Windows Protection Services all missing

Vespbot · Oct 6, 2012

Hey all. I appear to have a malware issue with my laptop, I only use it maybe 3 times a month and when turning it on 2 days ago I discovered I could no longer do windows updates, use Microsoft defender or Security Essentials.

I then done a Spybot S&D scan and Malwarebytes and removed all threats. I have attached the logs below.

After a few google searches I found the services were missing completely and my registry had entries removed. I found this thread.
I have since done the windows repair, re-added the 4 reg files and all Microsoft systems appear to now be running.

Could anyone please assist me with insuring nothing is still on the computer? I have attached the Farbar log but have not done any combofix or other virus scans without help.

Kestrel13! · Oct 6, 2012

Hi, you need to ensure that you have followed these procedures.

READ & RUN ME FIRST. Malware Removal Guide

Vespbot · Oct 6, 2012

Thanks for the reply. Sorry I didn't complete all the scans already, I got ahead of myself and followed the other thread.

The scans appear to have found malware still on the laptop. Here are the requested logs for Hitman, TDSskiller, roguekiller and MGtools.

Kestrel13! · Oct 7, 2012

Question: Are you purposely set up to use a proxy?

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 3 detections:

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-1918934994-2146949606-3456667402-1001\$90a8b90f401e02e331dd391082f10e9a\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$90a8b90f401e02e331dd391082f10e9a\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$90a8b90f401e02e331dd391082f10e9a\n.) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

and the same for Files/Folder entries...

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$90a8b90f401e02e331dd391082f10e9a\@ --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1918934994-2146949606-3456667402-1001\$90a8b90f401e02e331dd391082f10e9a\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$90a8b90f401e02e331dd391082f10e9a\U --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1918934994-2146949606-3456667402-1001\$90a8b90f401e02e331dd391082f10e9a\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$90a8b90f401e02e331dd391082f10e9a\L --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1918934994-2146949606-3456667402-1001\$90a8b90f401e02e331dd391082f10e9a\L --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot the machine.

Re run RogueKiller. Attach new log.

Tell me how things are running now.

Vespbot · Oct 7, 2012

Hey Kestrel13!, Yes the proxy was put on the pc by me

RogueKiller is crashing every time it attempts to delete those 3 keys. I have run as admin and still crashes. I could manually remove the 3 keys if you like, I have not done so yet in case RogueKiller does other stuff in the background.

With the files and folders listed I cannot seem to find them on the computer. they either are not there or say no longer exist. Show hidden files is turned on.

I have got AVG to detect the 2 GAC_32/64 desktop files and heal them

RogueKiller Crash log:
Problem Event Name: APPCRASH
Application Name: RogueKiller.exe
Application Version: 8.1.1.0
Application Timestamp: 506b95e0
Fault Module Name: StackHash_2eb6
Fault Module Version: 6.1.7601.17725
Fault Module Timestamp: 4ec49b8f
Exception Code: c0000374
Exception Offset: 000ce6c3
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 1033
Additional Information 1: 2eb6
Additional Information 2: 2eb6023a9446b28523af878f062b92c4
Additional Information 3: df38
Additional Information 4: df38fdabbdad7710f40f5deb49c84f48

Kestrel13! · Oct 7, 2012

Hmm, try RogueKiller in safe mode.

Vespbot · Oct 7, 2012

I ran it in XP SP3 compatibility mode and it seem to work fine.

Here is the log after the reboot.

Kestrel13! · Oct 8, 2012

So tell me, how are things currently running?

Vespbot · Oct 9, 2012

Everything still appears to be fine. have not had any strange issue and I have run a couple scans again today incase and nothing has been detected.

Everything appears to be fixed. Thanks for the help Kestrel13!

Kestrel13! · Oct 9, 2012

You are most welcome. Safe surfing!

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Windows Protection Services all missing

Vespbot Private E-2

Attached Files:

mbam-log-2012-10-04 (16-39-55).txt

mbam-log-2012-10-04 (18-22-08).txt

FSS.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Vespbot Private E-2

Attached Files:

MGlogs.zip

TDSSKiller.2.8.10.0_07.10.2012_08.46.16_log.txt

HitmanPro_20121007_0858.log

RKreport[1].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Vespbot Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Vespbot Private E-2

Attached Files:

RKreport[2].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Vespbot Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member