Go Back   TechArena Community > Technical Support > Computer Help > Windows Vista > Vista Help
Become a Member!
Forgot your username/password?
Register Tags Active Topics RSS Search Mark Forums Read

Sponsored Links



Windows Security Service missing.

Vista Help


Reply
 
Thread Tools Search this Thread
  #1  
Old 15-03-2007
Julian Dicks
 
Posts: n/a
Windows Security Service missing.

got hit by a virus (while I had access control turned off), cleaned up fine
but Windows Security Service disappeared and I now get the complaint on
startup that it isnt running and I can't turn it on.

so it isn't listed in the services list so I'd like to know how to
re-install the service WITHOUT reinstalling vista.

Reply With Quote
  #2  
Old 16-03-2007
Jesper
 
Posts: n/a
RE: Windows Security Service missing.

> got hit by a virus (while I had access control turned off), cleaned up fine
> but Windows Security Service disappeared and I now get the complaint on
> startup that it isnt running and I can't turn it on.
>
> so it isn't listed in the services list so I'd like to know how to
> re-install the service WITHOUT reinstalling vista.


There is no such thing as the "Windows Security Service," at least not on a
legitimate installation of Vista. Either you are not getting the name right
or, more likely, the infection has not been completely removed. Can you tell
us more about how exactly you are getting notified that this is missing?
Reply With Quote
  #3  
Old 16-03-2007
Julian Dicks
 
Posts: n/a
RE: Windows Security Service missing.


> There is no such thing as the "Windows Security Service," at least not on a
> legitimate installation of Vista. Either you are not getting the name right
> or, more likely, the infection has not been completely removed. Can you tell
> us more about how exactly you are getting notified that this is missing?


Correction: Security Center Service
Little red icon with cross (x) appears on startup, click it and the Windows
Security Center pops up showing the Windows Update, Firewall, Defender etc.
on the Left and on the right says Security Center on right and "The Security
Center service is turned off."

And when I ask it to turn on it complains "The Security Center service can't
be started."

Thanks
Reply With Quote
  #4  
Old 16-03-2007
Jesper
 
Posts: n/a
RE: Windows Security Service missing.

> Correction: Security Center Service
> Little red icon with cross (x) appears on startup, click it and the Windows
> Security Center pops up showing the Windows Update, Firewall, Defender etc.
> on the Left and on the right says Security Center on right and "The Security
> Center service is turned off."


Aah. That makes more sense. Can you do two things for me:
1. Click the Window button
2. Type "eventvwr.msc" in the search dialog
3. Accept the UAC prompt
4. Expand Windows Logs and click on System
5. On the right-hand side, click "Filter current log..."
6. Select "Warning," "Critical," and "Error" and hit OK
7. Find the event(s) from the Service Control Manager that relates to the
Security Center Service and select it
8. Hit the "Copy" button on the right hand side
9. Respond to this message and past the entire event into the response

10. Step 2: Click the Window button: All Programs:Accessories
11. Right-click Command Prompt and select "Run as administrator..."
12. In the command prompt, type "sc qc wscsvc"
13. Click the little "C:\_" icon in the upper left corner
14. Select Edit:Mark...
15. Click-drag the cursor over all the output from the sc command to select it
16. Right-click anywhere in the selection
17. In the reply to this post, paste the output so we can see what it says.

This information will help troubleshoot what is going on.
Reply With Quote
  #5  
Old 16-03-2007
Julian Dicks
 
Posts: n/a
RE: Windows Security Service missing.

part 1
====
The wincom32 service failed to start due to the following error:
The system cannot find the file specified.

The MCSTRM service failed to start due to the following error:
The system cannot find the file specified.

part 2
====
C:\WINDOWS\system32>sc qc wscsvc
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.
Reply With Quote
  #6  
Old 16-03-2007
Jesper
 
Posts: n/a
RE: Windows Security Service missing.

> part 1
> ====
> The wincom32 service failed to start due to the following error:
> The system cannot find the file specified.
>
> The MCSTRM service failed to start due to the following error:
> The system cannot find the file specified.
>
> part 2
> ====
> C:\WINDOWS\system32>sc qc wscsvc
> [SC] OpenService FAILED 1060:
>
> The specified service does not exist as an installed service.


Have you ever had Real Player installed on this system? If you have mcstrm
may be legit, but otherwise it is almost certainly a leftover from the
infection. Can you run sc qc mcstrm? If it shows you a binary path that is
not %systemroot%\system32\drivers it would be a piece left over of the
malware that took over your system. The name of the service seems to indicate
the same thing.

wincom32 is a component of a number of downloaders (malware). It appears the
removal process removed some of the infection, but not the services that were
created. Neither of those services have corresponding binaries left on the
system any longer, which is why they fail to start. Neither has to do with
the Security Center. Here is one link about Wincom32.sys:
http://www.symantec.com/security_res...403-99&tabid=2

It appears that the malware somehow managed to remove the Windows Security
Center service, which is why it is not running. sc is telling you that it has
been removed as an installed service. To be honest, I would suggest you
flatten the computer and start over. That would give you a far better chance
at having a fully functional system than attempting to recover the things
that you know have been hosed. There could very well be other detritus left
over which was not removed and you really have no way to find it.
Reply With Quote
  #7  
Old 19-03-2007
Julian Dicks
 
Posts: n/a
RE: Windows Security Service missing.


