Solved Windows security not working and shows me blank page, could you please help me?

  • Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Status
Not open for further replies.
@MaXz Re-run Rouge killer and fix everything found.

Here is the windows defender key, I have uploaded it for you.
Unzip it to your desktop.
Boot into safe mode and right click and select merge.
Reboot into normal mode and check the issue.
Post a new FSS log so I can see if the key has been replaced.
Adware Cleaner

  • Download AdwCleaner and save it to your Desktop
  • Right-click on AdwCleaner.exeand select, Run as Administrator
  • Accept the EULA (I accept), then click on Scan Now
  • Let the scan complete
  • Once the scan completes, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button
  • Subsequently you may be asked to Run Basic Repair. This is optional. I would suggest holding off on this for now.
  • Once the cleaning process is complete, AdwCleaner will ask you to restart your computer
  • Close all other open windows and allow it to restart
  • After the restart, Notepad will open with the AdwCleaner cleaning log
  • Please Attach the contents of that log into your next reply to me
 

Attachments

Last edited:
Once you have completed all of the above, and security center will still not open.

Open PowerShell . Via Power Run
Unzip to your desktop.
Double click folder.
Drag PowerRun_X64.exe to your desktop.
Run the program then run Powershell.
1695424112309.png

Copy and paste each command below hitting enter after each one, then reboot the computer.

Set-ExecutionPolicy Unrestricted
Click to expand...

Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage
Click to expand...

Get-AppxPackage *Microsoft.Windows.SecHealthUI* | Reset-AppxPackage
Click to expand...

Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
Click to expand...
 
Last edited:

Attachments

Malnutrition said:
Once you have completed all of the above, and security center will still not open.

Open PowerShell . Via Power Run
Unzip to your desktop.
Double click folder.
Drag PowerRun_X64.exe to your desktop.
Run the program then run Powershell.
View attachment 12685

Copy and paste each command below hitting enter after each one, then reboot the computer.
Click to expand...
Also I did the powershell commands and got a whole list of red texts
 
Hmmm, all registry keys have been replaced. It is still not starting, we may need to perform a repair install but lets check and make sure I did not miss anything first.

Download Malwarebytes v.4 . Install and run.

  • Once the MBAM dashboard opens, click on Settings (gear icon).
  • Click on Security tab and make sure that all four Scan options are enabled.
  • Close Settings and click on the Scan button on the dashboard.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
  • If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and include that log on your next reply.
ZHP Diag Scanner.

Download ZHP Suite to your desktop.
Right Click Run as admin.
Hit the scanner button.
Once it is complete a file name ZHPdiag.txt will be on your desktop.
Attach it.
 
  • Like
Reactions: MaXz
Malnutrition said:
Hmmm, all registry keys have been replaced. It is still not starting, we may need to perform a repair install but lets check and make sure I did not miss anything first.

Download Malwarebytes v.4 . Install and run.

  • Once the MBAM dashboard opens, click on Settings (gear icon).
  • Click on Security tab and make sure that all four Scan options are enabled.
  • Close Settings and click on the Scan button on the dashboard.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT button and save the file as a Text file to your desktop.
  • If there were detections then once the quarantine has completed click on the View report button, then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and include that log on your next reply.
ZHP Diag Scanner.

Download ZHP Suite to your desktop.
Right Click Run as admin.
Hit the scanner button.
Once it is complete a file name ZHPdiag.txt will be on your desktop.
Attach it.
Click to expand...
 

Attachments

@MaXz Sorry for the delay. The Log I requested takes time to go over. :)

Please for now, uninstall malwarebytes.

Download AV block remover .
Unzip to your desktop, Right click run as admin and follow the instructions. If it does not start, rename the AVbr.exe file to, for example, AV_br.exe
Click yes to reset hosts file.
After the machine reboots then there will be a logfile in the new folder created, post that please.


Copy the content of the code box below.
Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.


