Solved Strange problem with Windows Action Center

[truoc]

Hi all I am having a strange problem with Windows Action Center in Windows 8. When I first installed Windows 8 everything worked fine, but I've since tried a few different security products. I've had Avast 7 free on the computer, and Norton Security Suite (Norton 360 basically) on the computer not at the same time of course, but have decided to go back to default Windows defender that comes with Windows 8 even though I know it doesn't offer the best protection out there. Like I said I had Avast 7 free on the computer and when I uninstalled it I used the awsclear.exe file in safe mode to uninstall it. Then I chose to install Norton Security Suite because I get it free through Comcast. Didn't really have a problem with it, but want to go back to the default that came with Windows 8. So I uninstalled the Suite via Control Panel, restarted the computer then downloaded and ran the Norton Removal tool. Here is what is wrong. The windows action center reports that my antivirus protection is turned off which is correct because Norton turned off Defender like it is supposed to. The problem is that when I click Turn On Antivirus protection it doesn't turn it on, but instead opens the Windows\System32 folder. I am at a loss as to why it is doing this.

Things I have tried:
ran sfc /scannow via command prompt - no errors found
ran malwarebytes anti-rootkit - nothing found
ran tdss killer - nothing found
ran full scan of emsisoft antimalware - nothing found
ran full scan of eset online scanner - nothing found
tried the net stop mgmt command via command prompt to no avail

currently i'm running a scan with kaspersky rescue disk, but it would seem this isn't a virus issue (didn't think it was to begin with, but you never know). Anyone have any ideas or had something similar happen? I really don't want to have to reinstall Windows just to get Defender to work again. One thing I should note that is kind of odd is that every time I run Norton Removal tool it asks me to restart the computer. Does this mean it continues to find things and I should run it until it doesn't ask me to restart or is that normal behavior? I'm pretty much open to any and all suggestions at this point. Thanks for sticking with me and reading this.

 

[Exterminator]

Norton is infamous for being hard to get rid of on uninstall.Norton and windows defender dont coexist which is why it shut down defender.The use of programs like revo Uninstaller or iobit Uninstaller work well to uninstall the program and all traces leftover.Since you have already uninstalled these its too late.The restart is normal behavior.Did you try system restore to a restore point before you installed Norton or avast?

 

[truoc]

Norton is infamous for being hard to get rid of on uninstall.Norton and windows defender dont coexist which is why it shut down defender.The use of programs like revo Uninstaller or iobit Uninstaller work well to uninstall the program and all traces leftover.Since you have already uninstalled these its too late.The restart is normal behavior.Did you try system restore to a restore point before you installed Norton or avast?

Nah I haven't tried a system restore, trying to avoid that too if at all possible. Do you think if I reinstalled Norton and used Revo to uninstall again it then it would get rid of all traces? Trying to exhaust all options before I take too drastic of a step. Thanks for the help.

 

[Exterminator]

system restore is not the same as a clean install.With System restore you can go back in time if you will,your files and documents are not lost.If you have a restore point say before you installed norton and do a system restore your PC will be as it was before you installed Norton.You can try that or you could reinstall Norton and then uninstall and run the Norton removal tool again.It might be that something is left over from Norton that is preventing you from running defender.Make sure you are familiar with Revo uninstaller before using it especially when deleting leftover registry items.The items to be removed are those in Blue.Even if you use revo uninstaller I would run the removal tool again after uninstalling.I would personally try system restore first,that is if you have it turned on and have a restore point to go back to

 

[Ramblin]

A few years ago I had a strange situation with action center, the solution was to delete a file that keeps information (don't remember the name) about action center, after a reboot, the file was recreated and action center worked properly.

I searched a little but cant remember what file it was. I found some links on how to reset action center. Maybe that will work for you but I don't know.

As far as I know, you uninstalled Norton properly. My W7 came with Norton, the first thing I did after the first boot was uninstall it. I did what you did and it worked just fine. Norton uninstalled properly.

