Virus disabled Windows Security

swainbeau · May 1

Hi there,

I might have a virus or malware on my PC that completely disables Windows Security. I tried to go into Windows Command and fix it, but it says that I'm no longer an administrator. I tried going to the Family section in Windows to fix it, but it also said that it's unavailable at the time- even though I'm marked as administrator there. I don't know what other damage it's done to my PC as of now. I would appreciate some help with this.

Thank you!

AdvancedSetup · May 1

Hello and :welcome:

My screen name is AdvancedSetup and I will assist you with your system issues.

Let's keep these principles as we proceed. Make sure to read the entire post below first.

Please follow all steps in the provided order and post back all requested logs
Please attach all log files to your post, unless otherwise requested
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans have been completed.
Temporarily disable Microsoft SmartScreen to download the software below if needed. Make sure to turn it back on once the scans are completed.
Searching, detecting, and removing malware isn't instantaneous and there is no guarantee to repair every system.
Before we start, please make sure that you have an external backup, not connected to this system, of all private data.
Do not run online games while the case is ongoing. Do not do any free-wheeling or risky web-surfing.
Only run the tools I guide you to use. Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
Cracked, Hacked, or Pirated programs are not only illegal but also can make a computer a malware victim. Having such programs installed is the easiest way to get infected. It is the leading cause of ransomware encryption. It is at times also a big source of current Trojan infections. If there are any on the system you should uninstall them before we proceed.
Please be patient and stick with me until I give you the "all clear". We don't want to waste your time, please don't waste ours.
If your system is running Discord, please be sure to Exit it while this case is ongoing.

To begin, please do the following so that we may take a closer look at your installation for troubleshooting. This is a report only.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Download the Malwarebytes Support Tool
In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
In the User Account Control pop-up window, click Yes to continue the installation
Run the MBST Support Tool
In the left navigation pane of the Malwarebytes Support Tool, click Advanced
In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

swainbeau · May 2

Here's the file ^^

mbst-grab-results.zip

AdvancedSetup · May 2

Thank you for the logs @swainbeau

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

STEP 01

If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
If you don't have Malwarebytes installed yet please download it from here and install it.
Once installed then open Malwarebytes and select Scan and let it run.
Once the scan is completed make sure you have it quarantine any detections it finds.
If no detections were found click on the Save results drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

Double-click to run the program
Accept the End User License Agreement.
Wait until the database is updated.
Click Scan Now.
When finished, if items are found please click Quarantine.
Your PC should reboot now if any items were found.
After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens, click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
Please attach the Additions.txt log to your reply as well.
On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

Thanks

swainbeau · May 2

Thanks for the help! I've done everything. I renamed the first file (Malwarebytes TXT) to vir response 1. Everything else should be the same.

I am going to sleep for the night, so I'm turning off my PC, but I will disconnect the Wi-Fi and pull the power plug. Hopefully nothing bad happens in the meantime. Again, thank you for the help so far!

vir response 1.txt AdwCleaner[C00].txt FRST.txt Addition.txt

AdvancedSetup · May 2

Thank you for the logs @swainbeau

Please run the following scan

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones. Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run.
The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

Thank you

swainbeau · May 4

Here's the MSERT file. Let me know if you need the frst and additions txt files as well, I was a little confused.

It said I had 4 infections during the scan, but came back saying I had nothing. A little confused on that as well.

msert.log

AdvancedSetup · May 4

Thank you for the log. Please run the following

Please download the following tool

Farbar Service Scanner and run it on the computer with the issue
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender

Click "Scan"

It will create a log (FSS.txt) in the same directory the tool is run.
Please attach the log to your next reply.

swainbeau · May 4

Here you are ^^

FSS.txt

AdvancedSetup · May 4

Your Security Center is disabled as you said

Please see if you can go into Safe Mode and enable it to Automatic (Delayed)

If you're unable to let me know and we'll try another method to change it

Here is what it should look like

C:\>sc qc wscsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wscsvc
        TYPE               : 20 WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Security Center
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\>sc queryex wscsvc

SERVICE_NAME: wscsvc
        TYPE               : 30 WIN32
        STATE              : 4 RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0 (0x0)
        SERVICE_EXIT_CODE : 0 (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 14264
        FLAGS              :

Edited May 4 by AdvancedSetup
Updated information

swainbeau · May 4

Couldn't go and change it to anything other than disabled in both safe mode and normal startup.

