Windows Virus & Threat protection won't open

[Yourmom321]

2 days ago I allegedly tried to download this certain crack file, but of course it contained some kind of malware. While downloading, the cmd window popped up a few times and it had admin rights (it showed C:\Windows\system32> instead of C:\Users\[Username]). After the download was complete i did a quick scan with malwarebytes and it showed that i had a trojan, so i removed it. After that i wanted to also scan with Windows Defender but then i noticed that it wasn't running. So i tried to open it and it didn't open. I tried to activate it through control panel but it gave me some kind of a error message. After that i tried everything to fix it, i scanned the device with adwcleaner, malwarebytes, tried to scan it in safe mode, tried to change values in registery editor etc. But nothing worked, so i decided to factory reset. I removed everything and had a fresh reinstall of windows. Now i can open my windows security window but i can't use Microsoft antivirus, it tells me "Your IT administrator has limited access...". Again I tried so many things from the internet to fix it but nothing works. I scanned my system with malwarebytes and it showed no threats. So now I'm using malwarebytes for my real-time protection but i only have it for 7 days until the trial ends. I want to know, how can I get my windows antivirus back working again?

[Maurice Naggar]

Hello 

A few important guidance principles as we go along.

• Do not make changes to the system on your own.
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

In your notes, you indicate that you have very recently installed the Malwarebytes Trial. First next thing to do:

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }

This will not affect any real-time protection of the Malwarebytes trial   😃.

Close Malwarebytes.

>

NEXT:

Now, close and exit as many open app-windows that are open that you really do not have to have running.

NEXT:

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on Scan Options & select  CUSTOM scan  & then select the C drive to be scanned.

Then start the scan. Have lots of patience. Once you start the scan & you see it started, then leave it be.  

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on screen display.  The only things that count are the End result at the end of the run.
• Again, any on-screen display about repeat 'infection' is not to be relied on.  Ignore those.
• We only rely on the end result that is on the log-report-file.

 

This is likely to run for many hours   ( depending on number of files on your machine & the speed of hardware.)

The log is named MSERT.log  

the log will be at  

Windows\debug\msert.log

Please attach that log with your reply. We will do more later.

 

Edited May 26, 2022 by Maurice Naggar

[Yourmom321]

Hello!

It's great to see on how quick you guys reply. Anyway, here's the log.

---------------------------------------------------------------------------------------
Microsoft Safety Scanner v1.367, (build 1.367.507.0)
Started On Thu May 26 21:21:07 2022

Engine: 1.1.19202.3
Signatures: 1.367.507.0
MpGear: 1.1.16330.1
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Safety Scanner Finished On Thu May 26 21:51:32 2022

Return code: 0 (0x0)
 

[Maurice Naggar]

Good to see 😀 

I would like a report set for review.   This is a report only.

Please download MALWAREBYRES MBST Support Tool

Once you start it click Advanced >>> then   Gather Logs

 Have patience till the run has finished.

Upload an archive once it is done. Attach the mbst-grab-results.zip from the Desktop.

 

• Please attach  mbst-grab-results.zip    to your reply

[Yourmom321]

Here it is!

 

 

mbst-grab-results.zip

[Maurice Naggar]

Thank you for the report. I do have one question, since this pc has Avast Antivirus, have you been able to use it and do a Scan ?

[Yourmom321]

Yes, I'm able to use it. I did one scan with it and it said that i have no threats.

[Maurice Naggar]

Hello. 

Since you did run the support tool, there -is- a tool named FRSTENGLISH on the Downloads folder . This script works as one of a pair.

This custom script is for  Yourmom321  only / for this machine only.

Be very sure to Save any work-files you have open at this point. Close & Save any open edits, if any. Next, a custom script to do  checks & some  cleanups. 

We will use FRSTENGLISH  on the Downloads  folder to run a custom script.    The system will be rebooted after the script has run.

This custom script has some specific things, plus some general aspect to help the system overall.  Hoping it will not exceed 60 minutes in execute time.

