Windows defender got deleted.

[dbg]

Recently I downloaded a crack game. A big mistake. I had to quickly delete it but the harm was already done. My windows defender got deleted. How do i get it back?

 

Following an earlier forum from here, I did the following scans-

1. MSERT

2. FRST (+Addition)

3. FSS

4. ESET

Now I am not sure what to do next...

FSS.txt eset_scan.txt msert.log FRST.txt Addition.txt

[Maurice Naggar]

Hello. Please allow me some time to go over your reports. Very saddened to read some crack was allowed willingly onboard. It has DINGED the MS Defender.

[Maurice Naggar]

My name is Maurice. I will guide you.

The act of using or installing that "crack" has resulted in damage to at least three Microsoft Windows services.
wscsvc Service , Windows security center service is Missing.
wuauserv Service, Windows Update service is Disabled.
WinDefend Service  , Microsoft Defender antivirus main engine, is Disabled.
I will help you on getting those back to standard normal.

• Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. 
• Please don't run any other scans, download, install or uninstall any programs while I'm working with you.
• Only run the tools I guide you to.
• Do not run online games while case is on-going. Do not do any free-wheeling web-surfing.
• The removal of malware isn't instantaneous, please be patient.
• Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure.
• Please stick with me until I give you the "all clear".
• If your system is running Discord, please be sure to Exit out of it while this case is on-going.

  Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  1. Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  2. Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

Next, we use Malwarebytes to check for any other potential malware.

Malwarebytes can detect and remove most malware with no further actions required for free.

Please download, install, update Malwarebytes
from this link

and do a Threat Scan with Malwarebytes see guide link
and post back the log as shown below.
Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See see how-to link

Next, an adjustment,

Please do the following actions, so that Microsoft Defender antivirus runs side-by-side along with Malwarebytes.
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center

Click the Security Tab. Scroll down to

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".
{ We want that to be set as Off   .... be sure that line's  radio-button selection is all the way to the Left.  thanks. }
IF that line-selection is greyed-out  unavailable, do not fret. Just skip over that.

This will not affect any real-time protection of the Malwarebytes for Windows    😃.

Close Malwarebytes.

>

Stick with me until after I give the all clear. There is more to do.

[dbg]

Soon after i posted it, i found out windows update was disabled because of an application by "novirusthanks". The windows update was turned disabled. I enabled it. I updated my windows.

Windows defender is still missing. Its late night here. I shall reply as soon as i get your recommended steps done.

[Maurice Naggar]

Thank you for the information. I look forward to getting the scan report from Malwarebytes.

[dbg]

I followed the steps. Here's the Malwarebytes scan report.

malwarebytesscan.txt

[Maurice Naggar]

This Malwarebytes scan found and removed a lot of threats.

Let's do one scan  with Malwarebytes Adwcleaner. 

It will not take much time, 

First download & save it

download link

 

Then go to where the EXE file is saved. Start Adwcleaner.  Do not rush. 

 

Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt.

 

Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan.

This can take several minutes.

When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found.

 

AdwCleaner "may" prompt you to save any open files or data as the program 'may' need to close any open programs before it starts to clean.

Click on the “Continue” button to finish the removal process.

 

 

Guide article

 

Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt

[dbg]

Adwcleaner report-

 

Also what's this script host window? It has been appearing every time I start my computer for the last few days. 

AdwCleaner[S00].txt

[Maurice Naggar]

On that message window about Run.vbs  just click the X button to get that out of the way. It is not a show stopper.

Now a different scan with another security scanner. 

You should first Close as many of your open-user app-screens as possible. That is to say, Exit all that you do not need to have open.

This with Kaspersky KVRT tool.

Download Kaspersky Virus Removal Tool (KVRT) from here: https://www.kaspersky.com/downloads/thank-you/free-virus-removal-tool and save to your Desktop.

Next, Select the Windows Key and R Key together, the "Run" box should open.



Drag and Drop KVRT.exe into the Run Box.



C:\Users\Welcome\DESKTOP\KVRT.exe will now show in the run box.



add

-dontencrypt

Note the space between KVRT.exe and -dontencrypt

C:\Users\Welcome\DESKTOP\KVRT.exe -dontencrypt 

should now show in the Run box.



That addendum to the run command is very important.


To start the scan select OK in the "Run" box.



The Windows Protected your PC window "may" open, IF SO then select "More Info"



A new Window will open, select "Run anyway"



A EULA window will open, tick both confirmation boxes then select "Accept"



Go slow & careful on this part.  In the new window select "Change Parameters"

 

• In the new window ensure the following boxes are ticked:
  • System memory
  • Startup objects
  • Boot sectors
  • System drive

• Then select "OK" and "Start scan“.

The Kaspersky tool is very thorough so will take a considerable time to complete, please allow it to finish. Also while Kaspersky runs do not use your PC for anything else.. you

• completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue".
• Usually, your system needs a reboot to finish the removal process.
• Logfiles can be found on your systemdrive (usually C: ), similar like this:

Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20240105_203000.klr

• Right click direct onto those reports, select > open with > Notepad.
• Save the files and attach them with your next reply
• Have lots of patience, as this will most likely run for many hours.
• Also, be aware I am a volunteer here. I help here as personal time permits. I am not on all the time.

[dbg]

I just got banned, don't know why. I changed the wifi and am now able to sign in again. That was scary. Anyway-

Scan is complete. I wonder why it shows processing in the scan results window when i press the details option. But here are the results.

report_2024.01.04_22.39.20.klr.txt

[Maurice Naggar]

The

• Recheck on these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start.
  1. Show-Hidden-Folders-Files-Extensions
  https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/

  2. Disable-Fast-Startup
  https://forums.malwarebytes.com/topic/299350-disable-fast-startup/

3. This next report I truly need.

I would like a report set for review. This is a report only. This is the first beginning step so I can see what is what on this particular machine.

Please download MALWAREBYTES MBST Support Tool

Once you start it click Advanced >>> then Gather Logs

Have patience till the run has finished.
Attach the mbst-grab-results.zip from the Desktop to your reply..

Kaspersky KVRT scan indicates iy found no virus; no trojan; no threat.

[dbg]

The MBST grab results-

mbst-grab-results.zip

[Maurice Naggar]

The "crack game infection" has dinged at least three Windows services, Windefend, Sense, and MSSECFLT. That is why you got the black screen on Security at a glance/
It also appears that there are two obfuscated trojans. A scheduled task referring to "run.vbs" is one of them.

Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine.

NOTE-1:  This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files.  It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers.  It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more.

Please Close all open work before you actually do begin this run.

FRSTENGLISH program location:   D:\Microsoft repair tools folder. The tool is already on system. That is what we will use.

Please download the attached fixlist.txt file and save it to D:\Microsoft repair tools

Fixlist.txt<- < - - - -

NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work.

Right-click with your mouse on  FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important.

next, press the Fix button just once and wait.

You will see a green-color scroll display while FRST is running.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the D:\Microsoft repair tools folder (Fixlog.txt) . Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply.

NOTICE: For potential outside readers,  This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm.

Edited January 5 by Maurice Naggar

[dbg]

By FRSTENGLISH you mean FRST64.exe? 

After running the fix with frst64.exe, here's the fixlog-

took like 5-10mins.

Fixlog.txt

[Maurice Naggar]

The custom-run is good. The Windows System File Checker has made some corrections.

Windows Resource Protection found corrupt files and successfully repaired them.

This last run has completed what was originally intended. 

There is still one other Windows service that needs attention. Also, the Microsoft Defender antivirus is not running. Further than that, this Windows OS build version is very much not the latest build release. It shows as Windows 11 Home Version Dev 22000.1

You need to insure you accept any Microsoft offer of a Windows Eleven Feature Update or one that shows as a Cumulative Update for Windows 11.

I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start  button, and then go to Settings  > Update & Security  > Windows Update . and click Check for Updates.
Have much patience.

Note, do not take any update that has "PREVIEW' in its description or title.
DO take those that may mention "Feature Update" or "enablement package". Those optional updates you will need to affirmatively select.

Stick with me. There is a lot more to do.

[dbg]

Sorry for the late reply. Had some work.

I did the update but am stuck here-

[dbg]

I believe the network speed is not an issue here, it has to be something else.

[Maurice Naggar]

It is unfortunate that all those Microsoft Office update offers popped up in addition to the October 2023 Cumulative Windows 11 update KB 5031358.
I will do a little research and get back to you.

[Maurice Naggar]

Windows "geek speak" here. Windows Update Error code 0x800f081f means CBS_E_SOURCE_MISSING

Make a Windows Eleven Media Creation Tool with a clean reusable or new USB flash-thumb drive.
See OPTION ONE on this guide article
https://www.elevenforum.com/t/create-windows-11-bootable-usb-installation-media.750/

NEXT do a Repair Install Windows 11 with USB Installation Media
That is outlined under OPTION TWO of this guide article
https://www.elevenforum.com/t/repair-install-windows-11-with-an-in-place-upgrade.418/
 

[Maurice Naggar]

Hello. Checking up. What is the current status of the system ?

[dbg]

Sorry for the late reply again. My college recently started so was in a state of rush, struggling to make some time out for it.

 

I don't have a USB flash drive with me at the moment. Can we use any pen drive or is USB flash drive a specific device?

I have to order one from amazon or look out if I can borrow it.

[Maurice Naggar]

I believe a pen drive is also a term the same as USB-flash  or thumb drive. Best for you to buy a new one. It has to be at least 8 or 16   GB. You can get one at low cost. Here is a 32 GB USB Thumb drive by SanDisk for $7.09

https://www.newegg.com/sandisk-model-sdcz48-032g-uam46-32gb/p/N82E16820171979

 

Another for 5.70

at Newegg

 

 

Edited January 15 by Maurice Naggar

[dbg]

An update. I order the pendrive. Will take some days.

 

But today outta nowhere, I got a notification asking for a restart to install an update, I don't know where it came from, it was writter "windows 11" just. I did the restart. An installation took place. And suddenly I can find Windows defender.

[dbg]

Am running a full scan at the moment. Checked the protection history. How do i remove all these? Or are they just already removed but just shown as history. Here are some ss

[Maurice Naggar]

Congratulations on getting successful Microsoft Windows Updates. Bravo.

As to all th eold protection history from December and any date bfore today, Go into Protection History.  See about taking Action to get the entries removed.

 

Please try this:

• Press Windows key + R to invoke the Run dialog.
• In the Run dialog, type eventvwr and hit Enter to open Event Viewer.
• Under the Event Viewer (Local) section on the left-hand side of the pane, expand the Applications and Services logs option.
• Under this, expand the Microsoft option.
• Click on Windows to open the list of all its files on the middle pane.
• On the middle pane, scroll down to find Windows Defender from the list of files.
• Right-click Windows Defender, and click on Open.
• From the two options in the middle pane, right-click on Operational, and click Open to view all the past logs.
• Now, under Windows Defender folder on the left pane, right-click on Operational.
• Click on Clear Log… on the menu.
• Select Clear