Removed 2 malwares, now need help with DEP

[St8kout]

Do I need to go back and set my execution policy back to 'NO'?

 

[karlsnooks]

St8kOut,
St8kout,

If you still can not get the DEP setting to stick then:
Most probably you have reinfected yourself.

What anti-virus software you using?

==================================
==================================

Please carry out:
Install CCleaner:
CCleaner - PC Optimization and Cleaning - Free Download

list of STARTUP PROGRAMS

CCleaner | Tools icon | Startup button | Windows tab |
click on Save to text file button (bottom right side) |
accept Startup.txt as file name | SAVE button

list of SCHEDULED TASKS

CCleaner | Tools icon | Startup button | Scheduled Tasks tab |
click on Save to text file button (bottom right side) |
enter Scheduled Tasks as File name | Save button

List of INSTALLED PROGRAMS

CCleaner | Tools icon | Uninstall button |
click on Save to text file button (bottom right side) |
accept install.txt as File name | Save button


UPLOAD, as an attachment, the startup.txt file
UPLOAD, as an attachment, the Scheduled Tasks.txt file
UPLOAD, as an attachment, the install.txt file.

HOW TO UPLOAD
Post a File or Screenshot in Seven Forums

 

[St8kout]

I was using Windows Defender, then that was replaced by Microsoft Security Essentials. I should point out that when I went to use MSE a few days ago when all this started I found it had been disabled.

I also use Advanced System Care 5 which I guess I put a little too much faith into as it's supposed to check for malware. I run it everyday.

Today I installed the free version of AVG. It didn't find anything but the tuneup part repaired some 900 items. It also said it corrected some Firewall problems. Didn't know I had any. I also ran Anti-Spy.Info today and it came up clean. Was about to try CCleaner so I'll do that now.

From what I've read no one program can find everything, so I'm trying them all I guess, lol. But since using Defender on a stick nothing else is showing up.

I had checked the DEP setting immediately after Defender offline rebooted and it was still affected, so I don't know if there is some other infection or that file is corrupted.

At this point I'm thinking window reinstall would be a lot easier and safer. I do have some documents and other things I absolutely have to save but don't know if they are infected. I'm about to close on a new house and have all this paperwork on my computer.

 

[karlsnooks]

Windows Defender is NOT an AV solution. Windows Defender was used to remove nasty malware and was not running continuously.

Here at the end, I'm going to give you a link. I would like for you to go there and read about Microsoft security components.

Now remove AVG immediately if not sooner.

Put MSE back on there. Your problems were not due to or caused by MSE.

You had a nasty "rootkit" type of infection which WDO got rid of since it is an Offline solution.

Once your system is clean, the MSE will keep your system clean.

Get rid of Advanced Care! There is a good bit of your problems.

I need those three programs. Your software is causing the problem. If you reinstall Win 7 and then reinstall the same enemies, then you will be fighting the same battles again.

First, carry out the advice above,
2nd, I need those three files.
3rd, here is the promised link: Understanding Microsoft Anti-Malware Software 2012 ~ Security Garden

 

[St8kout]

Here they are

 

[karlsnooks]

While we are working on putting your system in order then:

UNINSTALL

Advanced SystemCare 5    IObit    6/15/2012    85.8 MB    5.3.0
Anti-Spy.Info 1.8d    Neuber Software    7/18/2012        1.8d
AVG 2012    AVG Technologies    7/18/2012        2012.0.2197
AVG PC Tuneup    AVG    7/18/2012    42.4 MB    10.0.0.27
Bonjour    Apple Inc.    3/19/2012    2.00 MB    3.0.0.10
CESAM: Online Solutions Anti-Malware v5.0    Online Solutions    7/16/2012    5.91 MB    5.0.11926.0
Futuremark SystemInfo    Futuremark Corporation    7/18/2012        4.9.0
Internet Explorer (Enable DEP)        7/18/2012        
MSI Afterburner 2.1.0    MSI Co., LTD    7/17/2012        2.1.0
Spybot - Search & Destroy    Safer Networking Limited    7/18/2012        1.6.2
Tweaking.com - Windows Repair (All in One)    Tweaking.com    7/17/2012        1.7.5

REBOOT

Due to the high number of changes and the effects they will have,
I need you to submit a fresh set of those three files after perfoming these uninstalls.

thanks,
karl

 

[St8kout]

Lol, all those uninstalls kept opening a webpage wanting an explanation from the companies. "What's wrong with our program?"

 

[karlsnooks]

Until you system is in order then:
CCLEANER | TOOLS icon | STARTUP tab | SCHEDULED TASKS tab |
Use DISABLE button to disable ALL

Close CCleaner.


REBOOT!

You have not disabled any programs. You have disabled the scheduled running.
Later, after your system is running smoothly, you may reenable desired programs.

