Jump to content

Bitcoin address copy/paste issue

_rafael_

By _rafael_
in Resolved Malware Removal Logs

 Share

Recommended Posts

_rafael_

_rafael_

Posted
Posted

Hi,

I'm having the following issue: whenever I copy a Bitcoin address to the clipboard, after a few seconds the original address is always replaced by the following address:

18v8Uqjt9wvEXXGbDCh9bLk15qXkFGeYmX

Also, my Windows Defender is not working, I believe it happened after I installed Malwarebytes a few weeks ago. The Windows Security panel shows nothing and the Windows Defender icon does not appear on system tray. 

Attached are the Malwarebytes and FRST logs. The Malwarebytes scan showed no threats.

Thanks in advance.

malwarebytes threat scan.txt Addition.txt FRST.txt

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hello, Welcome to Malwarebytes.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download the attached Fixlist.txt file to  the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the FRST.txt log you have submitted.

Run FRST and click Fix only once and wait.

The Computer will restart when the fix is completed.

It will create a log (Fixlog.txt) please post it to your reply.
===

Please post the Fixlog.txt and let me know what problem persists.

fixlist.txt

Link to post
Share on other sites
_rafael_

_rafael_

Posted
  • Author
Posted

Hi nasdaq,

Thank you! The copy/paste issue is gone.

Though the "Windows Defender" not working problem still persists. Do you think it may be related to the previous installation of Malwarebytes? My thought is that Windows Defender got disabled in order to not generate conflicts, but now my trial license of Malwarebytes expired and I am without any realtime protection. My "Windows Security" panel shows nothing when I open it.

Attached is the Fixlog.txt file.

Fixlog.txt

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi,

Malwarebytes will not disable Windows defender. Normally they work well together.

Go to this Microsoft page.
https://answers.microsoft.com/en-us/protect/forum/all/problems-starting-windows-defender-in-windows/808253bb-db89-4db9-a4e5-1c91a86489e9

Execute the instructions under these sections.

1. Restart your PC
2. Remove existing antivirus and antispyware software
  p.s. Remove Malwarebytes using the instructions on this page.
https://support.malwarebytes.com/docs/DOC-2674
Do not reinstall just yet.

3. Scan your PC for malware
Skip 4 and 5.
6. Restart Security Center Service

Restart the computer normally,

Is Windows Defender working?

Link to post
Share on other sites
_rafael_

_rafael_

Posted
  • Author
Posted

Hi, I followed the steps but Windows Defender still is not working.

 

I didn't quite understand what you meant by "do not reinstall just yet", because in order to execute step 3 I need to reinstall Malwarebytes right after step 2?

Well, what I did was reinstall it not using the removal tool, but exiting the tool first, then reinstalling downloading the latest version from the site.

Anyway, it did not find any malware.

 

Also, In step 6 I found it strange that in services.msc the "restart" option for the Security Center was greyed out. Only the "start" option was available. But when I selected start it did nothing, and now all options are greyed out.

I restarted the computer and the situation still is the same.

Any ideas?

Thanks again.

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi,

Lets check further.

Download   Farbar's Service Scanner utility
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/
and Save to your Desktop.
If using Windows 7 or above, Right-Click on fss.exe and select Run As Administrator.
If using XP, double-click to start.
Answer Yes to ok when prompted.
If your firewall then puts out a prompt, again, allow it to run.
Once FSS is on-screen, be sure the following items are checkmarked:
Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other Services
  
Click on "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Copy & Paste contents of FSS.txt into your reply.
===

Link to post
Share on other sites
_rafael_

_rafael_

Posted
  • Author
Posted

Hi, I ran Farbar and the log is as follows:

Microsoft Windows 10 Pro  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Policy: 
========================


Security Center:
============


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv: "C:\Windows\system32\svchost.exe -k netsvcs -p".
Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Windows Defender Disabled Policy: 
==========================


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi,

Repair these services.

Boot with Safe Mode with Networking. Execute the following.