I don't use uninstallers as I don't trust them. I think doing a system restore is less drastic than reinstalling Norton, installing a uninstaller and uninstalling Norton again.

Bo

 

[Exterminator]

Can you run defender at all ? besides from the action center.You will get a message in Action Center after uninstalling Antivirus.Did you check to see if you can still run windows defender?Windows defender and firewall might be turned off still from the install of Norton and need to be enabled again

 

[truoc]

Can you run defender at all ? besides from the action center.You will get a message in Action Center after uninstalling Antivirus.Did you check to see if you can still run windows defender?Windows defender and firewall might be turned off still from the install of Norton and need to be enabled again

That is the exact problem. Action center is saying that Defender is turned off and needs to be turned on, but when I click to turn it on in Action Center it takes me to the System32 folder for some unknown reason and doesn't turn it on. I just tried reinstalling the Norton Security Suite and using Revo to uninstall it. It uninstalled it, but wouldn't let me select any registry entries to delete. I did run the Norton Removal Tool 4 times after that, restarting after each time it asked me to and I'm still getting the same problem. I'm going to try installing Avast again, uninstalling it through the Control Panel and then using awsclear.exe in safe mode to ensure it is gone. I'll post back once I do that real quick.

 

[Jack]

Hello truoc,
Did you check if Windows Defender is enabled in the Windows Services?
Type Services.msc in the run box and search for Windows Defender service, is it set to Automatic?

 

[truoc]

Well I just tried reinstalling Avast then uninstalling it from Control Panel then using the awsclear.exe Avast uninstall tool in safe mode and still same issue.

Hello truoc,
Did you check if Windows Defender is enabled in the Windows Services?
Type Services.msc in the run box and search for Windows Defender service, is it set to Automatic?

Yeah I did and it is strange. It is not turned on. Startup type is set to Manual. I try to start it and get this error:

Services
The Windows Defender Service service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.


I have tried to set Startup type to Automatic and restart the computer, but after the computer boots back up and I recheck it, it is set back to Manual and the service isn't started. Seems I am going to have to do a System Refresh or go back to a different restore point if there aren't any other suggestions. I appreciate all of your help and if you have any other suggestions, please throw them my way. It is pretty late right now so I'm not going to Refresh or Restore the PC tonight so I will leave time for other suggestions before I do so.

 

[Jack]

What security products do you have installed on this machine?

 

[truoc]

What security products do you have installed on this machine?

No AV's since I've been trying to go back to default Windows Defender in Windows 8. Other programs that are installed are Malwarebytes (free version), Superantispyware (free), Zemana AntiLogger free, EMET, Panda Security URL Filtering, LastPass, WOT.

 

[Exterminator]

That is a common problem whether it was due to avast or norton.I would try System Restore,that is if you have a restore point before installation of avast and or norton.In search bar type restore point,then click settings.Click the result create restore point.Then system restore.window will pop up click next and you will see all the restore points that you can restore tbviously you will have a restore point from revo uninstaller which creates a restore point prior to uninstallation.If you have one before norton or avast installation click and restore to that

 

[madyrocksin]

i think,
your windows system32 folder is getting opened because action center cannot find windows defender,
i would first try to re-install defender and then look further

 

[Deleted member 178]

not to say Win8's Windows Defender aka MSE is quite buggy, even with EIS + WSA it said they were turned off. but i didn't have the WD issue.

 

[malbky]

IF you get Norton from your ISP use it. Its excellent.
As mady said your location for windows defender is not found or registry keys are corrupted.
Just try this.
Do a cc Cleaner cleanup. Tick all options except wipe freespace. Also do a registry cleanup.
If it is not solved open your registry.
Open HKLM/Current config and current user, in software search for norton and avast keys and delete them. There a few avast keys so look for them.
From MS pls try this.

1. Click "Start", type: "notepad D:\fix.reg" (without the quotes) in the Start Search Bar and press Enter. Choose "Yes" when you are prompted.

2. Copy the following commands between the two ---------- lines (without the lines) and then paste them into the opened Notepad window.



-------------------------------------------------

Windows Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend]

"DisplayName"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-103"

"ErrorControl"=dword:00000001

"Group"="COM Infrastructure"

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,73,00,65,00,63,00,73,00,76,00,63,00,73,00,00,00

"Start"=dword:00000002

"Type"=dword:00000020

"Description"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-3068"

"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00

"ObjectName"="LocalSystem"

"ServiceSidType"=dword:00000001

"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\

00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\

65,00,00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,\

00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,\

74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\

00,00,00,53,00,65,00,44,00,65,00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,\

69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,\

00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,\

6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,\

00,74,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\

00,00

"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\

00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Parameters]

"ServiceDllUnloadOnStop"=dword:00000001

"ServiceDll"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,\

00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,\

20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,6d,00,70,00,73,\

00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Security]

"Security"=hex:01,00,14,80,04,01,00,00,10,01,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,d4,00,07,00,00,00,00,00,28,00,ff,01,0f,00,01,06,00,00,00,00,00,\

05,50,00,00,00,b5,89,fb,38,19,84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,\

00,0b,28,00,00,00,00,10,01,06,00,00,00,00,00,05,50,00,00,00,b5,89,fb,38,19,\

84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,00,00,14,00,fd,01,02,00,01,01,\

00,00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,\

05,20,00,00,00,20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,\

04,00,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,\

00,28,00,15,00,00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,\

e5,55,dc,f4,e2,0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,\

00,01,01,00,00,00,00,00,05,12,00,00,00



[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\Enum]

"0"="Root\\LEGACY_WINDEFEND\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001

And i think i have a doubt on the keys as they look like Windows 7 ones.
See here http://social.technet.microsoft.com/Forums/en-US/w7itprosecurity/thread/642a5e21-2d7f-4122-b26e-811cfe54a89d[/quote]
I thin you miss windows defender entries. I think it must be a bug in windows as when i switch of kaspersky and try to enable windows defender i get the same error.
I think we both are missing the same things.
-The registry keys at the specified location
-The group policy adm file.

LOL a great bug find. Other users please confirm this bug.

 

[Exterminator]

I havent tried Kaspersky on Win 8 Pro but I have tried Avast,which I uninstalled with revo uninstaller without any problems and Eset Smart Security 5 which I uninstalled to run Smart Security 6 RC and had no problems with uninstall of Eset.3rd Party Av's and Security Suites are going to turn off windows 8 defender and windows 8 firewall on install.I have seen the exact same problem as trouc's posted on many sites and most were the result of trying to uninstall Norton and a few with Avast.This occurs even when properly uninstalling Norton including use of Norton removal tool.I can disable both Av & firewall in Eset and in the action center Iam able to turn on both windows defender and windows 8 firewall once I enable these again in eset all windows 8 security turns off again.I would imagine there is a compatability issue with certain Av and security suites more so than a bug in Windows 8.Avira for example will install on windows 8 but it does give you a compatibility warning but will let you proceed at your own risk Not trying to slam Norton but it has been my experience that it is sometimes very hard to get rid of and have seen it cause many problems some which require a clean install of the operating system.

 

[truoc]

Sorry I haven't replied till now, was busy with some stuff. This activity does seems strange and frustrating too. I think what I am ultimately going to do is either just install Norton Security Suite or Avast 7 free again and call it good. I don't really feel like reformatting my PC because I don't have a restore point that is applicable in this situation. So Avast or Norton, which is it? That is the ultimate question. Thanks for all of your help, I appreciate it.

 

[Deleted member 178]

i prefer Avast personally

 

[McLovin]

Go with Avast then over Norton (personal preference). I would also do a backup, once you do have it settled then if something like this screws up again you can just revert back to the backup.

 

[malbky]

You get Norton from Comcast go for it as it all in one.