dbg Posted January 3 ID:1609018 Share Posted January 3 Recently I downloaded a crack game. A big mistake. I had to quickly delete it but the harm was already done. My windows defender got deleted. How do i get it back? Following an earlier forum from here, I did the following scans- 1. MSERT 2. FRST (+Addition) 3. FSS 4. ESET Now I am not sure what to do next... FSS.txt eset_scan.txt msert.log FRST.txt Addition.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 3 ID:1609033 Share Posted January 3 Hello. Please allow me some time to go over your reports. Very saddened to read some crack was allowed willingly onboard. It has DINGED the MS Defender. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 3 ID:1609040 Share Posted January 3 My name is Maurice. I will guide you. The act of using or installing that "crack" has resulted in damage to at least three Microsoft Windows services. wscsvc Service , Windows security center service is Missing. wuauserv Service, Windows Update service is Disabled. WinDefend Service , Microsoft Defender antivirus main engine, is Disabled. I will help you on getting those back to standard normal. Removing pesky malware can be an involved set of tasks over separate runs. Have much patience. Follow my directions. Please don't run any other scans, download, install or uninstall any programs while I'm working with you. Only run the tools I guide you to. Do not run online games while case is on-going. Do not do any free-wheeling web-surfing. The removal of malware isn't instantaneous, please be patient. Cracked or or hacked or pirated programs are not only illegal, but also will make a computer a malware victim. Having such programs installed, is the easiest way to get infected. It is the leading cause of ransomware encryptions. It is at times also big source of current trojan infections. Please uninstall them now, if any are here, before we start the cleaning procedure. Please stick with me until I give you the "all clear". If your system is running Discord, please be sure to Exit out of it while this case is on-going. Do these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start. 1. Show-Hidden-Folders-Files-Extensions https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/ 2. Disable-Fast-Startup https://forums.malwarebytes.com/topic/299350-disable-fast-startup/ Next, we use Malwarebytes to check for any other potential malware. Malwarebytes can detect and remove most malware with no further actions required for free. Please download, install, update Malwarebytes from this link and do a Threat Scan with Malwarebytes see guide link and post back the log as shown below. Then, locate the Scan run report; export out a copy; & then attach in with your reply. See see how-to link Next, an adjustment, Please do the following actions, so that Microsoft Defender antivirus runs side-by-side along with Malwarebytes. Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center Click the Security Tab. Scroll down to "Windows Security Center" Click the selection to the left for the line "Always register Malwarebytes in the Windows Security Center". { We want that to be set as Off .... be sure that line's radio-button selection is all the way to the Left. thanks. } IF that line-selection is greyed-out unavailable, do not fret. Just skip over that. This will not affect any real-time protection of the Malwarebytes for Windows 😃. Close Malwarebytes. > Stick with me until after I give the all clear. There is more to do. Link to post Share on other sites More sharing options...
dbg Posted January 3 Author ID:1609070 Share Posted January 3 Soon after i posted it, i found out windows update was disabled because of an application by "novirusthanks". The windows update was turned disabled. I enabled it. I updated my windows. Windows defender is still missing. Its late night here. I shall reply as soon as i get your recommended steps done. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 3 ID:1609076 Share Posted January 3 Thank you for the information. I look forward to getting the scan report from Malwarebytes. Link to post Share on other sites More sharing options...
dbg Posted January 4 Author ID:1609219 Share Posted January 4 I followed the steps. Here's the Malwarebytes scan report. malwarebytesscan.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 4 ID:1609228 Share Posted January 4 This Malwarebytes scan found and removed a lot of threats. Let's do one scan with Malwarebytes Adwcleaner. It will not take much time, First download & save it download link Then go to where the EXE file is saved. Start Adwcleaner. Do not rush. Reply YES at the Windows prompt to allow the program to proceed and make changes. That is the usual Windows security prompt. Now On the left side of the AdwCleaner window, click on “Dashboard” and then click “Scan” to perform a computer scan. This can take several minutes. When the AdwCleaner scan is completed it will display all of the items it has found. Click on the “Quarantine” button To remove what it found. AdwCleaner "may" prompt you to save any open files or data as the program 'may' need to close any open programs before it starts to clean. Click on the “Continue” button to finish the removal process. Guide article Attach the clean log from Adwcleaner when all completed. For example AdwCleaner[C00],txt Link to post Share on other sites More sharing options...
dbg Posted January 4 Author ID:1609238 Share Posted January 4 Adwcleaner report- Also what's this script host window? It has been appearing every time I start my computer for the last few days. AdwCleaner[S00].txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 4 ID:1609246 Share Posted January 4 On that message window about Run.vbs just click the X button to get that out of the way. It is not a show stopper. Now a different scan with another security scanner. You should first Close as many of your open-user app-screens as possible. That is to say, Exit all that you do not need to have open. This with Kaspersky KVRT tool. Download Kaspersky Virus Removal Tool (KVRT) from here: https://www.kaspersky.com/downloads/thank-you/free-virus-removal-tool and save to your Desktop. Next, Select the Windows Key and R Key together, the "Run" box should open. Drag and Drop KVRT.exe into the Run Box. C:\Users\Welcome\DESKTOP\KVRT.exe will now show in the run box. add -dontencrypt Note the space between KVRT.exe and -dontencrypt C:\Users\Welcome\DESKTOP\KVRT.exe -dontencrypt should now show in the Run box. That addendum to the run command is very important. To start the scan select OK in the "Run" box. The Windows Protected your PC window "may" open, IF SO then select "More Info" A new Window will open, select "Run anyway" A EULA window will open, tick both confirmation boxes then select "Accept" Go slow & careful on this part. In the new window select "Change Parameters" In the new window ensure the following boxes are ticked: System memory Startup objects Boot sectors System drive Then select "OK" and "Start scan“. The Kaspersky tool is very thorough so will take a considerable time to complete, please allow it to finish. Also while Kaspersky runs do not use your PC for anything else.. you completed: If entries are found, there will be options to choose. If "Cure" is offered, leave as it is. For any other options change to "Delete", then select "Continue". Usually, your system needs a reboot to finish the removal process. Logfiles can be found on your systemdrive (usually C: ), similar like this: Reports are saved here C:\KVRT2020_Data\Reports and look similar to this report_20240105_203000.klr Right click direct onto those reports, select > open with > Notepad. Save the files and attach them with your next reply Have lots of patience, as this will most likely run for many hours. Also, be aware I am a volunteer here. I help here as personal time permits. I am not on all the time. Link to post Share on other sites More sharing options...
dbg Posted January 4 Author ID:1609280 Share Posted January 4 I just got banned, don't know why. I changed the wifi and am now able to sign in again. That was scary. Anyway- Scan is complete. I wonder why it shows processing in the scan results window when i press the details option. But here are the results. report_2024.01.04_22.39.20.klr.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 4 ID:1609290 Share Posted January 4 The Recheck on these 2 steps so that ALL folders & Files are set to SHOW, plus also, Turn OFF Windows Fast start. 1. Show-Hidden-Folders-Files-Extensions https://forums.malwarebytes.com/topic/299345-show-hidden-folders-files-extensions/ 2. Disable-Fast-Startup https://forums.malwarebytes.com/topic/299350-disable-fast-startup/ 3. This next report I truly need. I would like a report set for review. This is a report only. This is the first beginning step so I can see what is what on this particular machine. Please download MALWAREBYTES MBST Support Tool Once you start it click Advanced >>> then Gather Logs Have patience till the run has finished. Attach the mbst-grab-results.zip from the Desktop to your reply.. Kaspersky KVRT scan indicates iy found no virus; no trojan; no threat. Link to post Share on other sites More sharing options...
dbg Posted January 5 Author ID:1609409 Share Posted January 5 The MBST grab results- mbst-grab-results.zip Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 5 ID:1609505 Share Posted January 5 (edited) The "crack game infection" has dinged at least three Windows services, Windefend, Sense, and MSSECFLT. That is why you got the black screen on Security at a glance/ It also appears that there are two obfuscated trojans. A scheduled task referring to "run.vbs" is one of them. Please run the following custom script. Read all of this before you start. The meaning of the "Fix button" operation here is just to run a custom script just for this particular machine. NOTE-1: This custom fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will attempt to run some scans with Microsoft Defender antivirus. It will attempt to clear Cache files of web browsers. It will attempt to clear temporary file areas. It rebuilds the Winsock. Depending on the speed of your computer this fix may take 50-55 minutes or more. Please Close all open work before you actually do begin this run. FRSTENGLISH program location: D:\Microsoft repair tools folder. The tool is already on system. That is what we will use. Please download the attached fixlist.txt file and save it to D:\Microsoft repair tools Fixlist.txt<- < - - - - NOTE. It's important that both files, FRSTENGLISH, and fixlist.txt are in the same location or the fix will not work. Right-click with your mouse on FRSTENGLISH and select "Run as Administrator" and reply Yes and allow it to proceed when prompted. That is important. next, press the Fix button just once and wait. You will see a green-color scroll display while FRST is running. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the D:\Microsoft repair tools folder (Fixlog.txt) . Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. The system will be rebooted after the fix has run. Attach FIXLOG.txt with next reply. NOTICE: For potential outside readers, This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause harm. Edited January 5 by Maurice Naggar Link to post Share on other sites More sharing options...
dbg Posted January 6 Author ID:1609640 Share Posted January 6 By FRSTENGLISH you mean FRST64.exe? After running the fix with frst64.exe, here's the fixlog- took like 5-10mins. Fixlog.txt Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 6 ID:1609656 Share Posted January 6 The custom-run is good. The Windows System File Checker has made some corrections. Windows Resource Protection found corrupt files and successfully repaired them. This last run has completed what was originally intended. There is still one other Windows service that needs attention. Also, the Microsoft Defender antivirus is not running. Further than that, this Windows OS build version is very much not the latest build release. It shows as Windows 11 Home Version Dev 22000.1 You need to insure you accept any Microsoft offer of a Windows Eleven Feature Update or one that shows as a Cumulative Update for Windows 11. I would highly suggest to insure that this pc is all up-to-date with security updates & cumulative updates on Windows. select the Windows Start button, and then go to Settings > Update & Security > Windows Update . and click Check for Updates. Have much patience. Note, do not take any update that has "PREVIEW' in its description or title. DO take those that may mention "Feature Update" or "enablement package". Those optional updates you will need to affirmatively select. Stick with me. There is a lot more to do. Link to post Share on other sites More sharing options...
dbg Posted January 9 Author ID:1610284 Share Posted January 9 Sorry for the late reply. Had some work. I did the update but am stuck here- Link to post Share on other sites More sharing options...
dbg Posted January 9 Author ID:1610285 Share Posted January 9 I believe the network speed is not an issue here, it has to be something else. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 9 ID:1610342 Share Posted January 9 It is unfortunate that all those Microsoft Office update offers popped up in addition to the October 2023 Cumulative Windows 11 update KB 5031358. I will do a little research and get back to you. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 9 ID:1610347 Share Posted January 9 Windows "geek speak" here. Windows Update Error code 0x800f081f means CBS_E_SOURCE_MISSING Make a Windows Eleven Media Creation Tool with a clean reusable or new USB flash-thumb drive. See OPTION ONE on this guide article https://www.elevenforum.com/t/create-windows-11-bootable-usb-installation-media.750/ NEXT do a Repair Install Windows 11 with USB Installation Media That is outlined under OPTION TWO of this guide article https://www.elevenforum.com/t/repair-install-windows-11-with-an-in-place-upgrade.418/ Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 13 ID:1611207 Share Posted January 13 Hello. Checking up. What is the current status of the system ? Link to post Share on other sites More sharing options...
dbg Posted January 15 Author ID:1611635 Share Posted January 15 Sorry for the late reply again. My college recently started so was in a state of rush, struggling to make some time out for it. I don't have a USB flash drive with me at the moment. Can we use any pen drive or is USB flash drive a specific device? I have to order one from amazon or look out if I can borrow it. Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 15 ID:1611644 Share Posted January 15 (edited) I believe a pen drive is also a term the same as USB-flash or thumb drive. Best for you to buy a new one. It has to be at least 8 or 16 GB. You can get one at low cost. Here is a 32 GB USB Thumb drive by SanDisk for $7.09 https://www.newegg.com/sandisk-model-sdcz48-032g-uam46-32gb/p/N82E16820171979 Another for 5.70 at Newegg Edited January 15 by Maurice Naggar Link to post Share on other sites More sharing options...
dbg Posted January 17 Author ID:1612090 Share Posted January 17 An update. I order the pendrive. Will take some days. But today outta nowhere, I got a notification asking for a restart to install an update, I don't know where it came from, it was writter "windows 11" just. I did the restart. An installation took place. And suddenly I can find Windows defender. Link to post Share on other sites More sharing options...
dbg Posted January 17 Author ID:1612092 Share Posted January 17 Am running a full scan at the moment. Checked the protection history. How do i remove all these? Or are they just already removed but just shown as history. Here are some ss Link to post Share on other sites More sharing options...
Maurice Naggar Posted January 17 ID:1612094 Share Posted January 17 Congratulations on getting successful Microsoft Windows Updates. Bravo. As to all th eold protection history from December and any date bfore today, Go into Protection History. See about taking Action to get the entries removed. Please try this: Press Windows key + R to invoke the Run dialog. In the Run dialog, type eventvwr and hit Enter to open Event Viewer. Under the Event Viewer (Local) section on the left-hand side of the pane, expand the Applications and Services logs option. Under this, expand the Microsoft option. Click on Windows to open the list of all its files on the middle pane. On the middle pane, scroll down to find Windows Defender from the list of files. Right-click Windows Defender, and click on Open. From the two options in the middle pane, right-click on Operational, and click Open to view all the past logs. Now, under Windows Defender folder on the left pane, right-click on Operational. Click on Clear Log… on the menu. Select Clear Link to post Share on other sites More sharing options...
Recommended Posts