Jump to content

Malware infected my pc and now i don't have access to Windows Defender

DaemonEde

By DaemonEde
in Resolved Malware Removal Logs

 Share

Recommended Posts

DaemonEde

DaemonEde

Posted
Posted

Hello there i'm Daniel

Yesterday i was working in my pc normally before i went to sleep, seems like i downloaded a malware and now this thing is making me go nuts, it sended links through discord, disabled or uninstalled my Window Defender and now i'm kinda worried of all the things it can do, can someone help me with this?

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @DaemonEde and :welcome:

Let me have you run the following please and we'll work on getting you cleaned up.

 

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler
 
 
 
 
Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

image.png

image.png

image.png

 



STEP 01

  • If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
  • If you don't have Malwarebytes installed yet please download it from here and install it.
  • Once installed then open Malwarebytes and select Scan and let it run.
  • Once the scan is completed make sure you have it quarantine any detections it finds.
  • If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
  • If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

  • Double-click to run the program
  • Accept the End User License Agreement.
  • Wait until the database is updated.
  • Click Scan Now.
  • When finished, if items are found please click Quarantine.
  • Your PC should reboot now if any items were found.
  • After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens, click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
  • Please attach the Additions.txt log to your reply as well.
  • On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Thank you for the logs @DaemonEde there is no issue with the logs being in Spanish. Most of what we often need to look at is in English. If really needed I can always use one of the online translators. I used to be low level conversational in Spanish but that was thirty years ago. Since my friends that spoke Spanish back then moved away I lost touch.

 

 

The logs show that the system is running one or more P2P torrenting programs.

The act of torrenting itself is not illegal. However, downloading and sharing unsanctioned copyrighted material is very much illegal, and there is always a chance of getting caught by the authorities.
Torrenting non-copyrighted material is perfectly fine and is allowed. We have seen an increase in malware being bundled with software downloads over P2P.
Please keep in mind when sharing files that you're increasing the risk that your system might get infected. Scan all files prior to running them.

 

The log shows that you're using Sophos Anti-Virus - I'm surprised that it did not stop this , but for some reason even though it's installed and running it's not registered on the system as the main antivirus.

 

 

 

Please make sure to exit out of Malwarebytes and stop any other real-time antivirus temporarily while this fix runs.

If you leave the antivirus real-time protection running this fix may not work.

 

Please download the attached fixlist.txt file and save it to the Desktop  where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run Farbar from here C:\Users\Administrador\Desktop\FRST64.exe and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

From the log, the program found and repaired some issues.

Windows Resource Protection found damaged files and successfully repaired them.

 

Please run Malwarebytes and AdwCleaner again and run scans and post back both NEW logs.

Thanks @DaemonEde

 

I only need new Farbar logs when asked.

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

No problem. So is Windows Defender or Folder options still disabled or having an issue? @DaemonEde

 

 

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted (edited)

Yes, it looks like something attacked Windows Defender and removed it's services.

Please try to do the following in Windows Normal mode. If you're unable import these files in Normal mode then save the files where you can find them and then restart the computer into Safe Mode and try to import them there.

 

Save all 3 downloads first, each one to be saved first, before applying.

Download, Save, Merge for each of these 3 services.

RIGHT-CLICK each link with your mouse-pointer and select SAVE ...As.... & guide the folder for saving to a folder ( do not double click / do not 'run' the file / nor open)

 

1: SecurityHealthService 

2: Windows Security Center

3: Microsoft Defender Antivirus 

 

 

Once all 3 files have been saved to your computer please do the following.

With your mouse, do a RIGHT-CLICK on each Registry file  and select Merge

If you get an error please note the file that gave you the error so that you can run it from Safe Mode

 

If all 3 files merged with a Success then go ahead and restart Windows.

Then after the restart open your Security and see if all looks okay now or not.

image.png

 

Then go ahead and run the Farbar program again and click on SCAN and get me new logs files.

FRST.txt
Addition.txt

Thank you

 

 

 

 

Edited by AdvancedSetup
Updated information
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Okay, let me have you temporarily go ahead and uninstall Sophos Antivirus.

Go to Control Panel, Programs, Programs and Features and uninstall.

Then restart the computer and run the FSS Farbar Service Scanner program again and post back new logs.

Thanks @DaemonEde

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please download the following scanner from Kaspersky and save it to your computer: TDSSkiller

Then watch the following video on how to use the tool and make sure to temporarily disable your security applications before running TDSSkiller.

PC Winvids - How to run Kaspersky TDSSKiller

If any infection is found please make sure to choose SKIP and post back the log in case of a False Positive detection.

Once the tool has completed scanning make sure to re-enable your other security applications.

Thank you

 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted (edited)

Okay if the TDSSKiller tool is still running please have it CURE that item.

If you've already closed the tool then scan again and have it Cure what it finds.

Then restart the computer.

Delete those registry files you downloaded above and download NEW fresh copies.

Boot into Safe Mode and merge all three of them again and restart the computer again.

Then run the FSS tool again and post back new logs.

Thank you @DaemonEde

 

Note: I may be on the road until later tonight. I'll try to follow up as soon as I can.

 

 

Edited by AdvancedSetup
Updated information
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please try the fix for the Windows Update Service again. @DaemonEde

Please note I'm going to be on the road until late tonight soon but will reply as soon as possible. If not today we can finish up tomorrow.

 

 

Windows Update:
============
wuauserv Service is not running. Checking service configuration:
Checking Start type of wuauserv: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ServiceDll of wuauserv: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

 

 

Try running a new Threat Scan with Malwarebytes as well.

Then run the following afterward

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
  • The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

Thank you

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Good day @DaemonEde yes, the wife and I had a nice drive and a meal. Thank you for asking.

Let's go ahead and see if we can get this other service up and running.

Please download the attached zip file for the Windows update service. Then extract the .reg file out of the zip file to a location you can easily find from Safe Mode.

wuauserv_w10.zip

 

Then restart the computer into Safe Mode  and run Regedit.exe and merge this new wuauserv_w10.reg  file into the registry.

Then start an admin command prompt and type the following exactly. It might be better to save this into notepad in the same location as the .reg file so that when you're in Safe Mode you can have access to it. 

sc.exe sdset wuauserv D:(A;;CCLCSWRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

Then once that's done restart into Normal Mode and run the FSS scanner again and post back the new log.

Thank you

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.