Windows Security Center can't be started because of virus/malware

Ok, this is weird...I did save the file in "Notepad" and dragged it over the way you said I should, but then I got this message saying the program/file was changed and now I can't find the ComboFix! It said I might have gotten a virus out of it as well :confused: I tried to download ComboFix again, but a window pops up and says that it contains something bad that can damage my computer and I'm afraid to download it if you get my point. What should I do?
 

My Computer My Computer

At a glance

Windows 7 Ultimate, 32bit
OS
Windows 7 Ultimate, 32bit
perhaps I missed it - but have you had the chance to try WDO from post #2?
 

My Computer My Computer

At a glance

W7 Pro SP1 64biti78GBIntel HD Graphics
Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
UsernameIssues, I'm afraid I haven't as I don't have access to a "clean" computer.
 

My Computer My Computer

At a glance

Windows 7 Ultimate, 32bit
OS
Windows 7 Ultimate, 32bit
If I could not borrow a clean computer, I would make one using virtualbox.
 

My Computer My Computer

At a glance

W7 Pro SP1 64biti78GBIntel HD Graphics
Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
How do you do that, and how does it work? :)
 

My Computer My Computer

At a glance

Windows 7 Ultimate, 32bit
OS
Windows 7 Ultimate, 32bit
Last edited by a moderator:

My Computer My Computer

At a glance

W7 Pro SP1 64biti78GBIntel HD Graphics
Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
Crumble,

You do not need problems with ComboFix. We need to look at the system before Windows starts,
and to work with the program described below, you need to find someone who has a computer you can use for just a few minutes. That would be the easiest way to go.

Also, you may want to print these instructions so you can have access to follow them.

Please plug a flash drive into a clean computer.
Go to Start > Computer
Double-click Computer, and select the flash drive.
Right-click and select: (Quick) Format
Press Start on the Format prompt.
Remove when done.

Now, download Farbar Recovery Scan Tool (32-bit):
http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Save the program to the >> USB flash drive.

Next, plug the flash drive into the infected computer.




>>>Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select your language settings, and click: Next
  • Select your User account and click: OK (If you did not set a password, leave blank.)
On the System Recovery Options menu you get the following options:
  • Startup Repair
    [*]System Restore
    [*]Windows Complete PC Restore
    [*]Windows Memory Diagnostic Tool
    [*]Scan your computer's memory for errors.
    [*]Command Prompt
Select Command Prompt
  • In the Command window, at the bliking cursor type notepad and press: Enter
  • In Notepad, under the File menu select: Open
  • Double-click Computer, find the flash drive letter, remember what letter it is, click on it, and press: Open
  • Close out of Notepad.
  • Click the Command window
  • Type g:\frst.exe, and press: Enter
    Note: Replace the drive letter g with the drive letter of your flash drive, if necessary!
  • The tool starts and prepares to run. Follow the prompts.
  • Click Yes to the disclaimer.
  • Press the Scan button.
  • The program saves the FRST.txt, on the flash drive.
  • Click the Command prompt window, type exit, and press: Enter
  • Back at the System Recovery Options, press: ShutDown, or Restart
Please provide the FRST.txt (located in the flash drive) in your reply.
 
Last edited:

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
It is your choice as to which program you want to use at this point. Both programs scan the computer for malicious entries.

FRST allows us to analyze the system, identify the malware before Windows starts, and for us to decide what to remove and what other actions need attention.

MDO removes the malware found, using its malware definitions. However, malware definitions vary amongst programs.

More than likely, we will end up using both programs.



@UsernameIssues,

Thanks for all the useful links.
 
Last edited:

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Crumble,


Important!

Today, a notice came out that an executable in ComboFix is infected.

Quoting the notice:

The steps we suggest you take to make sure your computer is not infected are:

At this point, before you pursue any instructions, suggest you download and run the Free version of ESET Online Scanner.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
You need to use Internet Explorer for this scan.

Please right click the IE shortcut and select: Run as Administrator

Click on: Run ESET Online Scanner
Click: Start

When asked, allow the add/on to be installed
Click: Start again
Click on: Advanced Settings


Make sure these options are checked:
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
Click: Scan

When the scan is complete

If threats are found:
  • Click on: List of threats found
  • Click on: Export to text file
  • Save to the Desktop and name it ESET Scan Results
  • Click on: Back
  • Place a check on: Uninstall application on close
  • Click on: Finish, and close the program.
Please provide the ESET report in your reply.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
shawn77,

See post #49

Crumble has the option to use any of these tools.

Sality has been around for quite a while, as I am sure you know, and any of these tools should be able to detect and remove Sality from the computer.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
The ESET Online Scanner found and deleted 16 treaths:

C:\Users\siri1802\AppData\LocalLow\Sun\Java\JRERunOnce.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\AppData\Roaming\Mozilla\Firefox\Profiles\sqlite3.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\adwcleaner.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\chromeinstall-7u11.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\ConvertHelperSetup.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\Firefox Setup 15.0.1.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\FSS.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\mbam-setup-1.70.0.1100.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\mseinstall (1).exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\mssstool32.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\SecurityCheck.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\setup_Min_CeWe_Fotoverden.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\Silverlight.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\SoftonicDownloader_for_vlc-media-player.exe Win32/Sality.NBA virus cleaned - quarantined
C:\Users\siri1802\Downloads\SpotifySetup.exe Win32/Sality.NBA virus cleaned - quarantined
C:\subinacl.exe Win32/Sality.NBA virus cleaned - quarantined



I think I will be able to find a clean computer. I have a USB flash drive, but that's where all my important files are saved so I'm afraid of using it for this purpose. Is this really the only way of getting rid of the malware/virus? If it is I will try to provide a new USB flash drive :)
 

My Computer My Computer

At a glance

Windows 7 Ultimate, 32bit
OS
Windows 7 Ultimate, 32bit

My Computer My Computer

At a glance

W7 Pro SP1 64biti78GBIntel HD Graphics
Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
Great! I'll try to get it done tonight :)
 

My Computer My Computer

At a glance

Windows 7 Ultimate, 32bit
OS
Windows 7 Ultimate, 32bit
Thought we could not, but, I think we can...

