What Is Wscfix.exe And How Is It Supposed To Behave?

willbldrco

Hi Experts,

I had malware issues on my Windows7 PC and decided to try BitDefender to recover from it. In the end, I couldn't save my OS and since I had a backup of my critical data, I decided to simply install a new PC and restore my data.

I've installed a fresh copy of Window7 on a different PC, performed Windows system updates until there were no more to do, and then installed my newly purchased copy of BitDefender Antivirus 2012 and performed an update so I'd have the latest virus catalog. I had the hard disk from my former PC which I suspected had malware on it so I plugged it into my newly built system's second disk bay and ran BitDefender in "Rescue mode" (rebooted into the linux kernel and did a full system scan). I removed all the files from the second disk that BitDefender found offensive, rebooted the box and started BitDefender in Rescue Mode again. BitDefender found no issues with the system.

I then rebooted the system back into Windows7 and noticed that Windows Action Center had a red X on it in the toolbar which was not present before. I saw the following warnings via Action Center:

- "Windows Defender and Bitdefender Antispyware both report that they are turned off"

- "Bitdefender Antivirus reports that it is turned off"

Opening the BitDefender desktop shortcut, the program loads, I see that autopilot is on. Through the Windows Action Center toolbar icon with the red X, there is a link, "Turn on Bitdefender Antivirus (Important)." When I click on that, I get an Action Center pop-up which gives the following options:

"Do you want to run this program?

Publisher: BitDefender SRL

Program: C:\Program Files\Bitdefender\Bitdefender 2012\wscfix.exe

- Yes, I trust the publisher and want to run this program

- No, I would like to verify the identity of the publisher before running this program"

Clicking the second link provides some cert info that, in my opinion, could be easily spoofed. I don't want to try the first option until I hear back from the experts on this forum, especially after reading this post concerning wscfix.exe.

Why, on a clean Windows7 install, with BitDefender being the only other software installed, would I get Action Center warnings about antivirus software being during off (in contradiction to Bitdefender who says it's on)?

What is wscfix.exe for and what does it do? Is it true that if I run it from the Action Center link it will "do nothing" as reported in the post I link to above? If so, that's not very reassuring.

Is it expected that Windows Action Center will report that Windows Defender is turned on on PCs running BitDefender?

I want to be confident that Bitdefender is indeed running, reliable, and uncorrupted on my newly built PC. If it is operating correctly, why Windows7 Action Center thinks it is not?

I'd greatly appreciate answers to these questions from the BitDefender experts on this forum!

Regards,

Will

rootkit

Hello

Welcome to our forums.

wscfix.exe was design to establish a connection between our product and Windows Action Center / Windows Security Center.

That is a valid file as you can see, it is digitally signed.

Please follow the steps explained in the article below and send me via PM the generated log file:

http://forum.bitdefender.com/index.php?showtopic=29927

If you were already asked to generate the log file, disregard the message above and just post the ticket ID.

Thank you.

willbldrco

Thanks Christian! PM sent.

Regards,

Will

rootkit

Hi

In order to be able to properly identify the causes for the reported situation and find a solution we will need to investigate a bit deeper.

Please follow the steps below and send us the result:

a ) Go to this page

http://technet.microsoft.com/en-us/sysinte...s/bb963902.aspx and download the autoruns file.

b ) Extract the contents of the downloaded file and run the 'autoruns.exe' file;

c ) Wait for the list to be filled with all the processes and then make sure that you have the Everything tab selected in the upper part;

d ) Click on the Disk icon right under File and chose any location folder on your computer;

e ) Save the file with a specific name (your name, computer name, a random name, which one you want) and then send me a PM with it.

If the file is too big to attach it, upload it on

http://www.sendspace.com

or

http://www.mediafire.com

and send me a PM with the download link.

We will analyze the information you sent and then reply with a possible solution in the shortest time.

Have a nice day.

willbldrco

Hi

In order to be able to properly identify the causes for the reported situation and find a solution we will need to investigate a bit deeper.

Please follow the steps below and send us the result:

Thanks for the response, Christian. I no longer need help tho - I rebuilt my PC.

Regards,

Will

rootkit

Hi Will

Thank you for your feedback.

Since the issue was resolved, I declare this topic closed.

Take care.