MSE can not start. Security Center can not start - I have done everything.
I swear I have done everything to solve this problem. I've spent the last 6+ hours since I was an idiot and downloaded from somewhere I didn't really trust trying to solve this problem. I doubt anyone will be able to help me aside from telling me to format my drive, but here goes. It all started when I downloaded a file and ran it as administrator. As soon as I did the file disappeared from the desktop and I knew bad things were about to happen. Microsoft Security Essentials popped up and said that some files were installed that might be bad but it didn't know so it wanted permission to send them off to be reviewed. So I gave permission then immediately went to where the files were saved and deleted them, but while I was doing this I could see other files start popping up in the same location. I couldn't tell exactly which files they were though, I just saw the files scrolling around. I could have gone and deleted everything that was modified at that time, but I was afraid that the virus may have infected something essential and that I would kill my computer. So after that I ran MSE and no threats were found. I then ran the free version of Malwarebytes and it found 5 security threats, a few trojans, something that said faketrojan or something to that extent. I quarantined and then deleted them all. Malwarebytes then prompted me to restart the computer to make sure everything was completely removed so I did. When I came back everything seemed fine for a few minutes but then I got the little problem popup in the bottom right saying that the security center was turned off, defender was turned off, and I had no antivirus. I immediately started up MSE but it popped up for a few seconds with the red theme (showing that it is turned off) and then went away. I tried again and again and every time it did the same thing. When I went to the icons on the toolbar in the bottom right as soon as I moved my mouse over the MSE icon it disappeared. I thought this must be some trace of the virus that is preventing me from opening MSE so I can't get rid of it, so I ran another scan with Malwarebytes but it found nothing. I thought that there may have been some damage to the program from the virus so I uninstalled MSE and reinstalled, but the problem persisted. Next, I downloaded the free 30 day trial of Kaspersky Antivirus 2011 and ran a complete scan with that which found nothing. After much more searching on the internet someone described having the same problem and said that booting into safe mode allowed them to run MSE which found the virus that stopped it from loading in normal mode and the problem was solved. So that's what I did. I booted into safe mode and just like the person said, MSE was able to start so I ran a complete scan. It found nothing. I then ran a complete scan with Malwarebytes in safe mode and it found nothing. I then ran a complete scan with Kaspersky in safe mode and it found nothing. I did some more searches and found a link to a complete wscsvc registry file, which someone claimed was the problem and that it would fix it. There were several other people praising the person after this saying that it solved the problem, so I made a backup of wscsvc and imported the new one. It didn't do any harm, but it also didn't solve the problem. I searched around some more and found that some people said that the popups only affect one user and that it could be the result of the user being corrupt as a result of damage from the virus. So I created a new administrative account, logged out of my account, logged into the new one, uninstalled MSE, reinstalled it, tried to run it, and again it would disappear within seconds. I also continued getting the popup messages and was still unable to start the security center. I deleted the new account and went back to my original, ran CCleaner registry error sweep out of pure desperation, it found some problems, I fixed them, the problem is still there. Oh and somewhere along the way I went to services and changed security center and defender to automatic (also tried Automatic with delay) along with apply and then start and ok, and it said automatic on the list after that and looked like it worked, but it never really opened, and when I checked on it later it said disabled again. I also ran the Kaspersky rootkit killer and it returned no results. I also ran sfk /scannow twice and both times it said there were no problems. So here I am, having tried everything short of formatting my drive that I haven't backed up with very important files (I can't afford an external drive at the moment). Formatting is not an option. Internet searches have stopped yielding possible solutions. Can