 

[karlsnooks]

WIN | type MSCONFIG | ENTER | STARTUP tab |
Uncheck ALL except for:

Sidebar    Microsoft Corporation    C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSC    Microsoft Corporation    "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

REBOOT!

You have just told Win 7 to not run unchecked programs at start up time.

You have not disabled the programs. They will be run when needed.

WIN = key with the Microsoft logo on top

=============================================
=============================================

After this reboot is finished, then:
Enable DEP

and see if it stays enabled.

thanks,
karl

 

[St8kout]

I should point out that I'm relying on Microsoft's Fixit program to tell me DEP status.

Everything I run it it says it finds that problem and fixes it. So if it is indeed finding it disabled, then no, something keeps constantly disabling it right after Fixit enables it again. I can run Fixit over and over again and still get the same result each time.

Other than that everything else seems to be working properly. Web pages open instantly now (taking way too long was one of the symptoms), back button no longer reloads the current page (another symptom), no odd behavior of anything so far.

I do appreciate all the time you spent helping me with this. It almost seem like you actually wrote Windows yourself, lol.

 

[karlsnooks]

The time has come for you to fill out your system specs. When you do, then at the bottom, underneath where your name appears, there is "My System Specs" in small and difficult to read letters.

Fortunately, one quickly learns where that is and we click on that to instantly inform us as to your system. No need to try to search an entire thread for info that may not even be there.


Please follow this procedure. I recommend Speccy, but that's personal choice.

Update your SevenForums System Specs
User CP (located on the top menu bar) |
Your Profile | Edit System Spec (left-hand column)

To gather info, use Speccy (my favorite) or SIW or System Info

In the System Manufacturer Block, enter:
Manufacturer and Model and
ADD the word laptop, desktop, netbook or tablet.
For example:
Toshiba Satellite L305D notebook.

Provide full windows version info, for example:
MS Windows 7 Ultimate SP1 64-bit

Use the “Other Info” block for Optical Reader,
Mouse, touchpad, wifi adapter, speakers, monitor, etc

Scroll down and click on SAVE CHANGES.

You will find that in Speccy, you can select info from the display
using your mouse/touchpad and then paste that info into your specs.

SIW is a marvelous program, but the free version does not offer
this capability.

 

[St8kout]

Specs loaded and done.

 

[karlsnooks]

St8kOut,

WIN + PAUSE key | System Protection (left-side) | Advanced tab |
Settings button ( in the Performance section) | Data Execution Prevention tab |
Turn on DEP for all programs and services except for those I select: Radio Button |
OK button | OK button

WIN = key with the microsoft logo on top


That's how one normally turns DEP on and off.

If you turn it on, does it stay on?

 

[St8kout]

The button stays 'on' but microsoft's Fix It program keeps saying it was disabled and the fix supposedly re-enables it. Same message everytime I run it. Could the Fix It program be wrong?

 

[karlsnooks]

Yes. My guess would also be that the FixIt program is wrong. In a few hours I will go looking for reading and writing DEP values using PowerShell.

 

[Layback Bear]

I don't know if this will help but what the heck. My DEP is set to protect Windows programs and services; the top one. I have never changed it. It's been that way from the install as far as I know. I don't know which one is better.

 

[karlsnooks]

Actually, the other setting is better which protects you against all programs.

If you ever run across a program that needs kernel access, then you can add the program as an exception.

I've never needed to add one.

 

[Layback Bear]

I will change it and see what happens if anything.

 

[karlsnooks]

St8kout,

I've been playing around with the DEP and would like your you to run a PowerShell one liner for me and post back the output which will be a file on your Desktop named BCDEDITinfo.TXT


Here's how to run a one-liner:
# STEP 1 ** RUN POWERSHELL AS ADMINISTRATOR
WIN key | type POWERSHELL | do NOT hit ENTER |
in the PROGRAMS list, right-click on WINDOWS POWERSHELL |
choose "Run as administrator" |
Click on the YES button (if such appears)

# STEP 2 ** COPY AND PASTE
COPY the script using CTRL+C,
PASTE into Powershell
---Right-Click at the PowerShell Prompt
---(Ctrl+V does not work)

WIN key = key with Microsoft logo on top

Here's the one-liner:
&$env:windir\system32\bcdedit /enum > $env:userprofile\desktop\bcdeditinfo.txt

 

[St8kout]

Here's the file.

Something else has been happening. For the last two days Windows won't shut down anymore. I let it go on for about 20 minutes one time to see what would happen. Eventually I had to hold down the power button to turn it off. It wasn't doing a microsoft update or anything, or if it was there was no message that you usually see.

Restarts seem to be ok. It's just the 'Shutdown' not working now.