebooted perfect everytime before any issues started. Now, I know some of those programs backup the registry. I'm pretty sure if I can restore the registry files it will work. WHo can help with this?

For ex, FRST - Farbar recovery tool, I was able to get into the folder for it labled, HIVES, and there are 4-5 files in there, SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT, etc. I'm not sure what to do next, but if I restore those when things were good, it may fix? DO I just import those into registry?

You mean this? http://www.sevenforums.com/tutorials/139576-startup-repair-infinite-loop-recovery.html

 

[Jackie1]

You mean this? http://www.sevenforums.com/tutorials/139576-startup-repair-infinite-loop-recovery.html

Yes, I basically had that issue first, before I messed with that SAM thing. So, try methods in your link above, and if that doesn't work, try the windows all in one repair?

 

[Kaktussoft]

You mean this? http://www.sevenforums.com/tutorials/139576-startup-repair-infinite-loop-recovery.html

Yes, I basically had that issue first, before I messed with that SAM thing. So, try methods in your link above, and if that doesn't work, try the windows all in one repair?

You must first have a booting system to even be able to run "windows all in one repair"

 

[Jackie1]

hOk, well, I just did the steps from (Startup Repair Infinite Loop Recovery) which that replaces the 5 files from regback and that fixed the blue screen error that I had from messing with the SAM in registry earlier. THanks. The files were from 4/23/14 in regbak. Now, in the actual config folder, there were backups in that folder of those 5 files, with .bak extentions from 4/28/14 before this all happened too.

So, this got me back to the original issue, which is the black screen with a mouse pointer after the windows logo... Anymore ideas?

(I wanted to say thanks. This isn't something anyone locally here can help with and places like certain big box store won't help with stuff like this, they just restore and don't want to dig down deep)

 

[Kaktussoft]

which is the black screen with a mouse pointer after the windows logo

When did the problems start? After some buggy installation?
Does "safe mode" work? Same problem in "safe mode"

 

[Kaktussoft]

* ALERT: ZEROACCESS rootkit symptoms found!
=>Did you remove ZEROACCESS????

 

[Kaktussoft]

Do I read correct???

-non of the "safe modes" boot successfully
-"system restore" from "recovery options" : 3 system restore points, but when you select one it fails. What error message?

 

[Jacee]

Looking at these Unicode characters: ❤≸⋙\Ⱒ☠⍨\ﯹ๛\


Please see this page ZeroAccess removal with RogueKiller

 

[Jackie1]

which is the black screen with a mouse pointer after the windows logo

When did the problems start? After some buggy installation?
Does "safe mode" work? Same problem in "safe mode"

Well, this pc had windows update off for some time. It got switched on and had 150 updates. I stopped it before it got to the 2nd update, not sure if this was the cause, but only 1-2 installed. After that, upon a reboot, it tried to run a scan, the windows scan where it goes through steps 1-5, this is the scan that can happen when you power off manually sometimes, but it was taking like 3 hours to go through it and I had to power off because I needed the pc. I think then it when this started.

* ALERT: ZEROACCESS rootkit symptoms found!
=>Did you remove ZEROACCESS????

That was from a log when I was running rkill, or another program. I think it was removed, but not sure how to check since it won't boot? The computer was fine though after running rkill, antispyware, combofix, etc, with multiple reboots, until the windows update and system scan were aborted.

Do I read correct???

-non of the "safe modes" boot successfully
-"system restore" from "recovery options" : 3 system restore points, but when you select one it fails. What error message?

Correct. Safe modes try to load, but then go to black screen with mouse pointer like normal booting.

I remember having these 3 restore points, but when I click system restore, it tries to load something, then in 1-2 sec, you get the window "no restore points have been created". Before it says that, it looks like it's trying to open that window where they'd be listed, but quickly in 1-2 sec goes to that splash screen, with the "no restore points...." I did try the command in dos rstruni,exe, I might be spelling that wrong, and same thing happens, it says there are none but I know there were there.

Looking at these Unicode characters: ❤≸⋙\Ⱒ☠⍨\ﯹ๛\


Please see this page ZeroAccess removal with RogueKiller

I can't run that since I can't boot. How do I check to see if it's gone?

 

[Jackie1]

also, I was going to do this next, http://www.sevenforums.com/tutorials/139810-sfc-scannow-run-command-prompt-boot.html

I followed steps and it says, "There is a system repair pending which requires reboot to complete. Restart Windows and run SFC again. But everytime I try to reboot and try this sfc, it says that....

 

[cottonball]

Jackie1,

If you are still dealing with ZeroAccess, please do the following before doing anything else:

:info: You may want to print these instructions so you can have access to them.
Also, you may want to read them once before you apply them.

Please plug in a USB pen drive into a working computer.

Go to the Farbar Recovery Scan Tool (FRST) download:
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
Select the download that applies to your system 64-bit
Save the program to the >> USB pen drive.
Remove USB pen drive when done.

Now, we are going to use the FRST program from the Recovery Environment to see what ZeroAccess has gotten hold of, and then remove it.

Please go to the problem computer.
Since you cannot boot, plug in the USB pen drive which has FRST.

Start the computer, and tap the F8 key until you get to the Advanced Boot Options
Use the arrow keys to select the Repair your computer menu item

From there...
Select your language settings, and click: Next
Select your User account and click: OK (If you did not set a password, leave blank.)

On the System Recovery Options you get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Scan your computer's memory for errors
Command Prompt

Select: Command Prompt

In the Command Prompt window, at the blinking cursor type notepad and press: Enter
In Notepad, under the File menu select: Open
Double-click the Computer icon on the left.
Find the pen drive letter, remember what letter it is, click on it, and press: Open
Close out of Notepad.

Click the Command Prompt window
Type x:\frst64.exe, and press: Enter
Note: Replace the drive letter x with the drive letter of your pen drive!

FRST starts, and prepares to run. Follow the prompts.
Click Yes to the Disclaimer.

Press the Scan button.

The scan runs, and, the program saves the FRST.txt, on the pen drive.

When done, click the Command Prompt window, type exit, and press: Enter

Back at the System Recovery Options, press: Shutdown
Remove the USB pen drive.

Plug the USB pen drive in the working computer, and please provide the FRST.txt in your reply

 

[Jackie1]

Thanks. It's too big to paste, so I attached it. Thanks to everyone for the fast replies. I'm dying here.

 

[Jackie1]

Why is my screen black when I start Windows 7?

Also, see above. it first mentions video driver, and I do notice when it tried to load safe mode, right before it gets to black screen with mouse pointer, the last file loaded was the ati driver, but maybe that is normal? Lastly, Scroll down to "fixing registry issues" on above link, and it says to check for "winlogon" key in registry and I don't have that key in my registry! This could be related? I haven't done anything else and will wait rfor eplies...