Results 1 to 12 of 12

Thread: Windows Security Service missing.

  1. #1
    Julian Dicks Guest

    Windows Security Service missing.

    got hit by a virus (while I had access control turned off), cleaned up fine
    but Windows Security Service disappeared and I now get the complaint on
    startup that it isnt running and I can't turn it on.

    so it isn't listed in the services list so I'd like to know how to
    re-install the service WITHOUT reinstalling vista.

  2. #2
    Jesper Guest

    RE: Windows Security Service missing.

    > got hit by a virus (while I had access control turned off), cleaned up fine
    > but Windows Security Service disappeared and I now get the complaint on
    > startup that it isnt running and I can't turn it on.
    >
    > so it isn't listed in the services list so I'd like to know how to
    > re-install the service WITHOUT reinstalling vista.


    There is no such thing as the "Windows Security Service," at least not on a
    legitimate installation of Vista. Either you are not getting the name right
    or, more likely, the infection has not been completely removed. Can you tell
    us more about how exactly you are getting notified that this is missing?

  3. #3
    Julian Dicks Guest

    RE: Windows Security Service missing.


    > There is no such thing as the "Windows Security Service," at least not on a
    > legitimate installation of Vista. Either you are not getting the name right
    > or, more likely, the infection has not been completely removed. Can you tell
    > us more about how exactly you are getting notified that this is missing?


    Correction: Security Center Service
    Little red icon with cross (x) appears on startup, click it and the Windows
    Security Center pops up showing the Windows Update, Firewall, Defender etc.
    on the Left and on the right says Security Center on right and "The Security
    Center service is turned off."

    And when I ask it to turn on it complains "The Security Center service can't
    be started."

    Thanks

  4. #4
    Jesper Guest

    RE: Windows Security Service missing.

    > Correction: Security Center Service
    > Little red icon with cross (x) appears on startup, click it and the Windows
    > Security Center pops up showing the Windows Update, Firewall, Defender etc.
    > on the Left and on the right says Security Center on right and "The Security
    > Center service is turned off."


    Aah. That makes more sense. Can you do two things for me:
    1. Click the Window button
    2. Type "eventvwr.msc" in the search dialog
    3. Accept the UAC prompt
    4. Expand Windows Logs and click on System
    5. On the right-hand side, click "Filter current log..."
    6. Select "Warning," "Critical," and "Error" and hit OK
    7. Find the event(s) from the Service Control Manager that relates to the
    Security Center Service and select it
    8. Hit the "Copy" button on the right hand side
    9. Respond to this message and past the entire event into the response

    10. Step 2: Click the Window button: All Programs:Accessories
    11. Right-click Command Prompt and select "Run as administrator..."
    12. In the command prompt, type "sc qc wscsvc"
    13. Click the little "C:\_" icon in the upper left corner
    14. Select Edit:Mark...
    15. Click-drag the cursor over all the output from the sc command to select it
    16. Right-click anywhere in the selection
    17. In the reply to this post, paste the output so we can see what it says.

    This information will help troubleshoot what is going on.

  5. #5
    Julian Dicks Guest

    RE: Windows Security Service missing.

    part 1
    ====
    The wincom32 service failed to start due to the following error:
    The system cannot find the file specified.

    The MCSTRM service failed to start due to the following error:
    The system cannot find the file specified.

    part 2
    ====
    C:\WINDOWS\system32>sc qc wscsvc
    [SC] OpenService FAILED 1060:

    The specified service does not exist as an installed service.

  6. #6
    Jesper Guest

    RE: Windows Security Service missing.

    > part 1
    > ====
    > The wincom32 service failed to start due to the following error:
    > The system cannot find the file specified.
    >
    > The MCSTRM service failed to start due to the following error:
    > The system cannot find the file specified.
    >
    > part 2
    > ====
    > C:\WINDOWS\system32>sc qc wscsvc
    > [SC] OpenService FAILED 1060:
    >
    > The specified service does not exist as an installed service.


    Have you ever had Real Player installed on this system? If you have mcstrm
    may be legit, but otherwise it is almost certainly a leftover from the
    infection. Can you run sc qc mcstrm? If it shows you a binary path that is
    not %systemroot%\system32\drivers it would be a piece left over of the
    malware that took over your system. The name of the service seems to indicate
    the same thing.

    wincom32 is a component of a number of downloaders (malware). It appears the
    removal process removed some of the infection, but not the services that were
    created. Neither of those services have corresponding binaries left on the
    system any longer, which is why they fail to start. Neither has to do with
    the Security Center. Here is one link about Wincom32.sys:
    http://www.symantec.com/security_res...403-99&tabid=2

    It appears that the malware somehow managed to remove the Windows Security
    Center service, which is why it is not running. sc is telling you that it has
    been removed as an installed service. To be honest, I would suggest you
    flatten the computer and start over. That would give you a far better chance
    at having a fully functional system than attempting to recover the things
    that you know have been hosed. There could very well be other detritus left
    over which was not removed and you really have no way to find it.