Didn't turn out the same when I ran the commands, here's a screenshot of the command prompt when I ran both in safe mode just in case you need it.

AdvancedSetup · May 4

Okay, I'm going to lunch. Give me a bit to write up a new fix for this.

AdvancedSetup · May 4

Please run the following FIX @swainbeau

[ 1 ]

Make a new folder. C:\FIX

Then extract all the files from the RepairServices.zip file into the C:\FIX folder. If the files are not in the C:\FIX folder this fix will not work.

RepairServices.zip

[ 2 ]

Find the file AdvancedRun.exe in the C:\FIX folder and right-click over it and select "Run as administrator"

Under Command-Line Arguments: It should say C:\FIX\repair_services.bat if it does not then copy and paste "C:\FIX\repair_services.bat" into it.
Under Run As: select TrustedInstaller as shown and click the Run button

[ 3 ]

The computer will restart after 30 seconds

[ 4 ]

After the restart

Run the FSS scanner again and get me a new set of logs
Run the Farbar scanner and click SCAN and get both new logs

New logs to attach

FSS log
FRST.txt
Addition.txt

Thank you

swainbeau · May 5

Here you are ^^

FSS.txt FRST.txt Addition.txt

AdvancedSetup · May 5

Great, the other services were fixed, but looks like Windows Defender needs some fixing.

Are you using Avira antiviurs as your choice for antivirus?

swainbeau · May 5

Yes, just started using it less than a week ago.

AdvancedSetup · May 5

Okay, thanks. I'm going to grab some lunch, then when I get back I'll make you one more fix.

In the mean time, please run the following

SecurityCheck by glax24

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
If Microsoft SmartScreen blocks the download, click through to save the file
This tool is safe. Smartscreen is overly sensitive.
If SmartScreen blocks the file from running click on More info and Run anyway
Right-click with your mouse on the Securitycheck.exe and select "Run as administrator" and reply YES to allow to run & go forward
Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file. Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

Thank you

swainbeau · May 6

Have a good lunch!

SecurityCheck.txt

AdvancedSetup · May 6

Please uninstall, update, or otherwise address the following as appropriate for your system

7-Zip 21.00 alpha (x64) v.21.00 alpha Warning! Download Update | Uninstall old version and install new one.
Adobe Flash Player 32 PPAPI v.32.0.0.156 Warning! This software is no longer supported. Please uninstall it.
Discord v.1.0.9011 Warning! Download Update
GIMP 2.10.8 v.2.10.8 Warning! Download Update
Git v.2.37.0 Warning! Download Update
HandBrake 1.3.3 v.1.3.3 Warning! Download Update
Java 8 Update 211 (64-bit) v.8.0.2110.12 Warning! Download Update | Uninstall old version and install new one (jre-8u371-windows-x64.exe).
Java 8 Update 211 v.8.0.2110.12 Warning! Download Update |Uninstall old version and install new one (jre-8u371-windows-i586.exe).
Node.js v.16.15.1 Warning! Download Update
ProtonVPN v.1.27.2 Warning! Download Update
qBittorrent 4.3.3 v.4.3.3 Warning! Download Update
Spotify v.1.1.89.862.g94554d24 Warning! Download Update
Telegram Desktop v.4.7.1 Warning! Download Update
VLC media player v.3.0.12 Warning! Download Update

---------------------------- [ UnwantedApps ] -----------------------------
CCleaner v.6.10 Warning! Suspected demo version of anti-spyware, driver updater or optimizer.
JDownloader 2 v.2.0 Warning! Suspected Adware! If this program is not familiar to you it is recommended to uninstall it
Avira System Speedup v.6.25.0.17 << Hidden Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using Malwarebytes Anti-Malware. Possible you became a victim of fraud or social engineering. Computer experts no longer recommend this program.

The act of torrenting itself is not illegal. However, downloading and sharing unsanctioned copyrighted material is illegal, and there is always a chance of prosecution if caught by the authorities.
Torrenting non-copyrighted material is perfectly fine and is allowed. However, be aware that we have seen increased malware bundled with software downloads over P2P.

Recent Ransomware infections have been seen to encrypt user data so that no one can decrypt the data without the private key.
When sharing files, please keep in mind that you're increasing your system's attack surface area, which can increase the risk of infection.

Scan all files before running them. https://www.virustotal.com

If you don't need or use the P2P software, you should uninstall it.

Risks of File-Sharing Technology by the Cybersecurity & Infrastructure Security Agency
https://www.cisa.gov/uscert/ncas/tips/ST05-007

Hidden risks in pirated software https://news.microsoft.com/apac/2019/01/08/hidden-risks-in-pirated-software/ Why You Shouldn't Use Pirated Software (But Why People Still Do) https://www.computer.org/publications/tech-news/trends/why-you-shouldnt-use-pirated-software

Games that use P2P

Malwarebytes can often block Steam and other games because Steam uses what is known as Peer-to-Peer (P2P) technology, meaning it connects to many different servers, workstations, and IP addresses.

Sometimes Torrent based software will connect to a server that is also known for hosting malicious content. This is because multiple sites often share servers, workstations, IP addresses.

So although what you are playing or downloading through Torrent-based software may be perfectly safe, some of the sites hosted on some of the IP addresses the Torrent-based software connects to may be malicious.
Such connections are typically not a threat, and you may exclude Torrent-based software from the Web Protection component in Malwarebytes to stop the block alerts.

Generally speaking, your web browser and other critical web-facing programs will still be fully protected from malicious websites and other malicious content.

To do so, add the game executable program file to your exclusions using the method described under the Exclude an Application that connects to the Internet section of Exclude detections in Malwarebytes for Windows

https://support.malwarebytes.com/hc/en-us/articles/360038479234-Add-to-the-Allow-List-in-Malwarebytes-for-Windows-v4

NOTE: Some torrenting software binds to your network card, and it may not be possible to exclude from Malwarebytes.

AdvancedSetup · May 6

Please run the following scanner to make sure we've not missed something.

Please run the following ESET Online Scanner and perform a Full Scan

Click the following link to save the installer for ESET Online Scanner

https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.
Go to the saved file, and double click it to get started.
When presented with the initial ESET screen, click on "Get Started". Read and accept the Terms of use
On the "Before we start..." screen chose if you want to send anonymous data and if you want to provide feedback or not, then click Continue
When prompted for scan type, Click on the Full Scan button
Enable ( select ) the radio selection "Enable ESET to detect and quarantine potentially unwanted applications" and click the Start scan button.
Have patience. The entire process may take a few hours or more.
When the scan is completed, if something was found, it will show a screen with the number of detected items. If so, click the button marked “View detected results”.
Click The blue “Save scan log” to save the log and give it a name and location you remember.
If something was removed and you know it is a false postive, you may click on the blue ”Restore cleaned files” ( in blue, at the bottom).
Press Continue when all done. You should click to turn off the offer for “periodic scanning”.
Enable "Delete application data on closing" - You do not need to submit feedback unless you want to. Simply ignore and close the program.

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

Please attach the ESET scan log you saved at the end to your next reply

swainbeau · May 6

Here it is

ESET scan log.txt

AdvancedSetup · May 6

Thank you for the log

Did not expect to find that. Please run the following again.

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones. Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run.
The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

It is normal for the Microsoft Safety Scanner to show detections during the scan process.

It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

Thank you

AdvancedSetup · May 30

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

Virus disabled Windows Security

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information