Live security platinum

Robinhood

My laptop has become infected with this virus. Having looked at other threads I found the link below which I am currently following. Once I have finished this I will let you all know the status of my laptop.

Are you following these instructions?. If not, you should be.

bluesnake

This guy also show you how to. His collection videos are not bad either.

https://www.youtube.com/watch?v=fB0LRDdp1XQ

Robinhood

Having completed the instructions in the link my laptop is now back working to a fashion. So far I have noticed that Windows defender will not run and I can not turn it on. Anybody got any advice on how this can be fixed?

waddler_8

Download Farbar's Service Scanner from the link below and save it to your desktop

LINK

• Double click FSS.exe to run it (XP), or right click & choose "Run as Administrator" (Vista, Win7)
• Check the following checkbox.
  • Window Defender
• Click Scan
• Notepad will open. Post the contents in your next reply.

Robinhood

Thanks for thhelp. Below is the content of notepad.

Farbar Service Scanner Version: 06-08-2012
Ran by Gwyn (administrator) on 12-08-2012 at 21:37:46
Running from "C:\Users\Gwyn\Desktop"
Microsoft® Windows Vista™ Home Premium (X86)
Boot Mode: Normal
****************************************************************

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============
Checking Start type of SharedAccess: ATTENTION!=====> Unable to retrieve start type of SharedAccess. The value does not exist.
Checking ImagePath of SharedAccess: ATTENTION!=====> Unable to retrieve ImagePath of SharedAccess. The value does not exist.
Checking ServiceDll of SharedAccess: ATTENTION!=====> Unable to open SharedAccess registry key. The service key does not exist.

File Check:
========
C:\Program Files\Windows Defender\MpSvc.dll
[2008-05-08 08:20] - [2008-05-08 08:20] - 0265912 ____A (Microsoft Corporation) 0D5AD0E71FF5DDAC5DD2F443B499ABD0
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

waddler_8

Download this file and save it to your desktop.

http://download.bleepingcomputer.com/win-services/vista/WinDefend.reg

Double click it. Allow/ok any prompts, then reboot.

Robinhood

Did that and defender now opens but when I attempt to check for updates the following error code is shown 0x80070424.

waddler_8

Run FSS again as before but this time check the Windows Update option and scan.

Robinhood

Did this, log below.

Farbar Service Scanner Version: 06-08-2012
Ran by Gwyn (administrator) on 12-08-2012 at 22:31:11
Running from "C:\Users\Gwyn\Desktop"
Microsoft® Windows Vista™ Home Premium (X86)
Boot Mode: Normal
****************************************************************

Windows Update:
============
wuauserv Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.
BITS Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Windows Autoupdate Disabled Policy:
============================

Other Services:
==============
Checking Start type of SharedAccess: ATTENTION!=====> Unable to retrieve start type of SharedAccess. The value does not exist.
Checking ImagePath of SharedAccess: ATTENTION!=====> Unable to retrieve ImagePath of SharedAccess. The value does not exist.
Checking ServiceDll of SharedAccess: ATTENTION!=====> Unable to open SharedAccess registry key. The service key does not exist.

File Check:
========
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

waddler_8

As before, download each of these, save to desktop, double click, reboot.

http://download.bleepingcomputer.com/win-services/vista/wuauserv.reg

http://download.bleepingcomputer.com/win-services/vista/BITS.reg

http://download.bleepingcomputer.com/win-services/vista/SharedAccess.reg

Robinhood

Done that but still getting the same code. Also noticed that security essentials isn't working either and has the same code.