Inaccessible Windows Basic Functions

[NoelDP]

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[soulcat]

Hi NoelDP,
Here is the Farbar log:

Farbar Service Scanner Version: 05-12-2013
Ran by Matt The Cat (administrator) on 23-12-2013 at 09:45:58
Running from "C:\Users\Matt The Cat\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Attempt to access Google.com returned error: Google.com is offline
Attempt to access Yahoo.com returned error: Yahoo.com is offline

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Please download the Farbar Service Scanner from

http://www.bleepingcomputer.com/download/farbar-service-scanner/

Right-click on the saved file and select 'Run as Administrator', and tick all the options, then click on the Scan button - copy and paste the report to your response.

 

[soulcat]

Hi Golden,
I will uninstall McAfee today. Since I purchased this machine 3 years ago, I've only run McAfee, MalwareBytes and Windows Defender on it. Nothing else. I'll let you know when it's completely uninstalled.

Thanks for all your help, guys.

Matt

OK. Did you see all the Conduit PUP items? They should have all been cleaned....check with Malwarebytes again to be sure.

I'm still not convinced the race condition interfering with the Windows genuine check has been solved. Did you completely uninstall McAfee? Have you ever had any other anti-malware software installed on the system prior to MaCafee?

When you run the genuine check, be sure to use this link: http://go.microsoft.com/fwlink/?linkid=52012

 

[Golden]

OK. Is Windows Defender still turned on? Once you install MSE, it will be turned off automatically since Defenders functionality is already included in MSE. You can safely have MSE and Malwarebytes on your system concurrently.

 

[soulcat]

Golden,
I just completely uninstalled McAfee. I tried installing MSE, but it keeps running into issues. So I uninstalled MalwareBytes, just in case. MSE still won't install. It gets to the question to remove other VS programs, I click continue and it says, "an error has prevented the Security Essentials setup wizard from completing successfully." I have restarted my machine several times with no luck.

OK. Is Windows Defender still turned on? Once you install MSE, it will be turned off automatically since Defenders functionality is already included in MSE. You can safely have MSE and Malwarebytes on your system concurrently.

 

[soulcat]

BTW, I turned Defender off, but MSE still won't install. Do you want me to run any logs so you can see how the system is acting?

 

[soulcat]

OK, this is weird. I put a "new" folder on my desktop and went to name it...it wouldn't rename, and windows put up an error message "Windows Is Restarting" but it didn't restart. So I tried renaming the folder again and still it wouldn't name and the same "restarting" error message, but no restart. WTF!

 

[Golden]

Mmm. This is quite a perplexing problem. sfc/scannow found no underlying system problems, yet your system seems to have some bizarre problems.

Can you be more specific about the issue with MSE? I don't understand the reference to "VS"?

 

[soulcat]

Sorry, I used VS to reference virus software. My fault. So after MSE tells me to uninstall all over anti-virus software, I click OK and it then pops up the error message saying that the wizard couldn't complete the installation.

 

[Golden]

OK. In Control Panel Programs, go through the entire list and check carefully if there are any references to other AV software.

There are certainly remnants of something preventing MSE installing...perhaps MAcafee wasn't fully uninstalled.

 

[NoelDP]

You'll need to run the MCPR (McAfee removal tool) or srun the risk of interferences from it's dregs...


Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.

After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

 

[Golden]

Thanks Noel. That was the tool recommended earlier. Hopefully thats the tool soulcat ran.

 

[NoelDP]

Can't hurt to run it again

 

[Golden]

Can't hurt to run it again

 

[soulcat]

OK, I carefully went through the entire list and MalwareBytes is the only other anti-virus/anti-malware/spyware program that's listed. Defender is turned off and I even uninstalled MalwareBytes in order to see if MSE could install. I can't figure out why it won't install. Should I try installing in Safe Mode? Would that make any difference?

 

[Golden]

Run the Macafee uninstaller again

 

[soulcat]

I've run the McAfee uninstaller 2 more times and restarted twice. MSE still won't install. Interesting thing happened...after booting up the 2nd time, Action Center had a few messages and one of them was "Solve A Problem With McAfee Virus Scan," so I clicked on it and got an error message that Windows couldn't find it. So maybe McAfee really isn't completely off the system yet. I'll run the uninstall a few more times and run MalwareBytes full scan whilst I sleep. It's midnight here in DC, so I'll catch ya on the flipside.

 

[ICIT2LOL]

MaI make a quick 2 cents suggestion - what about looking in th HKEY > CURRENT_USER & LOCAL_MACHINE > Software/s and see if McAfee is still listed there?

I have in the past had to delete stuff from those lists for Symantec in particular .

But this ONLY a suggestion I am not saying it has to be done.

 

[soulcat]

Hi guys,
I ran the McAfee removal tool again and the cmd, NETSH WINSOCK RESET. I even DLed MSE again just to make sure the setup wasn't corrupted. I ran another full MalwareBytes scan and then the AdwCleaner just to make sure and nothing new has turned up.

What about what ICit2lol suggested? What's the best way to go about doing that w/o messing up my system more?

Thanks and Merry Christmas to all.

Matt

You'll need to run the MCPR (McAfee removal tool) or srun the risk of interferences from it's dregs...


Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.

After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

 

[ICIT2LOL]

soulcat I have prepared a set of pics that will show how to get rid of reg keys but I want the others to have their say before I post them.
Before you go any further though a good idea is to back up the registry anyway I always do after I have done a new install for example.
http://www.sevenforums.com/tutorials/4230-registry-backup-restore.html

By the by I found McAfee had crept into my system while doing the set of pics and it is going to be going real soon

It just goes to show how careful you need to be downloading stuff and I usually am very aware of the add ons but this obviously went under the radar