> It appears that the malware somehow managed to remove the Windows Security
> Center service, which is why it is not running. sc is telling you that it has
> been removed as an installed service. To be honest, I would suggest you
> flatten the computer and start over. That would give you a far better chance
> at having a fully functional system than attempting to recover the things
> that you know have been hosed. There could very well be other detritus left
> over which was not removed and you really have no way to find it.


Quite correct. However, I'd really like the service details so I can at
least try to "re-install" it. Considering the complexities and time of
getting my development up and running again, I really can't afford to go a
day without my pc as I rebuild it. If i could just get a copy of the registry
key it should be enough.

If it takes longer than a coffee break it'll just have to be another one of
those annoying things I cope with.
Reply With Quote
  #8  
Old 19-03-2007
Jesper
 
Posts: n/a
RE: Windows Security Service missing.

> > It appears that the malware somehow managed to remove the Windows Security
> > Center service, which is why it is not running. sc is telling you that it has
> > been removed as an installed service. To be honest, I would suggest you
> > flatten the computer and start over. That would give you a far better chance
> > at having a fully functional system than attempting to recover the things
> > that you know have been hosed. There could very well be other detritus left
> > over which was not removed and you really have no way to find it.

>
> Quite correct. However, I'd really like the service details so I can at
> least try to "re-install" it. Considering the complexities and time of
> getting my development up and running again, I really can't afford to go a
> day without my pc as I rebuild it. If i could just get a copy of the registry
> key it should be enough.


It doesn't take very long, but the problem is that I don't think your PC is
clean. I think there are traces of malware still on it. If you are willing to
take the risk that something will keep forwarding your personal information
to some criminal in China, then run this command from an elevated command
prompt and Windows Security Center should work again:

sc create wscsvc type=share start=delayed-auto error=normal
binPath="C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted"
depend=RpcSc/WinMgmt obj="NT AUTHORITY\LocalService" /DisplayName="Security
Center"
Reply With Quote
  #9  
Old 20-03-2007
Julian Dicks
 
Posts: n/a
RE: Windows Security Service missing.

Thanks, I am definately sure I have gotten rid of every critter so its just
minor surgery required.

Something is missing from your "command"
1. remember spaces after xxxx=[ ]
2. There is nothing after the -k, is that right as it complains about "The
system cannot find the file specified." when I try start it.

sc create wscsvc type= share start= delayed-auto error= normal binPath=
"C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" depend=
RpcSs/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security Center"
Reply With Quote
  #10  
Old 20-03-2007
Julian Dicks
 
Posts: n/a
RE: Windows Security Service missing.

Tried this based on my XP box with no luck.. so I still have the wrong -k
command

sc create wscsvc type= share start= delayed-auto error= normal binPath=
"C:\Windows\System32\svchost.exe -k netsvcs LocalServiceNetworkRestricted"
depend= RpcSs/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security
Center"
Reply With Quote
  #11  
Old 21-03-2007
Jesper
 
Posts: n/a
RE: Windows Security Service missing.

> Something is missing from your "command"
> 1. remember spaces after xxxx=[ ]
> 2. There is nothing after the -k, is that right as it complains about "The
> system cannot find the file specified." when I try start it.


Sorry, I'm a moron. There is no slash before "DisplayName". This works:
sc create wscsvc type= share start= delayed-auto error= normal binPath=
"C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" depend=
RpcSc/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security Center"

You still need the right security descriptor on it. This will fix it:
sc sdset wscsvc
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSW LOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
Reply With Quote
  #12  
Old 09-11-2007
Member
 
Join Date: Nov 2007
Posts: 1
Can you make a file that can be run that will fix it. I too have this problem. Thanks.
Reply With Quote
Reply

  TechArena Community > Technical Support > Computer Help > Windows Vista > Vista Help
Tags:



Thread Tools Search this Thread
Search this Thread:

Advanced Search


Similar Threads for: "Windows Security Service missing."
Thread Thread Starter Forum Replies Last Post
Security Update for Windows XP Service Pack 3 (KB952069) vegasaudioguy Windows Update 8 24-03-2011 06:05 PM
Turn on Windows Security Center service Taizin Operating Systems 2 08-09-2010 01:10 PM
Missing Norton icon service tray on Windows Xp Sunny55 Windows Software 3 25-07-2009 01:58 PM
Missing Files For Windows Service Pack 3 Dharamsi Operating Systems 4 13-03-2009 01:30 PM
windows xp print spooler service missing Tirana Windows XP Support 2 14-01-2008 10:30 PM


All times are GMT +5.5. The time now is 10:03 PM.