Will need to modify the instructions to accomodate the CD.

Will do so as soon as I can.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
I was referring to WDO - that can use a CD.
 

My Computer My Computer

At a glance

W7 Pro SP1 64biti78GBIntel HD Graphics
Computer type
Laptop
Computer Manufacturer/Model Number
Employer provided Dell Latitude
OS
W7 Pro SP1 64bit
CPU
i7
Memory
8GB
Graphics Card(s)
Intel HD Graphics
Hard Drives
crappy SSD
Antivirus
Employer mandated Symantec Endpoint Protection
Browser
Pale Moon 64bit, IE11 64bit & Chrome 64bit
That's OK, UsernameIssues.

Even if he runs WDO, we may need to do a final confirmation that there are no Rootkits, etc.

You know how it goes, when it comes to malware, no one program covers all.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Testing FRST out on my own computer. So far it worked, with modification to the former instructions.

Can't find the report it makes, though.

Will get it sorted out, and post as soon as possible.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Crumble,

No need for another computer, or for a USB flash drive! ;)
Since the computer boots, let's run this program from the hard drive that contains your Operating System (normally C:\). Do not follow the previous instructions requiring a USB flash drive.

This was tested on my own computer, and it worked.

Please print these instructions, and read them once, so you have an idea of what you are doing.
Do follow them step by step.

Here we go...

Please download Farbar Recovery Scan Tool:
Farbar Recovery Scan Tool Download
Select the version that applies to your computer (32-bit or 64-bit)

Save FRST.exe to the Desktop

Right-click Start, and select: Open Windows Explorer
Look for drive C:\, or the drive that contains your Operating System (OS).

Now, go to the Desktop, right-click FRST.exe, and move it right into C:\

>>> Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until the Advanced Boot Options menu appears.
Use the arrow keys to select the Repair your Computer menu item.
Select your language settings, and click: Next
Select your User account and click: OK/Next (If you did not set a password, leave blank.)

On the System Recovery Options menu you get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Scan your computer's memory for errors.
Command Prompt

Select: Command Prompt

In the Command Prompt window, at the bliking cursor type: notepad
(See note #1)
Press: Enter

In Notepad, under the File menu select: Open
Double-click: Computer (on the left side), find the drive letter that has the Operating System, and remember what letter it has.
(See note #2)

Click on the OS drive
In Files of Type, select: All files
Press: Open
Confirm that FRST.exe is there!

Now, click the Command Prompt window.

Type the following: ?:\frst.exe, and press: Enter
Note: Replace the ? with the drive letter that contains the OS.

The tool starts and prepares to run. Follow the prompts.
Click Yes to the disclaimer.

When the FRST console appears, press the Scan button.
Let it run.

Once the scan finishes, a prompt appears stating "...the log has been saved in the same location as FRST.exe"
Close this prompt, close FRST, and close everything else, except...
Go back to the Command Prompt.

Once again in the Command Prompt window, at the blinking cursor type: notepad
Press: Enter

In Notepad, under the File menu select: Open
Double-click Computer (on the left side), find the drive letter that has the Operating System, and remember what letter it is.
(See note #3)

Click on the OS drive.
In Files of Type, select: All files
Press: Open
Confirm that FRST.exe is there!

Click the Command Prompt window again

Type the following: ?:\frst.exe, and press: Enter
Note: Replace the ? with the drive letter that contains the OS!

The tool starts and prepares to run. Follow the prompts.
Click Yes to the disclaimer.

When the FRST console appears, press the Scan button.

Once the scan finishes, a prompt appears stating the log has been saved in the same location as FRST.exe
Close this prompt, close FRST, and close anything else that is open.

Back at System Recovery Options, press: ShutDown, or, Restart.

After the computer restarts, and you are back in Windows, right-click Start, and select:
Open Windows Explorer

Look for drive C:\, which is normally the drive that contains your Operating System (or whatever drive applies), and open it.

Look for a folder named: FRST
Inside the FRST folder, there are three other folders. One of them is named: Logs

Open the Logs folder to find the text document resulting from the scan.
It should look like: FRST_30-01-2013_16-50-52 (reflects date and time.)
(See note #4)

Please provide the FRST.txt in your reply.

Notes:
1. Make sure the NumLk key is not active. If it is, you are not able to type correctly at the Command Prompt. If NumLk is active, press the Fn key and then the NumLk to deactivate it.

2. Once in this special mode you booted into, the drive containing the Operating System (OS) may not be C:\ (or the particular drive that has your OS)
You need to examine the drives carefully, and determine which one is the correct drive.

3. When you run FRST a second time, the drive containing the Operating System (OS) may have changed again!!!
Once again you need to examine the drives carefully, and determine which one is the correct drive.

4. In the first run, the tool places a FRST folder in the OS drive.
In the second run, it places the log in the folder.
 

My Computer My Computer

At a glance

Windows 7 Home Premium
Computer type
PC/Desktop
Computer Manufacturer/Model Number
An ol' eMachines
OS
Windows 7 Home Premium
Internet Speed
Fine for me...I'm retired!
Back
Top