Please Download Tweaking.com - Windows Repair from Here

  • Install and then run the program
  • Execute the instructions on Step 1 Important
  • Click Next on Step 2 Optional, do the Pre Scan skip Step 3 and 4 Optional for now.
  • On Step 5 Backup System Restore Do a Registry backup. When you have completed this click Next
  • Click Repairs - Open Repairs in the bottom right corner
  • Uncheck the All repair button then select just the item(s) listed below

  • 16 - Repair Windows Updates
20 - Repair MSI (Windows Installer)
25 - Restore Important Windows Services
26 - Set Windows Service to Default Startup
  • Click the Start button and let the process run to completion. Copy any error messages into Notepad, Save it on your Desktop. ( Reboot if asked to do so)
  • Please copy and paste the Contents of this file on your next reply.


===

Check the integrity of the operating system files.
How to run sfc /0x800f0831
http://support.microsoft.com/kb/929833

When completed refer to the Microsoft article again and follow the instructions to view details of the System File Checker process

Post the contents of the sfcdetails.txt file for my review.

If the problem persists please run the Farbar's Service Scanner utility and post a fresh log for my review.

Also, run the Farbar Recovery Scan Tool (FRST) and only post the FRST.TXT log for my review.
<<<>>>

p.s.
Was there ever a 3rd party security software installed on this computer?

Link to post
Share on other sites
_rafael_

_rafael_

Posted
  • Author
Posted

Hi, I executed all the steps, but the situation still is the same.

The sfc process apparently detected some corrupted files, but couldn't repair them.

 

I attached the sfcdetails.txt and FRST.txt logs for your review.

The new FSS log is as follows (services still are not running):

 

Microsoft Windows 10 Pro  (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy: 
==================


System Restore:
============

System Restore Policy: 
========================


Security Center:
============

wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc: "%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p".
The ServiceDll of wscsvc service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv: "%systemroot%\system32\svchost.exe -k netsvcs -p".
The ServiceDll of wuauserv service is OK.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Windows Defender Disabled Policy: 
==========================


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

 

Thanks.

sfcdetails.txt FRST.txt

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi,

If you refer back to this article.

https://support.microsoft.com/en-ca/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

It is suggested to run a DIMS command.

For this command to succeed you need to make sure that Windows Updates is working well.

That is why I suggested you execute the Tweaking.com - Windows Repair in my post no. 8.
Which you did and it's working.

Now I will refer you to this topic.

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/sfc-scannow-error-resolves/9a5f00cc-5b8d-478f-87f0-7d752e3cefe3?messageId=28c7329c-2669-4b42-9e40-f884ed169a96&page=3

The article is long.
Refer you to this post on page 3.
MarshallD'ArcyReplied on August 11, 2019

It is suggested to execute these commands

To do it, run the Cmd.exe as an administrator.
Execute these Dism commands in bold.

Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth

Personally I would restart the computer in normal mode before executing the SFC.EXe.

Run the sfc /scannow
Do it in the DOS box, Run the Cmd.exe as an administrator.

Restart the computer when all is done.

Let me know if the problem persists.
 

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi,

Go to this page.

How to permanently disable Windows Defender Antivirus on Windows 10
https://www.windowscentral.com/how-permanently-disable-windows-defender-windows-10#page1

It will show 3 way on how to disable Windows  Defender. I know yours is disabled but looking at the images/pictures you may find one where you can enable it.

Keep me posted.

Link to post
Share on other sites
_rafael_

_rafael_

Posted
  • Author
Posted

Hi,

In reference to the 3 ways shown on the article:

1- I can't verify that because the Windows Security Panel shows up blank, without any options to choose from;

2- The "turn off Windows Defender" option is set as "not configured", so I think it's not intefering with that;

3- The only key appearing in the Register in that section is the default one.

Link to post
Share on other sites
nasdaq

nasdaq

Posted
Posted

Hi

The problem is known see this article.

https://answers.microsoft.com/en-us/windows/forum/all/a-blank-screen-on-the-windows-defender-settings/3ccb9d16-fd14-470a-b732-760a71ac3766

It will refer you to this atcile.
https://answers.microsoft.com/en-us/windows/forum/windows_10-performance/windows-10-performance-and-install-integrity/75529fd4-fac7-4653-893a-dd8cd4b4db00

There is a lot of information to look at.

===

It may be worth while for you to install a 3rd party FREE security program to replace Windows Defender.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/

Pay attention to this section.
Choosing an Anti-Virus Program

You can Install a free version of a program of you choice and fell secure.

Your call.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.