Malware infection please help

[MrCharlie]

I think so, how do i tell?

You can't...try it again:

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

[darren]

I have internet access, but I cannot do windows update still, windows firewall is running

[MrCharlie]

Run FixIt:

http://support.micro...windows_update/

MrC

[MrCharlie]

How are we doing??

Do you still need help or can I close this post??

MrC

[darren]

Sorry missed your last reply, I ran that microsoft thing a couple of times and the update still doesnt run

[MrCharlie]

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
    
  • Windows Defender
    

  [*]Press "Scan".

  [*]It will create a log (FSS.txt) in the same directory the tool is run.

  [*]Please copy and paste the log to your reply.

MrC

[darren]

Farbar Service Scanner Version: 14-04-2013

Ran by User (administrator) on 10-05-2013 at 11:40:27

Running from "C:\Users\User\Downloads"

Windows 7 Home Premium Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Attempt to access Yahoo IP returned error. Yahoo IP is offline

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is set to Demand. The default start type is Auto.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:

==========================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware"=DWORD:1

Other Services:

==============

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys

[2011-05-23 16:19] - [2010-11-20 01:23] - 0499712 ____A (Microsoft Corporation) D31DC7A16DEA4A9BAF179F3D6FBDB38C

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys

[2011-05-23 16:19] - [2010-11-20 05:33] - 1924480 ____A (Microsoft Corporation) 509383E505C973ED7534A06B3D19688D

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

[MrCharlie]

That looks OK.

Please download on the Desktop the following application: Windows Repair

Next, extract and launch the Repair_Windows.exe

Click on Start repairs tab and then click on Start

Check mark following options:

Reset registry permissions

Reset file permissions

Repair WMI

Remove Policies Set By Infections

Repair Windows Updates

Check > Restart System When Finished option

Click the Start button

System should restart after repair

Let me know.....MrC

[darren]

Ok so I ran that program you mentioned. The auto updates still dont work, but now the computer is running alot slower than it was prior to doing that last fix

[darren]

the error code is 80072EE2

[MrCharlie]

See if any of this works:

http://windows.microsoft.com/en-us/windows-vista/windows-update-error-80072ee2

http://theitbros.com/how-to-solve-the-windows-update-error-80072ee2/

MrC

[darren]

Dear MrC

I tried that 1st site a couple of weeks ago and it didnt help, the second link I have got down to solution 4, I am re-entering the .dll files and all are ok except 2, msxml.dll & initpki.dll when i enter those two codes it brings a message up stating - The module "msxml.dll" failed to load. Make sure the binary is stored at the specified path or debug it to check for problems with the binary or dependent .DLL files. The specified module could not be found

I then tried solution 5 in regedit but there was no folder called windows update

does this make any sense to you, because it means nothing to me

[MrCharlie]

http://www.howtogeek.com/howto/windows-vista/guide-to-using-check-disk-in-windows-vista/

Run CheckDisk on the system.

Let me know if it finds anything.

MrC

[darren]

Ok it is scheduled for next time i restart, will update you once its done

[darren]

Hi MrC

I have done check disk as per that instruction

still no better!!!

are updates that important for me to be worrying about???

[MrCharlie]

They're important, look through this:

http://www.itexperience.net/2010/03/09/all-solutions-for-windows-update-error-80072ee2/

There's no one answer, you'll just have to keep trying things until you fix it.

If you want, I can send you to a tech forum that may be able to help you.

MrC

[darren]

ok if you could that would be great

and thank you for all of your help it is greatly appreciated

[MrCharlie]

Try here:

http://www.techsupportforum.com/forums/

MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!