anyone help? Please? UPDATE: Deleted temporary files, problem continues. Ran avast full scan - found nothing. Ran avast boot scan - found some corruptions but no infections. I took care of the corruptions. Ran AVG full scan - found nothing. Ran AVG rootkit scan - found nothing. Ran AVG PC Tuneup fixed registry errors, fragmentation, etc. Problem continues. All of the top anti-virus/malware/spyware is telling me there's nothing, but something must be killing MSE when it starts. I just don't understand it. After all of this my computer should be completely clean. UPDATE: Everything just got worse. I uninstalled MSE with Revo-Uninstaller then ran the advanced scan and deleted all remaining files. I then ran SuperAntiSpyware full scan and it found nothing. The problem continued so I tried Combofix and followed the directions EXACTLY. I left the scan to its self and left for about 20 minutes. When I came back the scan had finished and the report was on the screen. I figured I should see if the problem was continuing before posting the log to see what the problem was, and I was shocked to see that I was no longer getting the problem in the toolbar saying to open security center. I had thought the problem was solved so I installed MSE and it worked, so I started to update it while typing this up to thank everyone for the help and let you all know that Combofix solved the problem, BUT while I was typing it Firefox stopped responding for about 5 minutes. Eventually it came back and I wrote it off as something random, but a few minutes later it stopped responding again. This time it refused to respond again and I was forced to reset the computer. I then tried to start Windows normally and it got me to the log in screen, but when I put my password in and hit enter it seemed to get stuck at the welcome screen with the loading icon. I waited for several minutes (it usually logs in within 5 seconds) but it just continued spinning at the welcome screen. I reset and tried again, same problem, except this time the loading wheel froze after a few minutes. I thought that maybe something was caught in a loop so I reset, went to the log in screen and hit shutdown, but it froze and wouldn't shut down, so I was forced to kill the computer by holding the power button. I started the Windows normally again and the problem persisted where I could not log in, so I booted into safe mode and the warning message on the toolbar says windows security center is turned off again. I'm currently typing this from safe mode with connectivity. I'm not sure what happened. Everything looked like it was fixed but it just got worse. Can someone direct me to where I would restore from the point before Combofix ran? I thought I right-click the drive then go to properties and previous versions, but it says there are none. UPDATE: I found the system restore option and restored to right before I ran Combofix (from safe mode). I then logged in which took longer than usual, but after about a minute I was able to get into my account, but it was only a black screen. I was able to ctrl shift esc to to the task manager to find that most of the processes weren't running. After about 5 minutes everything suddenly came up and it said the restore was successful, so since I've never had to restore to a previous state I assume the black screen is what's supposed to happen while everything loads up. Now I can access Windows normally but the problem is still there and I'd rather not run Combofix again since after I ran that I wasn't able to access Windows normally. Any more ideas? UPDATE: I don't know what happened. I continued trying some complicated stuff with the process explorer, manually looking for malware, etc. and couldn't find anything so I randomly decided I would try setting it to automatic in services again even though it didn't work the last few times I tried. This time it worked. I then restarted the computer and it loaded up normally, MSE runs and there is no security center warning. Everything is working perfectly, but I didn't do anything. I don't know how everything got fixed. It seems like everything started working again after I ran Combofix and restored to a previous state (I guess the reason the problem was still there after this was because I just had to change Security Center to Automatic under services again). Thank you everyone for your help. Not only did I get the problem solved but I learned a valuable lesson. I will NEVER run a file from the internet again without first running it in a sandbox. And I also have 6 pages of notes from that Advance Malware Removal video and a folder full of Sysinternal and rootkit identifying tools so I should be set for if anything happens again. Thanks again for all the help.
