Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Inactive Support Threads
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Security Shield
Message
<blockquote data-quote="ziggy783" data-source="post: 58728" data-attributes="member: 1714"><p>Here is what happened:</p><p>- I transferred ComboFix via memory stick to my infected computer desktop in normal mode. I double-clicked the exe file. Soon after I did that a Security Shield pop-up window came up that could not be dragged to move. But then there was an error frame that stated that some exe program (Starting with the letter "z" -- sorry, i should have written down the name) was not responding -- it seems like this was related to the Security Shielf virus because after ending the Security Shield application using task manager (& the virus pop-ups went away), I was able to click on "I accept" for ComboFix -- it seemed liked Combofix ran fine but at the very end there was a frame that popped up and went away so quickly that I didn't even have time to read it. I also searched for the "C:\ComboFix.txt " file (on my desktop, in C: under "my computer" and also using the "Start search" function). Interestingly, my internet access started working at this point (not sure if it was because of the "z" exe file not responding).</p><p>- I successfully ran the FSS program, and I have copied/pasted the log below.</p><p>- After restarting my computer again, there is no evidence of the security shield pop-up (so far) BUT the computer no longer has internet access. The usual wireless network I use is under "local only" access. Even after disconnecting and then re-connecting again, I still am on "local only" access.</p><p></p><p></p><p>Farbar Service Scanner Version: 25-06-2012 01</p><p>Ran by Paulgun (administrator) on 29-06-2012 at 10:03:24</p><p>Running from "C:\Users\Paulgun\Desktop"</p><p>Microsoft® Windows Vista™ Business Service Pack 2 (X86)</p><p>Boot Mode: Normal</p><p>****************************************************************</p><p></p><p>Internet Services:</p><p>============</p><p></p><p>Connection Status:</p><p>==============</p><p>Localhost is accessible.</p><p>LAN connected.</p><p>Google IP is accessible.</p><p>Google.com is accessible.</p><p>Yahoo IP is accessible.</p><p>Yahoo.com is accessible.</p><p></p><p></p><p>Windows Firewall:</p><p>=============</p><p>mpsdrv Service is not running. Checking service configuration:</p><p>The start type of mpsdrv service is OK.</p><p>The ImagePath of mpsdrv service is OK.</p><p></p><p>MpsSvc Service is not running. Checking service configuration:</p><p>Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.</p><p>Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.</p><p>Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.</p><p></p><p>bfe Service is not running. Checking service configuration:</p><p>Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.</p><p>Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.</p><p>Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.</p><p></p><p></p><p>Firewall Disabled Policy: </p><p>==================</p><p></p><p></p><p>System Restore:</p><p>============</p><p></p><p>System Restore Disabled Policy: </p><p>========================</p><p></p><p></p><p>Security Center:</p><p>============</p><p>wscsvc Service is not running. Checking service configuration:</p><p>The start type of wscsvc service is OK.</p><p>The ImagePath of wscsvc service is OK.</p><p>The ServiceDll of wscsvc service is OK.</p><p></p><p></p><p>Windows Update:</p><p>============</p><p></p><p>Windows Autoupdate Disabled Policy: </p><p>============================</p><p></p><p></p><p>Windows Defender:</p><p>==============</p><p>WinDefend Service is not running. Checking service configuration:</p><p>The start type of WinDefend service is set to Demand. The default start type is Auto.</p><p>The ImagePath of WinDefend service is OK.</p><p>The ServiceDll of WinDefend service is OK.</p><p></p><p></p><p>File Check:</p><p>========</p><p>C:\Windows\system32\nsisvc.dll => MD5 is legit</p><p>C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit</p><p>C:\Windows\system32\dhcpcsvc.dll => MD5 is legit</p><p>C:\Windows\system32\Drivers\afd.sys => MD5 is legit</p><p>C:\Windows\system32\Drivers\tdx.sys => MD5 is legit</p><p>C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit</p><p>C:\Windows\system32\dnsrslvr.dll</p><p>[2009-09-25 14:08] - [2009-04-11 01:28] - 0086528 ____A (Microsoft Corporation) 30A08728740E71947AE1E073B5CE69B4</p><p></p><p>C:\Windows\system32\mpssvc.dll => MD5 is legit</p><p>C:\Windows\system32\bfe.dll => MD5 is legit</p><p>C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit</p><p>C:\Windows\system32\SDRSVC.dll => MD5 is legit</p><p>C:\Windows\system32\vssvc.exe => MD5 is legit</p><p>C:\Windows\system32\wscsvc.dll => MD5 is legit</p><p>C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit</p><p>C:\Windows\system32\wuaueng.dll => MD5 is legit</p><p>C:\Windows\system32\qmgr.dll => MD5 is legit</p><p>C:\Windows\system32\es.dll => MD5 is legit</p><p>C:\Windows\system32\cryptsvc.dll => MD5 is legit</p><p>C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit</p><p>C:\Windows\system32\svchost.exe => MD5 is legit</p><p>C:\Windows\system32\rpcss.dll => MD5 is legit</p><p></p><p></p><p>**** End of log ****</p></blockquote><p></p>
