Removed 2 malwares, now need help with DEP

[St8kout]

I was having some browser issues and the IE9 people linked me a Fixit program Fix Internet Explorer issues to make IE fast, safe and stable
and it works great, but it keeps finding the same problem after every restart, which is that DEP is disabled.

I suppose the little malware buggers are the culprits, did something that keeps disabling DEP with every bootup. Is there an easy permanent fix?

In all the many years of surfing the net since the Win 95/dialup days I've never had a malware problem until now. Microsoft's security scanner found a dozen or so "Exploit: Severe" alerts involving "Java/Blacloe...." I should have know something was up when I kept getting prompts from Sun to update but when I clicked on them the prompts just vanished. I didn't know what was happening. The only thing I even need Java for is the occasional line quality test for Speedtest.net.

 

[kegobeer]

Are you certain your computer is virus free?

 

[C-11]

Welcome to Seven Forums.

Download, install, update & scan with Malwarebytes Anti-Malware

Decline trial version while installing.

Post back with results please.

 

[St8kout]

I used this site Malware Removal Guide for Windows - Select Real Security after finding the 2 I mentioned and nothing showed up, and yes, Malwarebytes are what found them yesterday.

Ran it a few more times yesterday and today and it found nothing.

 

[kegobeer]

Open up an elevated command prompt and type sfc /scannow. That will reboot the computer, scan and hopefully find and replace damaged Windows system files. Run it at least twice, preferably three times, as sometimes it can take a few passes to find and fix everything.

 

[St8kout]

Ran it 3 times and it says, did not find any integrity violations.

I kept waiting for it to reboot but it never did. Did I miss something?

 

[M1GU31]

Ran it 3 times and it says, did not find any integrity violations.

I kept waiting for it to reboot but it never did. Did I miss something?

Reboot manually

 

[karlsnooks]

St8kout,

Let's bring out the big guns and blow your malware out of the water.

HOW TO USE WINDOWS DEFENDER OFFLINE ON A USB STICK
Windows Defender Offline
· is a free standalone, bootable malware and virus remover from Microsoft.
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

Download Windows Defender Offline (about 764 kB)

You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
You will need an Internet Connection.
Insert 512 mB (Microsoft’s 256 mB is no longer accurate) or larger USB stick into a usb port.
Run the downloaded program--mssstool64.exe or mssstool32.exe
NEXT button
Choose the option On a USB flash drive that is not password protected
NEXT button
NEXT button
.
The install program will format the usb stick using the NTFS format.
The install program will download about 210 mB.
The install program will name the USB stick WDO_Media32 or WDO_Media64
The WDO_Media32 usb stick will have used space of 255 mB (268,140,544 bytes)
The WDO_Media64 usb stick will have used space of 282 mB (296,165,376 bytes)
You can expect the number of mB to increase as more malware appears.

UPDATE Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download about 66 mB (mssstool32.exe) and 68 mB (mssstool64.exe).

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.


RESULTS OF THE SCAN
The results will be in 4 log files on your computer's disk in:
\Windows\Microsoft Antimalware\Support

 

[St8kout]

I went back into safe mode and re-ran Malwarebytes, then HitmanPro, just to make sure. MWB came up empty but Hitman found a bunch of cookies it didn't like and removed them. Rebooted and Fixit still showed DEP disabled.

Then I ran |MG| Tweaking.com - Windows Repair 1.7.5 Download as suggested by the Malware Removal site posted earlier. It had me run CHKDSK and the same sfc /scannow before it repaired anything. It found and repaired 21 registry errors, rebooted, and I STILL found DEP disabled upon startup.

Before I try your suggestion, Karl, I have Windows Defender but Microsoft Security Essentials disabled it by default. Is that going to be a problem running it from a usb stick with MSE installed?

 

[kegobeer]

No, it won't be a problem. Windows will not be running - Windows Defender will boot from the USB stick and it will scan without any issues.

 

[karlsnooks]

I have said it before and I will say it again:

WINDOWS DEFENDER OFFLINE IS NOT Windows Defender.

Just click on the link for WDO in my signature or on the link given in the write-up and you will get a thorough explanation.

