ping.exe using all the cpu usage, malware detected. - Page 2

[natakudragoon]

there is no windows defender in my all programs folder
i accessed it by searching it in the control panel, but i can't disable it or click on the tools button.
in regards to the combofix script, i did the exact instructions by copy and pasting it to notepad and dragging it to my combofix on desktop.

[jholland1964]

Notice I said if not in your programs folder. then go to Services.
Go to Start and in the search box type services.msc
Now when that opens the Windows Services are all in alphabetical order so scroll down and look for Windows Defender. I guarantee it IS listed there. Then turn it off.

[natakudragoon]

it's not listed there either..... :(

[jholland1964]

it's not listed there either..... :(

Positive...It is in the "W"'s See my attached.

Think we will have to have somebody else take a look here. Obviously more damage than we thought.

[natakudragoon]

yeah, i tried checking it on my sister's laptop just to see what it would look like or show and she has it just like your attached thumbnail, but not on this laptop. what should i do now?

[jholland1964]

It has to be on the computer, it cannot be uninstalled, it is part of the Windows 7 System, it can only be turned off,

Try this:
To enable the viewing of hidden and protected system files in Windows 7 please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button () in the lower left corner of your screen that has a Windows flag on it.

Click on the Control Panel menu option.
Now click on the Show hidden files and folders option as shown by the red arrow in Figure 2 above.

Under the Hidden files and folders section select the radio button labeled Show hidden files, folders, and drives.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files (Recommended).

[natakudragoon]

ok i have my hidden files and folders showing now.

[jholland1964]

Try this:

copy and paste this to notepad:

@ECHO OFF

net stop winmgmt /y
cd /d %windir%\system32\wbem
if exist repository ren repository repository.bad
net start winmgmt

save it to desktop as Fix.bat and then close all windows and run it.
REBOOT and see if problem remains.

[natakudragoon]

i did the fix.bat step, services.msc still doesn't show windows defender

[jholland1964]

I am having PP take a look at this, he gave me the script to give to you. You will just have to wait until he can respond, sorry.

[PhilliePhan]

i did the fix.bat step, services.msc still doesn't show windows defender

That was directed at the Norton and trying to remove that from Security Center, though it ought to resolve erroneous Windows Defender status, as well.

Let's have another look:
Open a command prompt and copy&paste:
winmgmt /verifyrepository ENTER
and tell us the result.

A number of AV programs will shut down Windows Defender + some malware will bork it. I'm not sure what is behind this current issue.

PP:)

[natakudragoon]

WMI repository verification failed
error code: 0x80041003
facility: wmi
description: access denied

[PhilliePhan]

WMI repository verification failed
error code: 0x80041003
facility: wmi
description: access denied

** Make sure you are running an Administrator Command Prompt

Let me get on my Win7 laptop and look at some reg keys.

In the meantime, let's try running this command:

winmgmt /salvagerepository

Run it over and over until it doesn't fail ( well, within reason, say 5-7 times).

If it runs with no error, REBOOT and see if windows defender shows up in services.

Again, be sure to use the elevated command prompt.

PP:)

[natakudragoon]

ok i used an administrator command prompt and did the verifyrepository and salvagerepository. both commands returned with "wmi is consistent". after i rebooted, i went to services but windows defender is still not there.

[PhilliePhan]

ok i used an administrator command prompt and did the verifyrepository and salvagerepository. both commands returned with "wmi is consistent". after i rebooted, i went to services but windows defender is still not there.

OK - I will grab my Win7 compy and look at a few reg keys.

I'll probably won't be back until tomorrow evening, EST.

PP:)

[PhilliePhan]

While I'm away, please try this command in elevated command prompt:

reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet/services/windefend /s >> C:\Peek.txt

Please post me the C:\Peek.txt

PP:)

[natakudragoon]

error: the system was unable to find the specified registry key or value.

[PhilliePhan]

error: the system was unable to find the specified registry key or value.

OK - let's add it, then.

Download the attached ZIP and Extract FIXWinDef.reg from the zip to the Desktop.
DoubleClick FIXWinDef.reg and Allow it to merge into the registry.