[QUOTE="ziggy783, post: 58728, member: 1714"] Here is what happened: - I transferred ComboFix via memory stick to my infected computer desktop in normal mode. I double-clicked the exe file. Soon after I did that a Security Shield pop-up window came up that could not be dragged to move. But then there was an error frame that stated that some exe program (Starting with the letter "z" -- sorry, i should have written down the name) was not responding -- it seems like this was related to the Security Shielf virus because after ending the Security Shield application using task manager (& the virus pop-ups went away), I was able to click on "I accept" for ComboFix -- it seemed liked Combofix ran fine but at the very end there was a frame that popped up and went away so quickly that I didn't even have time to read it. I also searched for the "C:\ComboFix.txt " file (on my desktop, in C: under "my computer" and also using the "Start search" function). Interestingly, my internet access started working at this point (not sure if it was because of the "z" exe file not responding). - I successfully ran the FSS program, and I have copied/pasted the log below. - After restarting my computer again, there is no evidence of the security shield pop-up (so far) BUT the computer no longer has internet access. The usual wireless network I use is under "local only" access. Even after disconnecting and then re-connecting again, I still am on "local only" access. Farbar Service Scanner Version: 25-06-2012 01 Ran by Paulgun (administrator) on 29-06-2012 at 10:03:24 Running from "C:\Users\Paulgun\Desktop" Microsoft® Windows Vista™ Business Service Pack 2 (X86) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Yahoo IP is accessible. Yahoo.com is accessible. Windows Firewall: ============= mpsdrv Service is not running. Checking service configuration: The start type of mpsdrv service is OK. The ImagePath of mpsdrv service is OK. MpsSvc Service is not running. Checking service configuration: Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist. Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist. Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist. bfe Service is not running. Checking service configuration: Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist. Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist. Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist. Firewall Disabled Policy: ================== System Restore: ============ System Restore Disabled Policy: ======================== Security Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is OK. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== WinDefend Service is not running. Checking service configuration: The start type of WinDefend service is set to Demand. The default start type is Auto. The ImagePath of WinDefend service is OK. The ServiceDll of WinDefend service is OK. File Check: ======== C:\Windows\system32\nsisvc.dll => MD5 is legit C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit C:\Windows\system32\dhcpcsvc.dll => MD5 is legit C:\Windows\system32\Drivers\afd.sys => MD5 is legit C:\Windows\system32\Drivers\tdx.sys => MD5 is legit C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit C:\Windows\system32\dnsrslvr.dll [2009-09-25 14:08] - [2009-04-11 01:28] - 0086528 ____A (Microsoft Corporation) 30A08728740E71947AE1E073B5CE69B4 C:\Windows\system32\mpssvc.dll => MD5 is legit C:\Windows\system32\bfe.dll => MD5 is legit C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit C:\Windows\system32\SDRSVC.dll => MD5 is legit C:\Windows\system32\vssvc.exe => MD5 is legit C:\Windows\system32\wscsvc.dll => MD5 is legit C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\system32\wuaueng.dll => MD5 is legit C:\Windows\system32\qmgr.dll => MD5 is legit C:\Windows\system32\es.dll => MD5 is legit C:\Windows\system32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit **** End of log **** [/QUOTE]
Insert quotes…
Verification
Post reply
Top