Code: 
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
DeleteKey: HKCU\SOFTWARE\153f8ce0-b97a-575b-ba12-4ff8b1481894
DeleteKey: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\SOFTWARE\153f8ce0-b97a-575b-ba12-4ff8b1481894
DeleteKey: HKLM\Software\Classes\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}
DeleteKey: HKCU\SOFTWARE\nwjs
DeleteKey: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\SOFTWARE\nwjs
DeleteValue: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\ozaga\AppData\Local\Updates\WindowsService.exe
DeleteValue: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\ozaga\AppData\Local\Updates\WindowsService.exe
VirusTotal: C:\WINDOWS\System32\drivers\RoutePolicy.sys
File: C:\WINDOWS\System32\drivers\RoutePolicy.sys
CMD: gpupdate /force
cmd: DISM.exe /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
cmd: winmgmt /salvagerepository
cmd: winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"
CMD: sc stop sysmain
CMD: sc config sysmain start= disabled
CMD: sc stop DiagTrack
CMD: sc config DiagTrack start= disabled
CMD: sc stop dmwappushservice
CMD: sc config dmwappushservice start= disabled
CMD: sc stop WSearch
CMD: sc config WSearch start= disabled
CMD: sc stop lfsvc
CMD: sc config lfsvc start= disabled
CMD: del /s /q %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
CMD: echo "" > %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
CMD: WMIC SERVICE WHERE Name="windefend" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="wscsvc" set startmode="auto"
CMD: net start windefend
CMD: net start wscsvc
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000002
EndRegedit:
emptytemp:
Reboot:
End::
 
Malnutrition said:
@MaXz Sorry for the delay. The Log I requested takes time to go over. :)

Please for now, uninstall malwarebytes.

Download AV block remover .
Unzip to your desktop, Right click run as admin and follow the instructions. If it does not start, rename the AVbr.exe file to, for example, AV_br.exe
Click yes to reset hosts file.
After the machine reboots then there will be a logfile in the new folder created, post that please.


Copy the content of the code box below.
Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.


Code: 
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0
DeleteKey: HKCU\SOFTWARE\153f8ce0-b97a-575b-ba12-4ff8b1481894
DeleteKey: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\SOFTWARE\153f8ce0-b97a-575b-ba12-4ff8b1481894
DeleteKey: HKLM\Software\Classes\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}
DeleteKey: HKCU\SOFTWARE\nwjs
DeleteKey: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\SOFTWARE\nwjs
DeleteValue: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\ozaga\AppData\Local\Updates\WindowsService.exe
DeleteValue: HKU\S-1-5-21-3989784722-1943139329-1569411945-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache|C:\Users\ozaga\AppData\Local\Updates\WindowsService.exe
VirusTotal: C:\WINDOWS\System32\drivers\RoutePolicy.sys
File: C:\WINDOWS\System32\drivers\RoutePolicy.sys
CMD: gpupdate /force
cmd: DISM.exe /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
cmd: winmgmt /salvagerepository
cmd: winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"
CMD: sc stop sysmain
CMD: sc config sysmain start= disabled
CMD: sc stop DiagTrack
CMD: sc config DiagTrack start= disabled
CMD: sc stop dmwappushservice
CMD: sc config dmwappushservice start= disabled
CMD: sc stop WSearch
CMD: sc config WSearch start= disabled
CMD: sc stop lfsvc
CMD: sc config lfsvc start= disabled
CMD: del /s /q %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
CMD: echo "" > %ProgramData%\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
CMD: WMIC SERVICE WHERE Name="windefend" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="wscsvc" set startmode="auto"
CMD: net start windefend
CMD: net start wscsvc
StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000002
EndRegedit:
emptytemp:
Reboot:
End::
Click to expand...
 

Attachments

Figured out the problem.

Registry ====> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc <==== Access Denied
Registry ====> ERROR: Error accessing the registry.




I’ll write a script to repair the permission on this key when I get home. Then security center will start for sure.
 
  • Like
Reactions: MaXz
We must run FRST via Run-X to set the permissions straight for the registry.


RunX

Current version: 1.0.0.1 Released May 19th, 2021 (fixed a bug with launching processes in general d7x code as explained here.) RunX is designed to easily launch any process with System account or…
www.d7xtech.com www.d7xtech.com
Download RunX unzip to your desktop.
Make sure that FRST64 is also there.
Make sure they are side by side on your desktop.
Drag and drop FRST64.exe onto the RunX App.



1691859100564.png



Copy the content of the code box below.
Do not copy the word code!!!
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.


Code: 
Start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
SetDefaultFilePermissions: C:\Windows\regedit.exe
SetDefaultFilePermissions: C:\Windows\System32\nsisvc.dll
SetDefaultFilePermissions: C:\Windows\System32\Drivers\nsiproxy.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\afd.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\tdx.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\tcpip.sys
SetDefaultFilePermissions: C:\Windows\System32\dnsrslvr.dll
SetDefaultFilePermissions: C:\Windows\System32\dnsapi.dll
SetDefaultFilePermissions: C:\Windows\SysWOW64\dnsapi.dll
SetDefaultFilePermissions: C:\Windows\System32\mpssvc.dll
SetDefaultFilePermissions: C:\Windows\System32\bfe.dll
SetDefaultFilePermissions: C:\Windows\System32\Drivers\mpsdrv.sys
SetDefaultFilePermissions: C:\Windows\System32\SDRSVC.dll
SetDefaultFilePermissions: C:\Windows\System32\vssvc.exe
SetDefaultFilePermissions: C:\Windows\System32\SecurityHealthService.exe
SetDefaultFilePermissions: C:\Windows\System32\wscsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\wbem\WMIsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\wuaueng.dll
SetDefaultFilePermissions: C:\Windows\System32\qmgr.dll
SetDefaultFilePermissions: C:\Windows\System32\es.dll
SetDefaultFilePermissions: C:\Windows\System32\cryptsvc.dll
SetDefaultFilePermissions: C:\Program Files\Windows Defender\MpSvc.dll
SetDefaultFilePermissions: C:\Windows\System32\ipnathlp.dll
SetDefaultFilePermissions: C:\Windows\System32\iphlpsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\svchost.exe
SetDefaultFilePermissions: C:\Windows\System32\rpcss.dll


StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000002
EndRegedit:

CMD: gpupdate /force
CMD: WMIC SERVICE WHERE Name="windefend" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="wscsvc" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="windefend" CALL startservice
CMD: WMIC SERVICE WHERE Name="wscsvc" CALL startservice
CMD: del /s /q "%userprofile%\AppData\Local\temp\*.*"
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
emptytemp:
Reboot:
End::
 
Last edited:
Malnutrition said:
We must run FRST via Run-X to set the permissions straight for the registry.


RunX

Current version: 1.0.0.1 Released May 19th, 2021 (fixed a bug with launching processes in general d7x code as explained here.) RunX is designed to easily launch any process with System account or…
www.d7xtech.com www.d7xtech.com
Download RunX unzip to your desktop.
Make sure that FRST64 is also there.
Make sure they are side by side on your desktop.
Drag and drop FRST64.exe onto the RunX App.



1691859100564.png



Copy the content of the code box below.
Do not copy the word code!!!
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.


Code: 
Start::
CreateRestorePoint:
CloseProcesses:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
SetDefaultFilePermissions: C:\Windows\regedit.exe
SetDefaultFilePermissions: C:\Windows\System32\nsisvc.dll
SetDefaultFilePermissions: C:\Windows\System32\Drivers\nsiproxy.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\afd.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\tdx.sys
SetDefaultFilePermissions: C:\Windows\System32\Drivers\tcpip.sys
SetDefaultFilePermissions: C:\Windows\System32\dnsrslvr.dll
SetDefaultFilePermissions: C:\Windows\System32\dnsapi.dll
SetDefaultFilePermissions: C:\Windows\SysWOW64\dnsapi.dll
SetDefaultFilePermissions: C:\Windows\System32\mpssvc.dll
SetDefaultFilePermissions: C:\Windows\System32\bfe.dll
SetDefaultFilePermissions: C:\Windows\System32\Drivers\mpsdrv.sys
SetDefaultFilePermissions: C:\Windows\System32\SDRSVC.dll
SetDefaultFilePermissions: C:\Windows\System32\vssvc.exe
SetDefaultFilePermissions: C:\Windows\System32\SecurityHealthService.exe
SetDefaultFilePermissions: C:\Windows\System32\wscsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\wbem\WMIsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\wuaueng.dll
SetDefaultFilePermissions: C:\Windows\System32\qmgr.dll
SetDefaultFilePermissions: C:\Windows\System32\es.dll
SetDefaultFilePermissions: C:\Windows\System32\cryptsvc.dll
SetDefaultFilePermissions: C:\Program Files\Windows Defender\MpSvc.dll
SetDefaultFilePermissions: C:\Windows\System32\ipnathlp.dll
SetDefaultFilePermissions: C:\Windows\System32\iphlpsvc.dll
SetDefaultFilePermissions: C:\Windows\System32\svchost.exe
SetDefaultFilePermissions: C:\Windows\System32\rpcss.dll


StartRegedit:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000002
EndRegedit:

CMD: gpupdate /force
CMD: WMIC SERVICE WHERE Name="windefend" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="wscsvc" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="windefend" CALL startservice
CMD: WMIC SERVICE WHERE Name="wscsvc" CALL startservice
CMD: del /s /q "%userprofile%\AppData\Local\temp\*.*"
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
emptytemp:
Reboot:
End::
Click to expand...
 

Attachments

Time for a repair install. Everything has been replaced and even the services are started... Still not working tho.

www.tenforums.com

Repair Install Windows 10 with an In-place Upgrade

How to Do a Repair Install of Windows 10 with an In-place Upgrade
www.tenforums.com www.tenforums.com

www.elevenforum.com

Repair Install Windows 11 with an In-place Upgrade

This tutorial will show you how to do a repair install of Windows 11 by performing an in-place upgrade without losing anything. If you need to repair or create a new recovery partition or having problems with the Windows 11 operating system on your PC, and the usual solutions will not fix it...
www.elevenforum.com www.elevenforum.com
 
Malnutrition said:
Time for a repair install. Everything has been replaced and even the services are started... Still not working tho.

www.tenforums.com

Repair Install Windows 10 with an In-place Upgrade

How to Do a Repair Install of Windows 10 with an In-place Upgrade
www.tenforums.com www.tenforums.com

www.elevenforum.com

Repair Install Windows 11 with an In-place Upgrade

This tutorial will show you how to do a repair install of Windows 11 by performing an in-place upgrade without losing anything. If you need to repair or create a new recovery partition or having problems with the Windows 11 operating system on your PC, and the usual solutions will not fix it...
www.elevenforum.com www.elevenforum.com
Click to expand...
before proceding with this step, is there any way I can keep windows.old in case I wanted to go back to w10 in the future?
 
There are steps for windows 10 repair. I edited my post. This is just a repair, you lose no files. You could try and create a new user and see if security center works there, We could just be dealing with profile corruption because all of the virus has been removed and services are intact
 
Malnutrition said:
There are steps for windows 10 repair. I edited my post. This is just a repair, you lose no files. You could try and create a new user and see if security center works there, We could just be dealing with profile corruption because all of the virus has been removed and services are intact
Click to expand...
Also should I delete the frst and fss app since it says delete any AV or security program?
 
As long as you do the instructions for the repair install you were not replacing your operating system you are just repairing it, it is always a good idea to make it back up. As far as any security program just make sure you delete Malwarebytes.
And rogue killer
 
Status
Not open for further replies.
Top Bottom