AVG service won’t start: error 1058 leaves your PC unprotected at boot

Fix it now

Error 1058 is ERROR_SERVICE_DISABLED, published as the service not being startable because it is disabled or has no enabled devices associated with it. When it names an AVG service, your antivirus has not been running at boot. Check the startup type before anything else, then find out what set it.

sc query "<servicename>"
sc config "<servicename>" start= auto
sc start "<servicename>"

1. Open services.msc, find the AVG entries and read the Startup type column. Anything showing Disabled is your answer.
2. Set it to Automatic and start it. Note the space after the equals sign in start= auto; without it the command fails.
3. If it will not start, open Event Viewer, then Windows Logs, then System, and read the Service Control Manager entries around boot time for a more specific reason.
4. Use AVG’s own repair option from its settings, which resets its files and permissions.
5. Restart and confirm the service is running and AVG reports protection as active.

Find out what disabled it. A tuning utility, a policy, a failed uninstall or malware are the realistic candidates, and if you do not find the cause the setting comes back.

If AVG starts on its own after a restart you can stop here. If not, the next section explains what each of the four codes is telling you.

Why it happens

All four of these are Windows system error codes with published text, which makes this one of the more tractable antivirus problems. 1058 is ERROR_SERVICE_DISABLED: the service cannot be started, either because it is disabled or because it has no enabled devices associated with it. That is unambiguous. Something set the start type, and that something is worth finding.

1053 is ERROR_SERVICE_REQUEST_TIMEOUT: the service did not respond to the start or control request in a timely fashion. Note that it covers control requests as well as start requests, so a service that hangs on a stop or a pause reports the same number. That points at something slow or blocked rather than at configuration.

1070 is ERROR_SERVICE_START_HANG: after starting, the service hung in a start-pending state. It is 1053’s near neighbour, one stage further along – the service was launched, told the Service Control Manager it was starting, and then stopped making progress. And error 5 is ERROR_ACCESS_DENIED, “Access is denied”, which on a service means either the account it runs under lost rights, or permissions on its files, registry keys or drivers were changed.

Access denied is the one that arrives on hardened machines. A security baseline or a permissions cleanup script that tightens the wrong tree will stop a security product starting just as effectively as it stops anything else, and tracing exactly which permission changed is usually slower than repairing or reinstalling the product to recreate them.

Full reference

The four codes, precisely

Service commands and where to look

What is protecting the machine meanwhile

Microsoft documents that Defender goes into Disabled mode automatically when a third-party antivirus registers, and that where it was disabled automatically it can be re-enabled automatically if that product expires, is uninstalled, or otherwise stops providing real-time protection. A disabled AVG service is exactly that last case, so in most cases Defender has already taken over.

Confirm rather than assume. Get-MpComputerStatus in an elevated PowerShell prompt shows whether real-time protection is on right now, and Windows Security, then Virus and threat protection, shows the same thing in a form you can put in front of a user. If neither says anything is scanning, turn Defender’s real-time protection on before you carry on troubleshooting.

Before you go near HKLM\SYSTEM\CurrentControlSet\Services, export the key or take a restore point. A wrong value under that tree can stop Windows booting, and a missing service key is a reason to reinstall the product rather than to build one by hand.

Finding what disabled it

1. Check whether a system tuning or optimiser utility is installed. Disabling security services to “speed up boot” is a standard behaviour for that class of software.
2. Check Group Policy and any management tool for a service configuration policy naming the product.
3. Look at the Application and System logs around the date the service first failed to start.
4. Consider malware seriously. Disabling security software is a common step in an infection, so once AVG is running again, run a full scan.
5. If you have real doubt, scan with a second on-demand scanner from separate media rather than trusting the product that was switched off.

When to stop and reinstall

• The service key is missing entirely from the registry.
• The access-denied code persists after a repair.
• Setting the start type sticks until the next restart and then reverts, with no policy or utility to blame.
• The product’s drivers appear in the System log as failing to load.
• Two or more of the four codes appear across different restarts, which usually means the installation rather than the configuration is damaged.

Every code this article covers

Confirm the fix worked

1. services.msc shows the AVG service Running with Startup type Automatic.
2. AVG reports all protection components as active.
3. Restart and confirm the service starts without intervention.
4. The System log shows no new Service Control Manager errors after that restart.
5. Get-MpComputerStatus reflects whichever product you intend to be protecting the machine.

Questions people ask about this