This link is also informative:
Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

 

[St8kout]

It found a Trojan: JS/Redirector.JA and removed it.
However, I ran the Fixit and once again DEP was disabled on startup.*sigh*

Here's what Microsoft says about it:

Technical Information (Analysis)
Trojan:JS/Redirector.JA is a trojan, written in highly obfuscated JavaScript, that redirects users to websites that promote a male enhancement product.


One thing, when I clicked on Full Scan it did not offer an option to select any drives. I found that only on Custom Scan, which I ran afterwards just to make sure. Shows all clean now.

Thought I was home-free for a moment there. Could DEP just be collateral damage from the Trojan now that it's gone, or could there be something else hiding somewhere?

Oh, and thanks for all the help so far. Didn't have a clue about Defender offline until today.

 

[karlsnooks]

can you now set DEP and it stay set?

 

[St8kout]

Sadly, no. It's still being disabled after each restart. Does that mean there could still be something lurking around?

 

[karlsnooks]

since you say that you have run WDO, then please:
# **********************INSTRUCTIONS**************************
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR ******************
# ************************************************************
#
# WIN key | type POWERSHELL | do NOT hit ENTER |
# in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
# choose "Run as administrator" |
# Click on the YES button (if such appears)
#
# WIN key = key with Microsoft log on top
#
# for the guru:
# WIN | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 ** COPY AND PASTE ***********************************
# ************************************************************
#
# COPY the script using CTRL+C,
# COPY every line of script down thru both EXIT statements
#
# PASTE into Powershell
#----Right-Click at the PowerShell Prompt
#----(Ctrl+V does not work)
#
# Start copying with first script line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#-------Lines starting with a # are ignored by PowerShell
# ************************************************************
# STEP 3 ** SCRIPT OUTPUT & SCRIPT PURPOSE *******************
# ************************************************************
# --The script output and purpose is given at the very front of the script
#
# --The script output and purpose is given at the very front of the script
#
# ************************************************************
# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#--The system can not find the path specified
# you may need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#---Run PowerShell
#---enter $host.version
#---you should see at least:
# Major Minor Build Revision
# ----- ----- ----- --------
# 2......0......-1.....-1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#---Run PowerShell
#---enter SET-EXECUTIONPOLICY -EXECUTIONPOLICY REMOTESIGNED
# ************************************************************

# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# ************************************************************

function New-Zip {
    param([Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
    [String] $Path, [Switch] $PassThru, [Switch] $Force )
    Process { if (Test-Path $path) {if (-not $Force) { return } }
    Set-Content $path ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
    $item = Get-Item $path; $item.IsReadOnly = $false;if ($passThru) { $item } } }
function Copy-ToZip {param(
  [Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  Begin {$ShellApplication = New-Object -ComObject Shell.Application
  if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path = Resolve-Path $ZipFile
  $ZipPackage =$ShellApplication.Namespace("$Path")}
  Process {$RealFile = Get-Item $File; if (-not $RealFile) { return }        
  if (-not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc = 0 } 
    Write-Progress "Copying to $ZipFile" $RealFile.FullName -PercentComplete $perc}
  $Flags = 0; if ($force) {$flags = 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage.CopyHere($realFile.Fullname, $flags);Start-Sleep -Milliseconds 500}}

$fileinfo = join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir = $env:windir + '\Microsoft Antimalware\Support'
$a = dir $dir  -rec -force -ea:silentlycontinue | sort-object -property lastwritetime 
$b = $a | where {$_.extension -eq '.log'} |Select  mode, fullname, name, creationtime, lastwritetime,  lastaccesstime, length, extension
$b | out-file -append $fileinfo
$b | foreach ($_.fullname) {get-content -path $_.fullname} | out-file -append $fileinfo 
$ziploc = $env:userprofile + '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ************************************************************

 

[Layback Bear]

I have said it before and I will say it again:

WINDOWS DEFENDER OFFLINE IS NOT Windows Defender.

Just click on the link for WDO in my signature or on the link given in the write-up and you will get a thorough explanation.

This link is also informative:
Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

Thanks karl great websit.

 

[grits]

S'cuse my intrusion, what is DEP & how would I know if mine is enabled or disabled?

 

[Layback Bear]

Google is your friend.
http://windows.microsoft.com/en-us/windows-vista/Data-Execution-Prevention-frequently-asked-questions

 

[Layback Bear]

Google is your friend.
Change Data Execution Prevention settings

 

[St8kout]

Here ya go Karl.