Solved Why is Win XP Security Center service listed in French?

January 29, 2015 at 08:52:04
Specs: Windows XP, P4-3.2HT/ DDR-400
Two services appear in French text in Services.
Windows Security Center - wscsvc.dll
Automatic Updates - wuauserv.dll
per the French translations.
Control Set 001, 003, Current - in French
However Control Set004 is correct, in English.

Could it be trickery, the user sees the French text, then disables these security services?


See More: Why is Win XP Security Center service listed in French?

Report •


✔ Best Answer
March 7, 2015 at 15:56:47
Extracting the SOLUTION from two long responses:

Windows Update was given a security update in 2012 in response to the Flame virus.

I will try the Microsoft Windows Update Fix-it (in response to to above threat) http://support.microsoft.com/kb/971058

I recommend that MS Fix-It highly. If the registry edits were done incorrectly, the Fix-It deletes them. After several passes Microsoft Update works and the computer is not slowed to a crawl anymore.

Note I didn't try the Fix-it on the French language versions, only after replacing those in the registry.

message edited by Macorama



#1
January 29, 2015 at 21:09:28
I had a similar problem--maybe for the same reason--recently. Whenever I'd go to one of the support.microsoft.com pages they'd open in German. The fix for that is to click on the globe icon in the lower left corner of the page. Then select 'region' and 'language' from the box that opens. It remembers the changes and the pages open correctly after that.

Possibly some of those pages were set to French and you downloaded some French files.


Report •

#2
February 2, 2015 at 18:34:12
Regional and Language Options set to English, no Alt Languages.
Now Windows Firewall / Internet Connection Sharing service is listed in French, along with Background Intelligent Transfer Service.
Firewall/ICS service shares a svchost.exe with 12 other basic services.

What is going on here?
ESET Smart Security, ESET ERARemover, Microsoft Support Emergency Response Tool (msert), SuperAntiSpyware, BitDefender Rescue CD, Malwarebytes Anti Rootkit (mbar), TDDSKiller, AdwareCleaner find NOTHING.

Permissions were flagged by Bel-Arc Security Advisor..

message edited by Macorama


Report •

#3
February 2, 2015 at 20:37:09
My response above was not about the 'regional and language settings' or possible malware.

Try this: Go to START--WINDOWS UPDATE. When the MS page opens go to 'change settings' under 'options'. It explains there about downloading stuff in other languages. Make sure 'english' is checked there.

That may not be your problem but you ought to check it.


Report •

Related Solutions

#4
February 4, 2015 at 14:06:40
What "globe"?
I would think Windows Update would check the installed Windows XP language version, via the process winver.exe
Microsoft Windows Update - Settings is just for the screen display language.
If XP SP3 was somehow updated with the wrong language versions, the actual files in Windows\system32 should be the French versions.
1..bitsprx4.dll = BITS 2.5 Proxy (English USA)
2. qmgr.dll = BITS (English USA)
etc for the others
3. winver.exe = Windows Version Reporter (English USA)

I may not even need these Services anyway, with the Windows Firewall is replaced by my Anti-Virus.

message edited by Macorama


Report •

#5
February 4, 2015 at 18:52:10
"Microsoft Windows Update - Settings is just for the screen display language" Not the way I read it "Windows Update displays Web pages in the same language you use to view Windows." (Different use of the word 'display') But you might be right as I haven't tried changing any of that.

All I can say is sometime in the past some french language files got installed. That might be corrected with further updates, if any are available, or maybe a system restore from before you noticed the problem.

You initially suspected malware. I don't know if you've run any scans but you might try malwarebytes:

https://www.malwarebytes.org/downlo...

Download the first option there--the free one. They also have the pay version and a free trial of the pay version. When you run it I think it asks about upgrading to the trial version. Don't do that. Just see if the free version finds anything. Then see if it turns up anything. A lot of malware can slip throiugh your AV.


Report •

#6
February 9, 2015 at 07:23:10

Hello Macorama,

I'm having the exact same issue. The following 4 services are in french, same version of WinXP.

Mise a jour automatique = Automatic Updates
Centre de securite = Windows Security Center service (wscsvc.dll).
Pare-feu Windows / Partage de connexion Internet = Windows Firewall / Internet Connection Sharing
Service de transfert intelligent en arricre-plan = Background Intelligent Transfer Service

One difference is that in my registry, Control Set 001 is correct and the others are in french. Also, I was noticing that my internet connection seemed to be lagging and found out Windows Firewall re-enabled itself even though it was disabled, and I was using two firewalls simultaneously. I have not used Windows Firewall in over a decade and have been using Comodo Firewall for about 8-9 years now. I do not use Windows Update/Automatic Updates either.(disabled)

I was poking around Event Viewer and I found this in the Security tab:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 849
Date: 1/31/2015
Time: 8:20:09 PM
User: NT AUTHORITY\SYSTEM
Computer: XXXXXX
Description:
An application was listed as an exception when the Windows Firewall started.

Policy origin: Local Policy
Profile used: Standard
Name: Logiciel de transfert de fichiers
Path: C:\WINDOWS\system32\ftp.exe
State: Enabled
Scope: All subnets

Notice how the name (Logiciel de transfert de fichiers) is in French? In The system32 folder, the ftp.exe program is the correct English version. I wonder if this is some sort of backdoor way of installing malware via the ftp ports? In my Comodo firewall log, I see IP addresses trying to access port 21. Fortunately, these IP addresses were blocked.

I would disable the 4 services if you haven't, until we can find a solution. Have you tried System Restore yet? I have, and all my restore points fail.


Report •

#7
February 11, 2015 at 11:27:47
I should start from the beginning: No Windows Audio, not even the beeps, so I did a System Restore, and started having issues - Windows Components unchecked.
DNS service was steady at 50% CPU.
Stopped DNS and checked Services, now seeing two in French.

Issues:
- System Restore points now gone.
- Four services listed in French
- ODBC Administrator lists many drivers in French
- Firefox icon reappeared 3 times in a few days.
- DNS issue gone.
- wuauserv.dll and wscsvc.dll were modified 3 hours ago, not 2008 (SP3)

DID so far:
- Disabled all four services and deleted them.
- the first two, I also deleted from system32 and dllcache.
Reboot replaces them from my SP3 \I386 on C:
- Registry search via Windows Registry Repair Pro, looking for first two in odd places.
- SFC scan
- Install all four services in English from a "good" Registry.
(Last full Registry backup - Nov 2012)
- Disabled all four services because do not even need them for XP!
1 Automatic Updates: can get the Windows Malware Scanner update directly.
2. Windows Firewall/ ICS is just for 56k modem dial-up home networks.
3. BITS is for background server-client transfers (Window Update)
4. Windows Security Center - do not need it, IF:
-Firewall is via a security program
-No Automatic Updates
-Internet Options are only for IE8, just use that.
should not use IE8 at all anyways, zero updates for 9 months.

message edited by MacGruber


Report •

#8
February 11, 2015 at 19:06:17
So three different posters in this thread have noticed some files and/or settings in french? I assume one of you is this person:

http://answers.microsoft.com/en-us/...

Unfortunately there's no suggestions there yet.

I find it odd they're all french but then maybe that was a google search term that led two of you here. You happened to notice the files/settings when diagnosing a problem but that doesn't mean they were part of the problem. That is, you may have had the french files for quite a while and just noticed them recently.

I haven't found any references to french files being indicative of a virus or malware on an english system but it could be some rare condition that doesn't show with a million google hits. Besides, any scans you've run haven't turned up any infections. So until someone wiser than me comes along and clears it up I still think it's because you've unknowingly installed either updates, drivers or software that had some french components.


Report •

#9
February 12, 2015 at 10:16:38
Update:

1. Some ODBC files are in French.

2. Mozilla Firefox icon appeared on desktop even though I NEVER check the option to put shortcut on desktop during an install of the browser.

3. None of the files pertaining to these 4 services have been changed; they are all 2008 SP3 files.

4. All 4 of these services were re-enabled with French names and descriptions even though I have had them disabled through multiple installs of XP over the past 10 years or so.

4. All system restore points fail.

5. I used my own registry hacks to get the services listed in English again.

6. A possible "French Connection". Shortly before I noticed this issue, I had downloaded and used an Anti-Malware program called "Rogue Killer". This is put out by Aldice Software and they are French developers. It seems like a legit program; they have a website and forum where they help with malware removal. One file put on my system by Rogue Killer is "TruSight.sys" which is located in System32\Drivers. It is an Anti-Rootkit Module, but the language is listed as "French" in the file properties. Don't think it's a virus/malware, but some websites indicate that it is.

So, did anyone here experiencing this issue install/use Rouge Killer before noticing this problem? Maybe it's a bug/glitch in the program.

message edited by navinrjohnson


Report •

#10
February 12, 2015 at 15:44:40
DAVEINCAPS:
Yes I asked in Microsoft Answers, I'll have to move it to Technet.

I now see that all four services have to do with Microsoft Windows Updates, with one only for dial-up connections. The minutes wasted waiting on these at bootup over the years.

Windows Updater = wuauclt.exe
I noticed that Windows/system32 has 18 windows update related files
"wu - etc." System32\dllcache has 10 of them stored. It appears an update to the Updater took place in 2012. After the Windows Search 4 (via Auto Updates) fiasco I never trusted it anyways.

Even if IE8 or the Update service language was set to French it isn't now.

navinrjohnson:
Yes I too have that Aldice file "TrueSight.sys" installed, modified after I noticed the language issue.

I will try the Microsoft Windows Update Fix-it at
http://support.microsoft.com/kb/971058

message edited by MacGruber


Report •

#11
February 12, 2015 at 21:20:17
Yeah truesight.sys is part of rogue killer. References to it being possible malware are I think because it comes up in scans as an unknown and therefore to be suspect. It's interesting that both of you have that file. That probably explains part of the mystery but it doesn't seem like it would have anything to do with updates or any of the other processes that seem to be using french files.

Report •

#12
February 15, 2015 at 12:24:23
Correction: never mind about "ODBC Drivers listed in French": Seven are in Portugese. Five are in German. Some are only evident by "Driver do Microsoft Excel" or "Microsoft Paradox-Treiber". I did say my newer PC with the identical XP SP3 Pro had the same multi-language descriptions noted.

I recommend that MS Fix-It highly. If the registry edits were done incorrectly, the Fix-It deletes them. After several passes Microsoft Update works and the computer is not slowed to a crawl anymore.

However on both Dells I now notice that Microsoft Update update description link to the update KB article now
FAILS to connect to www.support.microsoft.com.
The normal temporary display of "https://login.live.com/login...etc" hangs up - from the link in IE8 - Microsoft Update update descriptions.

Windows Update logs. I checked "Review your update history" with the oldest entry Feb. 13.
C;\WINDOWS\WindowsUpdate.log goes back 20 days though.
That contains mostly - "Unable to connect to the Service" errors, along with this from Feb. 10:
"WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.windowsupdate.com/v9/1/windowsupdate/redir/muv4wuredir.cab>. error 0x8024402c" ,

Windows Update was given a security update in 2012 in response to the Flame virus - if checking file versions.

message edited by Macorama


Report •

#13
March 7, 2015 at 15:56:47
✔ Best Answer
Extracting the SOLUTION from two long responses:

Windows Update was given a security update in 2012 in response to the Flame virus.

I will try the Microsoft Windows Update Fix-it (in response to to above threat) http://support.microsoft.com/kb/971058

I recommend that MS Fix-It highly. If the registry edits were done incorrectly, the Fix-It deletes them. After several passes Microsoft Update works and the computer is not slowed to a crawl anymore.

Note I didn't try the Fix-it on the French language versions, only after replacing those in the registry.

message edited by Macorama


Report •

#14
March 22, 2015 at 21:28:32
Was anyone flummoxed by #7? - MacGruber also happens to be Macorama here. Sorry about that.
Just to view Update Notifications, no need for BITS, Remote Registry, Security Center and Windows Firewall/ICS, so just disable all of them along with removing Internet Explorer from Windows Components (uncheck).

message edited by Macorama


Report •


Ask Question