  7. #7
    Julian Dicks Guest

    RE: Windows Security Service missing.


    > It appears that the malware somehow managed to remove the Windows Security
    > Center service, which is why it is not running. sc is telling you that it has
    > been removed as an installed service. To be honest, I would suggest you
    > flatten the computer and start over. That would give you a far better chance
    > at having a fully functional system than attempting to recover the things
    > that you know have been hosed. There could very well be other detritus left
    > over which was not removed and you really have no way to find it.


    Quite correct. However, I'd really like the service details so I can at
    least try to "re-install" it. Considering the complexities and time of
    getting my development up and running again, I really can't afford to go a
    day without my pc as I rebuild it. If i could just get a copy of the registry
    key it should be enough.

    If it takes longer than a coffee break it'll just have to be another one of
    those annoying things I cope with.

  8. #8
    Jesper Guest

    RE: Windows Security Service missing.

    > > It appears that the malware somehow managed to remove the Windows Security
    > > Center service, which is why it is not running. sc is telling you that it has
    > > been removed as an installed service. To be honest, I would suggest you
    > > flatten the computer and start over. That would give you a far better chance
    > > at having a fully functional system than attempting to recover the things
    > > that you know have been hosed. There could very well be other detritus left
    > > over which was not removed and you really have no way to find it.

    >
    > Quite correct. However, I'd really like the service details so I can at
    > least try to "re-install" it. Considering the complexities and time of
    > getting my development up and running again, I really can't afford to go a
    > day without my pc as I rebuild it. If i could just get a copy of the registry
    > key it should be enough.


    It doesn't take very long, but the problem is that I don't think your PC is
    clean. I think there are traces of malware still on it. If you are willing to
    take the risk that something will keep forwarding your personal information
    to some criminal in China, then run this command from an elevated command
    prompt and Windows Security Center should work again:

    sc create wscsvc type=share start=delayed-auto error=normal
    binPath="C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted"
    depend=RpcSc/WinMgmt obj="NT AUTHORITY\LocalService" /DisplayName="Security
    Center"

  9. #9
    Julian Dicks Guest

    RE: Windows Security Service missing.

    Thanks, I am definately sure I have gotten rid of every critter so its just
    minor surgery required.

    Something is missing from your "command"
    1. remember spaces after xxxx=[ ]
    2. There is nothing after the -k, is that right as it complains about "The
    system cannot find the file specified." when I try start it.

    sc create wscsvc type= share start= delayed-auto error= normal binPath=
    "C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" depend=
    RpcSs/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security Center"

  10. #10
    Julian Dicks Guest

    RE: Windows Security Service missing.

    Tried this based on my XP box with no luck.. so I still have the wrong -k
    command

    sc create wscsvc type= share start= delayed-auto error= normal binPath=
    "C:\Windows\System32\svchost.exe -k netsvcs LocalServiceNetworkRestricted"
    depend= RpcSs/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security
    Center"

  11. #11
    Jesper Guest

    RE: Windows Security Service missing.

    > Something is missing from your "command"
    > 1. remember spaces after xxxx=[ ]
    > 2. There is nothing after the -k, is that right as it complains about "The
    > system cannot find the file specified." when I try start it.


    Sorry, I'm a moron. There is no slash before "DisplayName". This works:
    sc create wscsvc type= share start= delayed-auto error= normal binPath=
    "C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" depend=
    RpcSc/WinMgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Security Center"

    You still need the right security descriptor on it. This will fix it:
    sc sdset wscsvc
    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSW LOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

  12. #12
    Join Date
    Nov 2007
    Posts
    1
    Can you make a file that can be run that will fix it. I too have this problem. Thanks.

Similar Threads

  1. Security Update for Windows XP Service Pack 3 (KB952069)
    By vegasaudioguy in forum Windows Update
    Replies: 8
    Last Post: 24-03-2011, 05:05 PM
  2. Turn on Windows Security Center service
    By Taizin in forum Operating Systems
    Replies: 2
    Last Post: 08-09-2010, 12:10 PM
  3. Missing Norton icon service tray on Windows Xp
    By Sunny55 in forum Windows Software
    Replies: 3
    Last Post: 25-07-2009, 12:58 PM
  4. Missing Files For Windows Service Pack 3
    By Dharamsi in forum Operating Systems
    Replies: 4
    Last Post: 13-03-2009, 12:30 PM
  5. windows xp print spooler service missing
    By Tirana in forum Windows XP Support
    Replies: 2
    Last Post: 14-01-2008, 09:30 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •