Windows Security Center - Virus??

[Baasha]

Earlier today, I was doing some work on my computer when a message came up on the task-bar saying my Windows Security Center Service was not turned on. When I clicked it, there was an error saying "Windows Security Center Service Cannot Be Turned On".

I then went in manually to Windows>Run>services.msc and then found the Windows Security Center service. I double-clicked it and it said it was disabled. I then set it to "Automatic" and then clicked "Start" to start the service. It seemed to be fine.

Soon after, I got another message saying there was no anti-virus/anti-malware software installed; I have Norton 2011 installed on my system so I was really confused.

I restarted the computer, and again, I got this "Windows Security Center Service" message.

I ignored it for a while. After coming home in the evening, I turned my PC back on and now, when I click the "Windows" icon (Start button), All my pinned icons/programs have disappeared! My RAM usage is 32% when I'm just typing this message and have no other programs running.

The real shocker is that I clicked Ctrl+Alt+Delete to run Task Manager and there was no such option available! I then tried to type Task Manager in the Search window and I got an error message saying, "Task Manager has been disabled by your administrator!" I AM the administrator and only user of my PC!

This is a pretty clear symbol, IMO, that my PC has been infected by some virus.

I did a bit of research online about this "Windows Security Center" nonsense and found nothing substantial. I did, however, find a folder in my C drive called 'system32' (NOT the one in the C:\Windows\ folder) which contains a single executable called 'winlogon.exe'. This executable shows the 'Date Modified' as 2/16/2011 whereas the other winlogon.exe, which is in the C:\Windows\System32 folder, shows the date from 2007 (?).

I find it really strange *another* system32 folder is found OUTSIDE of the Windows folder. I don't remember to have ever seen it there but I am not 100% sure.

Is this the virus? If so, how do I fix my system?

If not, how do I go about fixing this Windows Security Center service 'virus'?

This is really frustrating as my PC was perfectly fine this morning!

If someone can advise/help me, I'd appreciate it.

Thanks in advance.

 

[Kalmah]

I would start by downloading and running the free version of malwarebytes.

Don't forget to do the update before you run it.

 

[Texashiker]

Looks like a malware infection - most anti-virus programs will not protect against malware/spyware/scareware/popupware,,,,,,,,,.

combofix from bleepingcomputer.com and malwarebytes from download.com should fix you up.

I like to run combofix first, and then run malwarebytes, but that is just my personal preference.

 

[Baasha]

I ran MalwareBytes and the "weird" winlogon.exe in the C drive (not the one in system32) was indeed a virus.

The winlogon.exe has been removed however I still get the "Windows Security Center" service message (needs to be turned on)?!? WTF?

And, I just looked in task manager, and there are 11 instances of chrome.exe *32 running! WTF? I do have 9 tabs open. Is each tab a different process? And why does it say chrome.exe *32? Is it a 32-bit program?

 

[Ketchup]

Yes, each tab has it's own process. It's called a 'feature.'

 

[ZeroRift]

If something was able to hijack winlogon.exe, then you'll want to use some beefier methods to make sure your system is clean....

I would run Malwarebytes from safemode and see if that turns up anything else. I would also consider burning an offline scan CD like this one and see if it can't clean anything else up.

On the more manual front, I would consider running HijackThis or autoruns if you're somewhat comfortable with the registry.