Jump to content

Unable to update Windows 10 or access antivirus websites due to a Trojan

NC1210

By NC1210
in Resolved Malware Removal Logs

 Share

Recommended Posts

  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello @NC1210 and :welcome:

Please run the following fix

 

NOTE: Please read all of the information below before running this fix.

  • NOTICE: This script was written specifically for this user, for use on this particular machine.
  • Running this on another machine may cause damage to your operating system that cannot be undone.

Once the fix has been completed, please attach the file FIXLOG.TXT to your next reply

Farbar program:   FRST64.exe

Save the attached file:  FIXLIST.TXT to this folder C:\Users\nated\Downloads\

NOTE. It's important that both files, FRST64.exe, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

 

 

Run the Farbar program with Admin rights and press the Fix button just once and wait.

The fix may possibly take up to 60 minutes to complete

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log named Fixlog.txt in the same folder you ran the Farbar program from. Please attach that log on your next reply.

 

  1. NOTE:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity.
  2. NOTE: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications may be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed in most, but not all cases.
  3. NOTE: As part of this fix, it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Discord cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Thank you, the log looks like it ran well @NC1210

Please run the following scan

 

 

Please run the following ESET Online Scanner and perform a Full Scan

 

Click the following link to save the installer for ESET Online Scanner

https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

  • It will start a download of "esetonlinescanner.exe"
  • Save the file to your system, such as the Downloads folder, or else to the Desktop.
  • Go to the saved file, and double click it to get started. 
  • When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use
  • On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue
  • When prompted for scan type, Click on the Full Scan button
  • Enable  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click the Start scan button.
  • Have patience.  The entire process may take a few hours or more.
  • When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
  • Click The blue “Save scan log” to save the log and give it a name and location you remember.
  • If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
  • Press Continue when all done.  You should click to turn off the offer for “periodic scanning”.
  • Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

Please attach the ESET scan log you saved at the end to your next reply

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

 

Make sure the following options are checked:

  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please save the attached RepairServices.zip file to your computer @NC1210

RepairServices.zip

Then visit the following site and download the following program

NirSoft - AdvancedRun
https://www.nirsoft.net/utils/advanced_run.html

Direct download link:
https://www.nirsoft.net/utils/advancedrun-x64.zip

 

[ 1 ]

Make a new folder.  C:\FIX

Then extract all the files from the RepairServices.zip file into the C:\FIX folder

[ 2 ]

Extract the advancedrun-x64.zip files to the C:\FIX folder as well

[ 3 ]

Disable McAfee antivirus real-time protection and keep it off for now

[ 4 ]

If you're using the paid premium version of Malwarebytes, please open the program and click the small gear icon and go to Settings

Then go to Security and uncheck "Always register Malwarebytes" as shown below.

image.png

[ 5 ]

Open Windows Security - Manage settings and disable Real-time protection and Tamper Protection

[ 6 ]

Find the file AdvancedRun.exe and right-click over it and select "Run as administrator"

Under Program to run: click the 3 ... dots and select C:\Windows\System32\cmd.exe
Under Run As:  select TrustedInstaller as shown and click the Run button

image.png

 

In the DOS window, if you type in WHOAMI and press the Enter key, it should show you that you are now

nt authority\system

 

image.png

 

Now type in CD  C:\FIX as shown and press the Enter key it should change directory to your C:\FIX folder

Then type DIR and press the Enter key and it should show you the files in that folder

image.png

 

[ 7 ]

Now type in the following exactly and press the Enter key. You should get a success message 

reg import wuauserv.reg

Now let's do the other ones as well. Pressing the Enter key after each one 

reg import WaaSMedicSvc.reg

Then this one 

reg import UsoSvc.reg

image.png

 

[ 8 ]

Now we're going to restore the default hive files using the following commands. Copy and Paste and press the Enter key 

reg restore "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv" C:\fix\wuauserv.HIV

Then the next one 

reg restore "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" c:\fix\WaaSMedicSvc.HIV

Then the next one 

reg restore "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsoSvc" c:\fix\UsoSvc.HIV

 

[ 9 ]

Restart the computer now and run the FSS program again and post back the new log

I'll check back on you again sometime tomorrow

Thank you

 

 

 

 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Great, that looks good. Let me have you run the following @NC1210 so that I can look at some other logs

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Thank you for the log. Overall okay. Let me have you run the following please @NC1210

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

  • Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
  • If Microsoft SmartScreen blocks the download, click through to save the file
  • This tool is safe.   Smartscreen is overly sensitive.
  • If SmartScreen blocks the file from running click on More info and Run anyway
  • Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
  • Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
  • You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

image.png

image.png

image.png

 

Thank you

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please uninstall, update, or otherwise address the following as appropriate for your system.

 

  • Adobe Flash Player 11 Plugin v.11.1.102.55 Warning! This software is no longer supported. Please uninstall it.

 

 

What is up with the running antivirus processes here?

Do you also have F-Secure antivirus running or is that some other program?

 

------------------ [ AntivirusFirewallProcessServices ] -------------------
F-Secure Ultralight Hoster (fsulhoster) - The service is running
C:\Program Files\F-Secure\Ultralight\ulcore\1668586465\fshoster64.exe v.3.9.36.0
F-Secure Ultralight ORSP Client (fsulorsp) - The service is running
C:\Program Files\F-Secure\Ultralight\ulcore\1668586465\fsorsp64.exe v.1.3.1.688
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe v.4.0.0.1537
Malwarebytes Service (MBAMService) - The service is running
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe v.3.2.0.1219
C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe v.19.7.0.195
McAfee Validation Trust Protection Service (mfevtp) - The service is running
C:\Windows\System32\mfevtps.exe
C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe v.19.7.0.104
McAfee Firewall Core Service (mfefire) - The service has stopped
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe v.19.7.0.195
McAfee AP Service (McAPExe) - The service is running
C:\Program Files\Common Files\McAfee\VSCore_19_7\mcapexe.exe v.9.2.150.0
C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe v.9.9.140.0
McAfee CSP Service (mccspsvc) - The service is running
C:\Program Files\Common Files\McAfee\CSP\3.2.117.0\McCSPServiceHost.exe v.3.2.117.0
McAfee Service Controller (mfemms) - The service is running
C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe v.19.7.0.195
McAfee Module Core Service (ModuleCoreService) - The service is running
C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe v.2.17.113.0
Microsoft Defender Antivirus Service (WinDefend) - The service has stopped
Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

 

 

Then check for Windows Updates and install any found

Keep me posted

 

Link to post
Share on other sites
NC1210

NC1210

Posted
  • Author
Posted

I downloaded the free online scanner from F-secure a while back before the malware, and before I downloaded malwarebytes. though I'm not sure if it's still running anymore, or how to stop it if it is

I uninstalled Mcafee, Adobe, and the old 7-Zip. I'm pretty sure I updated the rest.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Okay, please restart the computer one more time.

Then run the following for me.

 

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

Thank you

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

I see the issue. You have another missing service that is related to Windows Updates

Please run the following fix while I go grab the correct files to fix that service

 

Save the attached file as before to this folder:  C:\Users\nated\Downloads\

fixlist.txt

Then run the Farbar scanner with Admin rights and click on the FIX button.

When done, please attach the updated FIXLOG.TXT file to your next reply.

 

 

 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please saved the attached file:  RepairServices2.zip  to your computer. @NC1210

RepairServices2.zip

Extract the files to your C:\FIX folder

 

Then, as before. Run the NirSoft AdvancedRun tool with Admin rights. All the same settings for C:\Windows\System32\cmd.exe 

Then click the Run button to open the DOS window.

Then the same as before

CD C:\FIX

Then copy and paste the following and press the Enter key 

reg import DoSvc.reg

 

Then copy and paste the following and press the Enter key 

reg restore "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DoSvc" C:\fix\DoSvc.HIV

 

Then restart the computer and see if Windows Updates work now or not and let me know.

 

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.