Used windows defender offline now windows won't start

Page 5 of 12 FirstFirst ... 34567 ... LastLast

  1. Posts : 58
    windows 7 64 bit
    Thread Starter
       #41

    so open notepad on the clean computer?
      My Computer


  2. Posts : 2,470
    Windows 7 Home Premium
       #42

    empresssoul,

    Please await my instructions before you do anything else!

    Do not run the script above.

    Thanks!
      My Computer


  3. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #43

    Yes . Sorry I wasn't very clear .
      My Computer


  4. Posts : 2,470
    Windows 7 Home Premium
       #44

    empresssoul,

    On the clean computer, please open: Notepad
    Copy/paste all the contents of the quote box below to Notepad (do not copy the word 'Quote').
    Save it on the flash drive as: fixlist.txt

    start
    C:\Windows\svchost.exe
    TDL4: custom:26000022
    ATTENTION: Malware custom entry on BCD on drive e: detected.
    cmd: bootrec /fixmbr
    cmd: bootrec /fixboot
    end
    WARNING: This script is written specifically for empresssoul, for use on this particular computer.
    Running the script on another computer may cause damage to the Operating System.

    Now, in the infected computer, plug in the USB flash drive, and enter System Recovery Options as you did before.

    Run FRST again, but this time press the Fix button just once, and wait.

    When done, the tool makes a log on the flash drive. This time it is called: Fixlog.txt

    Try to boot the computer into normal mode and post back on what happens.

    Also, please post Fixlog.txt in your reply.


    If the computer still does not boot into Windows, just hang in there.
    Last edited by cottonball; 29 Apr 2013 at 21:25.
      My Computer


  5. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #45

    Cottonball

    Wouldn't it be "ATTENTION: Malware custom entry on BCD on drive e: detected"
      My Computer


  6. Posts : 58
    windows 7 64 bit
    Thread Starter
       #46

    It worked....I am on my desktop!
    when I selected Internet explorer it won't open, but google chrome did, also my micro secur Essen is off and when attempting to turn on it comes back with an error message
      My Computer


  7. Posts : 2,470
    Windows 7 Home Premium
       #47



    Great job, empresssoul!!
    You are very good at applying instructions.

    My bad on: Malware custom entry on BCD on drive e: detected. (Your drive was not: y)
    However, it does not matter, since that is not a crucial entry.
    The rest of the entries is what matters.



    Now, let's see where the damage is, and give it a whirl.

    Please press on with Downloading Farbar Service Scanner
    Save to the Desktop
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
    • Press: Scan
    • FSS creates a log, FSS.txt, on the Desktop.
    Please provide the FSS.txt in your reply.
      My Computer


  8. Posts : 58
    windows 7 64 bit
    Thread Starter
       #48

    Farbar Service Scanner Version: 14-04-2013
    Ran by Empress (administrator) on 29-04-2013 at 22:51:23
    Running from "C:\Users\Empress\Downloads"
    Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Attempt to access Yahoo IP returned error. Yahoo IP is offline
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============

    Windows Update:
    ============

    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.


    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1


    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys => MD5 is legit
    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll => MD5 is legit
    C:\Windows\System32\bfe.dll => MD5 is legit
    C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll => MD5 is legit
    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit


    **** End of log ****
      My Computer


  9. Posts : 2,470
    Windows 7 Home Premium
       #49

    Not the results expected...

    When you open IE, what happens? Does it just flash and close, or, does it give you an error message?
    If so, describe.

    On MSE, what is the error message you are getting?
      My Computer


  10. Posts : 2,470
    Windows 7 Home Premium
       #50

    Also, please go to the TDSSKiller Download
    Select the .exe version
    Double-click on TDSSKiller.exe to run the program.


    When the TDSSKiller console opens, click on: Change Parameters
    Under Additional Options, place a check in the box next to: Detect TDLFS File System
    Click: OK


    Press: Start Scan

    •If a suspicious object is detected by this program, the default action is Skip. Leave this action as is, and click on: Continue
    •If malicious objects are found, they show in the Scan results.
    Ensure Cure (the default action) is selected, then click: Continue > Reboot now, to finish the cleaning process.
    (Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


    When done, the tool creates a log on the disk with the Windows Operating System, normally C:\


    Logs have a name like:
    C:\TDSSKiller.X.X.X_29.04.2013_15.31.43_log.txt


    Please post or attach the TDSSKiller log in your reply.
      My Computer


 
Page 5 of 12 FirstFirst ... 34567 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 08:01.
Find Us