Windows Security Center is shutting down - Suspicious .exe executed two days ago

JuusoK

New Member
Thread author
Nov 30, 2013
7
As an additional information, I un-installed Avast before writing this post just to make sure that it was not the reason for security center disabling.
 

Attachments

  • aswMBR.txt
    1.5 KB · Views: 83
  • OTL.Txt
    98.7 KB · Views: 111
  • Extras.Txt
    147.5 KB · Views: 112

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hi,



Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Post logfile will also be saved in the C:\AdwCleaner folder.



Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.


  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
 

JuusoK

New Member
Thread author
Nov 30, 2013
7
Hi!
And thanks for the quick reply.

Ran both of those. Logs attached.
 

Attachments

  • FRST.txt
    36.4 KB · Views: 126
  • Addition.txt
    31 KB · Views: 104
  • AdwCleaner[S0].txt
    4 KB · Views: 125

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
You have two Antivirus installed:
- AVG
- Microsoft Security Essentials

Please remove one of them, it is not good to keep two of them for many reason.




Please go to: VirusTotal
  • Click the Choose File button.
  • Please copy/paste the following text into the 'File name:' box:

    Code:
    C:\Windows\SysWOW64\msvfw325.dll
  • Click Open then click the Scan it! button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File already analyzed: click Reanalyse
  • Once scanned, copy and paste the URL from your browser address bar in your next reply.




Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.
 

Attachments

  • fixlist.txt
    1.6 KB · Views: 88

JuusoK

New Member
Thread author
Nov 30, 2013
7
Hi!

It does not allow me to choose this file. Attached a screenshot.
I should be having all the possible administrator rights, or then I'm missing something.

Should I go and run the FRST fix before solving the virustotal thing?
 

Attachments

  • Capture_01.PNG
    Capture_01.PNG
    7.7 KB · Views: 103

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Yes execute FRST...

About this file, can you copy it to another location, and then try to upload it to Virustotal. If you fail to upload it, archive it, and upload here...
 

JuusoK

New Member
Thread author
Nov 30, 2013
7
Hi!

I can't find a way to copy the file either. I've tried quite a lot of things to go around the problem, but I'm really stuck with this.

Do you think there is a way I could copy the file ignoring all the Windows permission stuff?

Attached the fixlog from FRST.
 

Attachments

  • Fixlog.txt
    373.4 KB · Views: 153

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Ok, let's try another method


Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.
 

Attachments

  • fixlist.txt
    80 bytes · Views: 72

JuusoK

New Member
Thread author
Nov 30, 2013
7
Hi!

Here is the log.

Should I now try again the VirusTotal?
 

Attachments

  • Fixlog.txt
    884 bytes · Views: 59

JuusoK

New Member
Thread author
Nov 30, 2013
7
Hi!

Now uploading to Virus Total worked!
And it seems one of the checks found a trojan:
https://www.virustotal.com/en/file/bad7e8e226b43f482bb8f3487fe73e5d7e6429d6c2cb0d8292f249e0d65a2d3b/analysis/1385919828/

Ran also the FRST again and attached the log.
 

Attachments

  • FRST.txt
    36.5 KB · Views: 100

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Download attached fixlist.txt on the same location as FRST (otherwise the fix won't work)

Open FRST, and click Fix. Attach me that report after it is finished.



How are the things now?
 

Attachments

  • fixlist.txt
    304 bytes · Views: 112

JuusoK

New Member
Thread author
Nov 30, 2013
7
Amazing!

After the latest fix and a reboot everything went back to normal again! Thank you so much!

Here's the latest log from FRST.

Btw, what security software you would prefer?
Now I have only the Windows Security Essentials, but should I override it with AVG or Avast for example?
 

Attachments

  • FRST.txt
    34 KB · Views: 156

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Great to hear it :)

About MSE, read this and decide yourself --> http://www.pcpro.co.uk/news/security/384394/microsoft-security-essentials-is-designed-to-be-bottom-of-the-antivirus-rankings


Please download DelFix by "Xplode" to your Desktop.

Run the tool and check the following boxes below;
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore

Now click on "Run" button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

> I don't need DelFix log report.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top