PDA

View Full Version : Microsoft.WindowsSecurityCenter_disabled



questionquestion
2010-10-18, 01:58
When I run Spybot Search and Destroy, I get a Microsoft.WindowsSecurityCenter_disabled detection. More specifically: (SBI $2E20C9A9) Settings HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl Set\Services\wscsvc\Start (is not) W=2 Registry Change.

When I tell Spybot to fix the problem, it tells me that it is fixed, and I can run another Search and Destroy and it will not register, but the next time I start my computer and run Search and Destroy, it detects the same change.

I have tried right clicking, selecting More Details, and jump to location, where I follow the file path, click on the file, and change the Value data from 4 to 2, however, when I restart my computer, it changes back to 4 and re-registers a registry change when I run Search and Destroy.

When I start my computer in Safe Mode, I can run Search and Destroy, select Fix selected problems when Microsoft.WindowsSecurityCenter_disabled pops up, and restart my computer in Safe Mode, run Search and Destroy again, and it will come back clean. However, when I start my computer in normal mode again, I will again get the Microsoft.WindowsSecurityCenter_disabled message.

This is not caused by other anti-virus software and I am not currently connected to the internet on the problem computer.

Previously, I had CoolWWWSearch.Leftovers HKEY_LOCAL_MACHINE\Software\Microsoft\Code Store Database\Distribution Units\Win32 Classes

and

CoolWWWSearch.OleHelp
Autorun settings (svchost)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost
Autorun settings (svchost)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost
Program file
C:\Documents and Settings\(Me)\ApplicationData\Microsoft\svchost.exe
Program file
C:\Documents and Settings\(Me)\Application Data\Microsoft\svchost.exe

and I believe a keylogger that is not currently showing up under my Recovery page.

After I removed these threats, I did a system restore to the earliest point I could and started troubleshooting as I have explained above.

Blade81
2010-10-23, 18:51
Hi,

Please follow the steps in BEFORE you POST (READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288) topic to create DDS logs (dds.txt & attach.txt). Then create a new topic with those two logs copy-pasted.