August 11th, 2011 10:36am

Hi Mitchell777 Try running a full scan with SuperAntiSpyware (there is a free edition which does not auto-update). Update the definitions before scanning. Also, the program has a repair section for you to repair pc damages caused by viruses. If u can't start SAS due to a virus, go to the SAS folder in start menu and click on SAS Alternate Start. Try uninstalling MSE with Revo-uninstaller (uninstall in Advanced mode). Have you tried updating windows? System restore? IMHO MSE is not so secure, it seems that quite a number of people running MSE have an infection. Personally I use Avast! free edition (with very frequent updating) and Comodo firewall free edition, also make sure you enable all security features of your antivirus programs. Hope that helps:)
Free Windows Admin Tool Kit Click here and download it now
August 11th, 2011 3:10pm

Since this seems like a bit of an annoying virus, if you can't do a system restore, you might want to try Combofix from bleepingcomputer.com. Here's the page with the guide and tutorial on using Combofix http://www.bleepingcomputer.com/combofix/how-to-use-combofix But be warned. Combofix is a powerful scanner so you should follow everything on that page exactly. If it says close all windows, and while it's running don't do anything on the computer (which it does) then DON'T DO ANYTHING. Combofix also creates a restore point before doing any scanning so if anything goes wrong you can go back to before you ran it, but still, following the tutorial is a good idea. After it's done, it'll make a log that you can show in the bleepingcomputer forums, so if MSE still isn't working, the people on the forum will be able to read the log and provide more help than I could as I'm not familiar with reading said logs.
August 11th, 2011 5:11pm

Hi, If you think the antivirus programs aren't doing the job you can try to manually remove a virus using some of the Sysinternals tools. I use this method all the time and would swear by it. There is a video by Microsoft's Mark russinovich called Advanced Malware Cleaning which should guide you in the right direction. Hope this helps. CathalCathal O'Brien BSc, PgDip, PhD . Techsmart IT Support | Computer Repairs
Free Windows Admin Tool Kit Click here and download it now
August 11th, 2011 8:32pm

I watched the video and got everything he listed, but under Process Explorer there is nothing suspicious or unverified. But wait, it gets much more confusing. I first began looking through the process explorer while disconnected from the internet, like the person in the video said. When I couldn't find anything I thought maybe I had to recreate the problem to cause whatever was stopping MSE and Security Center from working to show its self, so I tried to open Security Center and it wouldn't work, but nothing suspicious popped up. It launched highlighted in green and so did some other verified Microsoft component (I believe it was Windows Search which I disabled to see if it would solve the problem, but it didn't, nor has it created any new problems). When I closed the window nothing else came up, so nothing suspicious appeared when making the problem show up. Because of this I thought maybe opening MSE would cause whatever was killing it immediately to show, but to my surprise MSE worked. All I have done between MSE not working and working is run Combofix (which prevented me from running Windows normally) then restore to a previous working state right before using Combofix. So something there must have fixed that problem because I can now open MSE, but I still can't get rid of that annoying Security Center popup and every time I attempt to turn it on it says The Windows Security Center service can't be started. So since MSE was working and I couldn't force the malware that I think is there to show its self I figured it must need internet to block MSE and that however it's blocking the Security Center it must be able to do offline. So I connected the internet cable back into the computer and tried to open Security Center. Still didn't work, still nothing suspicious. I then attempted to open MSE and it's working. I don't know why, but magically it is. Because nothing suspicious is showing but I'm still unable to open Security Center for some reason I thought that something must be hidden that's shutting it down, and as the person in the video recommended I got various rootkit finders. I tried all of them both online and offline and all of them are killed as soon as they start up. Nothing showed up as suspicious in Process Explorer, but something must be stopping these programs from finding it. I don't see why they would all just not work. I tried: System Virginity Verifier, GMER, IceSword, F-Secure Blacklight, and Sysinternals Rootkit Revealer. None of them work, they're all either killed upon starting or get popups that say something went wrong or something doesn't exist in system32 so it can't run. I'm still playing around with everything try to see if I can get something to work or find what the problem is, but I just don't understand what's going on. Everything is pointing to the computer being completely clean, but then everything else is acting like something malicious is on the computer and nothing I do seems to work. I'm starting to think either there was a virus that I took care of but it caused a lot of damage which is resulting in all of these errors, or it's just extremely sophisticated and nothing can detect it or it kills them before they even have the chance. Does anyone have any ideas what my next step should be?
August 12th, 2011 2:18am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics