Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to fix a Windows 7 machine here that has been infected with all kinds of Malware. I have removed all of them as far as I can see but I am stumped by one last task.

One little bugger managed to remove the Windows Security Center service from the list of Windows services. So I cannot start it or set to automatically start. At the moment I cannot get the Windows firewall to turn on or any anti-virus software.

The security center shows the following image when I try:

1

Does anyone know how to add this back to the list of services so I may set it to start. I don't have a backup of the registry for this computer (it's not mine).

Many thanks

TT

share|improve this question
1  
I would run the sfc integrity check. Of course the far easier option is to nuke the system because it cannot be trusted at this point. – Ramhound Dec 3 '12 at 16:08
2  
If it were me I'd format the drive and start again. Far quicker in the long term and the plus side is you'll have a clean system too. – Lee Taylor Dec 3 '12 at 16:20

Service can be created like this:

  1. Run cmd.exe as Administrator
  2. exec this command: sc create wscsvc binpath= "C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted" type= share start= delayed-auto error= normal depend= RpcSs/Winmgmt obj= "NT AUTHORITY\LocalService" DisplayName= "Windows Security Center"
  3. and exec this also: sc sdset wscsvc D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCRP;;;S-1-5-80-2006800713-1441093265-249754844-3404434343-1444102779)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Don't know if this will work properly, but you'll have your service :)

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .