win 7 security 2012

You will have to attached the 5 logs inorder for us to look at them.

 

You're welcome.

No. You will then just have 4 logs.

 

Okay MBAM and SAS removed a couple of other items from the infection and we have a few more to still remove. I'm not sure that any of these would be reasons for McAfee's Firewall not to work. Let's fix them and see what happens. Also let's do one other thing first to avoid an area of potential conflict.

Uninstall Spybot Search & Destroy 2 first.

Uninstall the below old versions of software:
Java(TM) 6 Update 20

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

If you still have a problem with McAfee's Firewall, uninstall McAfee, reboot ( don't skip the reboot ). Then reinstall McAfee.

 

You're welcome.

It appears that your Base Filtering Engine (BFE) service is missing which can cause problems with firewalls.

I have just uploaded a new version of MGtools that may provide some more incite into this problem.

Please download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )



Now attach the below log:

• C:\MGlogs.zip

 

Yes the new MGtools logs shows the below which is why you cannot start your firewall.

Code:

   Base Filtering Service is NOT running  
        C:\Windows\system32\bfe.dll is missing   

Please download SystemLook_x64 from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  Code:

  :filefind
  bfe.dll

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. You can just close this notepad window since the log is already saved on your Desktop. Be patient! It may look like it is not doing anything, but it takes awhile for this to scan thru your whole system look for matches.
• Please attach the SystemLook.txt log found on your Desktop to next reply.

 

Due you have you installation program for McAfee so that we can uninstall it, and then reinstall it later when we are ready to reinstall?

 

Good then let's continue as per below.




Goto the below link and follow the instructions for running TDSSKiller from Kaspersky

• TDSSkiller - How to run

• Be sure to attach your log from TDSSKiller

Now please also download MBRCheck to your desktop.


See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now delete the below file from your Desktop:
C:\Users\Anna\Desktop\rhvwzqkuyr.tmp


Now uninstall McAfee. Then run the below for good measure:

McAfee Consumer Product Removal Tool

Then reboot your PC. Do not skip this reboot.

After the reboot, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

 

You skipped the step where I said the below which updates the log and then you will be able to attach it.

 

Not sure what your problem with uploading is. When you browse to the file and select it, and then click upload. It uploads whatever you select. If the file is the same file, it will not upload. The file in your root folder ( that is c:\ ) shows the below

Code:

----a-w           299,544 2011-12-11 14:48:45  C:\MGlogs.zip

which appears to be new so it should have uploaded if that is what you selected.

At anyrate, I have another new version of MGtools release to help assist us in the was on this infection. And I need you to get this new version installed and I need the new log. And then later will be asking for a second one.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


Now attach the below new MGtools log before continuing.

• C:\MGlogs.zip

Now as soon as you get the new MGlogs.zip file attached, continue on with the below.

Now run the C:\MGtools\FixWFW.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). This will run very fast.



Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

I asked for two logs from MGtools. One from Before the ComboFix procedure and one from afterwards. Which one did you attach?

 

That's unfortunate as I needed that first one. Please be careful to follow instructions properly.

I found a bug in one of the MGtools programs.

Please download and save the below new version file to your C:\MGtools folder overwriting the older file. You must save them to the C:\MGtools folder.

NwkTst.bat

Now right click on C:\MGtools\NwkTst.bat file and select Run As Administrator

Then attach the updated C:\MGlogs.zip file.

​

 

Also did you run C:\MGtools\FixWFW.bat as requested?

 

A couple of your Windows servies have been deleted and need to be fixed.


I want you to download and save the below to your Desktop

• reglite.exe

Then double click on it to install the RegistrarLite program.

Now run the RegistrarLite Program and copy and paste the below into the address bar line and hit enter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root

It will look like the below

http://forums.majorgeeks.com/attachment.php?attachmentid=170228&thumb=1&d=1323728408

• Then click on Security on the top menu and select Take Ownership
• Then click on Security on the top menu and select Edit Permissions
• On the next form, in the Group or user names: section, make sure Everyone is selected. Then in the bottom pane where it says Permissions for Everyone, put a check in the Full Control box and make sure it changes. It should look like the below when done correctly

http://forums.majorgeeks.com/attachment.php?attachmentid=170229&thumb=1&d=1323728408

Now repeat the same to Take Ownership and Edit Permissions after pasting the below into the address bar and hit enter

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE

http://forums.majorgeeks.com/attachment.php?attachmentid=170230&thumb=1&d=1323728408

Let me know if you are able to get the above completed.

 

Download SubInACL.msi from Microsoft.

• Now double click on SubInACL.msi to run the installer. Accept any prompts you get about installing this.
• Now download the below file and save it to your Desktop:
  • resetperm.cmd
• Now right click onresetperm.cmd and select Run As Administrator to run this script. Be patient as this may take awhile to run. Also it is imperative that you Run As Administrator. This is not the same thing as your user account having administrator priviledges.

Once it finishes, reboot your PC.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

Okay now press the Windows key and the R key at the same time to bring up the Run box. Type in regedit and hit OK.

• Then in the Registry Editor click File, Import.
• Navigate your way to the C:\MGtools folder and locate the fixW7BFE.reg key and select it.
• Then click the Open button and allow this to be added into your registry

Tell me what happend exactly. Like do you get any error messages or do you get a success message?

 

Then it definitely did not work as this takes 10 to 20 minutes to run at least. We may have to try this from a command prompt.

Do you have all security software disabled?
Do you have UAC disabled?