NOTE-1:  This script will  run a scan using System File Checker to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. .It will also run the Windows tool DISM to check Windows integrity.  It will rebuild the Winsock. 

NOTE-2: This should help with future Microsoft Windows Updates ( I noticed recent Windows Update failures). There are 2 blocks in the Windows Firewall rules that likely affect performance or ability of Avast. Those 2 will be removed. Plus, it will do a CHKDSK run on the next future system Restart.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

• If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.
• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

Fixlist.txt       <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads   folder.

RIGHT click on FRSTENGLISH   and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. 
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity. Stick with me.

Edited May 27, 2022 by Maurice Naggar

[Maurice Naggar]

<<Just additional notes>> You mentioned at the top

Quote

Now i can open my windows security window but i can't use Microsoft antivirus, it tells me "Your IT administrator has limited access...". Again I tried so many things from the internet to fix it but nothing works.

This pc has Avast installed & running and so that being so, Avast had turned Off the Microsoft Defender & that is why you could not use it and that "IT admin" message would show. After the custom script has finished, you should be able to get into Microsoft Security >> Virus and Threat Protection and be able to use Microsoft Defender. If you do that, you want to first do a update check via "Check for Updates".
<< Please do not try fixes on your own that you may find on "internet" web searches. I am here to guide you.>>

[Yourmom321]

56 minutes ago, Maurice Naggar said:

<<Just additional notes>> You mentioned at the top

This pc has Avast installed & running and so that being so, Avast had turned Off the Microsoft Defender & that is why you could not use it and that "IT admin" message would show. After the custom script has finished, you should be able to get into Microsoft Security >> Virus and Threat Protection and be able to use Microsoft Defender. If you do that, you want to first do a update check via "Check for Updates".
<< Please do not try fixes on your own that you may find on "internet" web searches. I am here to guide you.>>

I'm about to run the custom script, but i quickly wanted to say that i couldn't open windows virus & threat protection even when malwarebytes and Avast weren't installed. As soon as my factory reset was done, i opened the windows defender and everything else worked except virus & threat protection, it gave me that ''IT admin'' message. After that i downloaded malwarebytes and Avast. (Just wanted to try Avast out)

[Yourmom321]

Here's the log

Fixlog.txt

[Maurice Naggar]

Thanks for the run & that log. I would like to run a different report. This does not make changes. 

Download   Farbar's Service Scanner utility

and Save to your Desktop.

Right-Click on fss.exe and select Run As Administrator.

Answer Yes to ok when prompted.

If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are check-marked:

• Internet Services
  Windows Firewall
  System Restore
  Security Center/Action Center
  Windows Update
  Windows Defender
  Other services

  

Click on "Scan".

It will create a log (FSS.txt) in the same directory the tool is run.   Please attach that file.  

[Yourmom321]

Here it is!

FSS.txt

[Maurice Naggar]

Be sure you advise me What your short range and long range plans are as far as Avast antivirus ! The Avast antiirus is currently on & active & typically one does not want to have more than just 1 active antivirus.
The reason that you spotted & had notices about Windows Security are:
A registry key for a service of Microsoft Defender seems to be missing from the system registry. As well, it is quite possible a DLL asscoaited to Microsoft Defender may be "missing".
That you should know. + I would remark, that if "a Factory Restore" was done for this machine, that some thing did not go 1000% properly.
*
The following are steps to try to get Microsoft Defender back on.There will be 3 downloads, each one to be saved first, before applying.
 download, save, Merge for each of the other 3 services.

RIGHT click each link with your mouse-pointer and select

SAVE link ...as....

& guide the folder for saving to a folder ( do not double click / do not 'run' the file / nor open

win 10 SecurityHealthService 

With you mouse, do a RIGHT-click on the .reg file  and select Merge

Let it do that & insure it finishes ok.

[ 2 ]

Windows 10 Windows Security Center service

Save, then Merge Wscsvc.reg

With you mouse, do a RIGHT-click on the .reg file  and select Merge

Let it do that & insure it finishes ok.

[  3   ]

Microsoft Defender Antivirus service 

Save, then Merge Windefend.reg

With you mouse, do a RIGHT-click on the .reg file  and select Merge

Let it do that & insure it finishes ok.

[ 4 ]

Now do a Windows RESTART.

After Windows is restarted, just please take a visual look at the display of Windows Security. Stick with me. We are far from "done".

[Yourmom321]

I downloaded, saved and merged all the files. For the Avast thing, I only planned on using it until my windows threat & virus protection starts working again. I don't plan on using it long term, I just kinda got worried and since i don't really know much about antivirus programs, i decided to give Avast a try since my Malwarebytes trial only lasts 7 days.

[Maurice Naggar]

Later on, I will guide you to uninstall Avast + the special cleanup for it. Based on having merged the 3 Registry-services, this is like the acid test. 

Next step # 1

Do a Windows RESTART.      Select Start and then select Power > then select RESTART.

Next step # 2

Please  set File Explorer to SHOW ALL folders, all files, including Hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

Next step # 3

Just want to do a visual check in Windows Security to see (visually) that Microsoft Defender is on .  And do a Update run & do a Custom scan on the C drive.

• From the Windows Start menu, select Settings, then select Update and Security.
• Next, look at the left-side menu & select Windows Security
• Next, In Windows Security section: Click on the grey button Open Windows Security
• Now, click on the shield Virus and threat protection
• Look to see that Microsoft Defender is shown & available for use. You will likely have to scroll way down to find "WINDEFEND" since Avast is the primary antivirus application.  Take your time. Look real real close.
• On the next display, look at all the options.  Look down the list and see "Check for Updates" .
• You should click on that to have the system check for updates for Windows Defender.  Watch & wait for that to complete.
• Please also note that the Scan options (all) can be displayed by clicking on Scan options.
• I would like you to select CUSTOM scan from scan options
• Then select the C drive
• Then have it scan the whole C drive.

[Yourmom321]

This is all that i have in virus & threat protection section.

[Maurice Naggar]

Notice, way down at bottom of your screen, "Periodic Scanning"
Click that to the RIGHT so that ( at least) Microsoft Defender antivirus periodic scans are ON.
Then after, look to see if that screen will then reflect some new options.

[Yourmom321]

As i click it, the yes and no prompt pops up, i click yes but then immediately the "Periodic Scanning" bar goes back to the left.

[Yourmom321]

For some reason It doesn't turn on, doesn't matter how many times i try.

1 minute ago, Yourmom321 said:

As i click it, the yes and no prompt pops up, i click yes but then immediately the "Periodic Scanning" bar goes back to the left.

 

[Maurice Naggar]

You see the line in blue "Microsoft Defender Antivirus options" .....click that, see what shows

[Yourmom321]

1 minute ago, Maurice Naggar said:

You see the line in blue "Microsoft Defender Antivirus options" .....click that, see what shows

I just expands to the periodic scan window and back.

[Maurice Naggar]

To fully remove AVAST antivirus, first Uninstall it the standard Windows way.
See "OPTION THREE" on this guide  https://www.tenforums.com/tutorials/4689-uninstall-apps-windows-10-a.html#option3

You want to uninstall "Avast Free Antivirus"

[   2    ]
Keep going and do this.

Then get & first SAVE & then run the AVASTCLEAR tool
Get, Save & Run the Avast clear tool.
https://support.avast.com/en-us/article/Uninstall-Antivirus-Utility/Save the tool first; then run it.

[   3   ]
Then do a Windows RESTART  from the Start menu. Then, after system is settled down, do the suggestion to run Microsoft Defender Custom Scan on C drive. 😃
 

[Yourmom321]

When i click on check for updates, nothing happens (I can click it but it just does nothing)

[Maurice Naggar]

Stay cool. 1st try this, I  suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.