REBOOT and see if that helps.

I'll be back tomorrow - Judy may have additional steps to try should this fail....

PP:)

[natakudragoon]

yay! i turned windows defender off and ran the norton removal tool. i installed avira with no problems and installed comodo firewall too. :)
i kinda got ahead of myself though, is there certain settings i should set avira and comodo to? or should i post something for you guys to make sure my laptop is 100% safe now?

[jholland1964]

yay! i turned windows defender off and ran the norton removal tool. i installed avira with no problems and installed comodo firewall too. :)
i kinda got ahead of myself though, is there certain settings i should set avira and comodo to? or should i post something for you guys to make sure my laptop is 100% safe now?

I am going to advise against that Comodo Firewall. It does not work well with Avira.This is noted at Avira also. I would advise you keep Avia, it is one of the top three av programs around but I would Uninstall the Comodo and go with
PC Tools Firewall. It works very well with Avira and is one they recommend to use with their program.
Uninstall Comodo.
Then install PC Tools Firewall from here:

http://majorgeeks.com/PC_Tools_Firewall_Plus_d5470.html

Also add, if you have not yet, SpywareBlaster. Truly a MUST HAVE for all computers. It blocks spyware, adware, browser hijackers, and dialers also will
Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
Block spying / tracking via cookies.
Restrict the actions of potentially unwanted or dangerous web sites.
It is FREE and it does NOT run in the background.
Download, Install, Update, Enable all protection and close the program. Check manually for updates every couple weeks. If there is an update available it will download and when it is finished be sure to Enable all protection again and close the program.

Direct download from this link;

http://www.javacoolsoftware.net/downloads/spywareblastersetup45.exe

[jholland1964]

Here are print screens to show you how to set up Avira correctly, they are pretty self explanatory, any questions don't hesitate to ask.
this will take me two replies to get all the print screens on here.

[jholland1964]

Here are the rest;

[jholland1964]

And one more. You will receive this large pop up when one of the updates occurs.It is just the "price" you pay for using the Free version. Just click the "x" in the right corner to close it out.
There is one update built into the program, automatically schedule to occur around the time of your original install. The one you schedule will be one additional update for the day. I suggest that you make it 10 to 12 hours different from the time of the built in one. This way you are assured you have all the daily updates.

[PhilliePhan]

yay! i turned windows defender off and ran the norton removal tool.....

Great! One less thing to worry about tomorrow :)

I'll defer to Judy on the AV/Firewall side of things.

The Comodo/Avira conflict was resolved a couple years ago.

I really like Avira - It just seems to have all sorts of imaginary issues with various firewalls and other security products these days. Especially with the latest versions.

Avira has had issues with SpywareBlaster (that Judy recommended, BTW :) ) and has even called for the removal of MBAM.

See below:
http://www.pcreview.co.uk/forums/re-avira-wants-uninstall-everything-t4042965.html

As long as you have configured your firewall properly to allow Avira's components to operate unhindered, there should be no problems.

Cheers :)
PP

[natakudragoon]

alright! i uninstalled comodo, set up avira and installed pc tools firewall and spyblaster. this means i'm good to go?

thanks a lot guys! i appreciate all the help from the bottom of my heart! yes yes, one less thing you have to worry about tomorrow :D

[jholland1964]

No problem between SpywareBlaster and Avira, I also use it and have for many years along with Avira.

This "concern" comes from the new possible compatibility Caution that shows before new version of Avira is installed. This is just a general caution and not an ORDER to uninstall any of the programs mentioned in the warning prior to install the install file scans the computer for any programs installed that MAY cause a problem, it does not say it will cause a problem. It is just an Alert of POSSIBLE conflicts and you do not need to uninstall these software programs mentioned during the install. It is only there to make the user aware of the possibility.

It truly only applies to programs that also RUN real time protection...this is where the problem "may" come in, though not always either. This includes Resident SDHelper and Resident TeaTimer, Malwarebytes' Anti-Malware Paid version, which has realtime protection, SUPERAntispyware Paid which also has realtime protection.