Metropol

Hello,

I was infected by some form of Malware the other day (which has since been removed), but it seems to have messed everything up a fair bit. The Malware hid inside a Google folder in Program files, and any attempt to delete the folder froze the computer up for a while, with McAfee triumphantly declaring it had removed the malware every ten seconds until MalwareBytes did it properly. I think it deleted some registry files, as Windows Firewall refused to start up, although I have managed to get it back into operation (via some information found on Google).

What I haven't managed to find a solution to, however, is my now broken Windows Defender. If I try and open the program it tells me that it's been deactivated (which it had, by McAfee), and if I try to turn it back on it opens the System32 folder instead. A lot of Googling has had me install various things to try and fix it, but nothing has succeeded yet. Because Defender is part of Windows 8 I can't uninstall and reinstall it. I only really need it because I purchased something from the Windows 8 app store, which for some reason, needs the firewall to be active to download, and is kicking up a fuss because defender isn't defending me. The Windows Defender service stops as soon as I start it, and is currently set to start manually.

Additionally, I can't do a System Restore because apparently it can't access a file, so it aborts the process.

Any ideas on what's wrong and what to do would be much appreciated.

Personally I wouldn't bother trying to fix it, I'd just back up all my personal data and go for a full reinstall.

It might be a bit of a pain to have to reinstall all your programs and reconfigure all the settings to the way you like them, but in situations like this (particularly when you have a confirmed malware infection) it's probably a quicker, easier (and safer) solution to simply start again from scratch rather than try to fix the existing installation.

The aforementioned malware was only a Bit Coin miner and an advert clicker thing - ZeroAccess and something? At the moment, I don't particularly want to recover it at the moment because I reinstalled the entire thing the other week as it is!

EDIT: I'm currently getting the notification that a security program has blocked access to a risky address, before listing an IP - maybe I'm not out of the woods yet.

If your PC is actively stopping security software from running there is still stuff on there, even if you can't see / detect it. And once you're at that point, the only way you can trust the machine to be doing what you want it to do is to wipe it and start over.

dosxuk wrote:If your PC is actively stopping security software from running there is still stuff on there, even if you can't see / detect it. And once you're at that point, the only way you can trust the machine to be doing what you want it to do is to wipe it and start over.

Echoed. If you're trying to fix a problem caused by rogue code, you don't know exactly what has happened and may well spend hours/days/weeks researching solutions which lead to dead ends, along with the fact that you won't be able to be sure it's gone. It's a far more constructive use of your time (and will be quicker) just to reinstall. There's no need to view reinstallation as a last resort as so many people do, if it's not doing what you want any more and simple fixes haven't fixed it then it's always easiest just to reinstall it, and whilst it might be time consuming 99% of that time is just waiting for it to do stuff rather than you actively working at the machine, do it in an evening over a DVD and a couple of beers and it won't seem such a chore.

i also concur. don't waste time trying to clean it up. you'll never 100% be sure it's clean.

do a full factory reset. save yourself any future pain.

I've started by 'refreshing' my PC. This uninstalls all software (and then reinstalls it if it came from the Windows store), keeps my documents, but basically resets everything else. I want to see if this actually does anything useful, and if not it looks like I'll be resetting everything back to default.

Top tip for once you've reformatted is Ninite. Let's you install loads of the default apps really simply and easily without tedious clicking.

FACT ATTACK: Having once again forgot the name of this app I typed "install lots of programs at once" into google and it sent me directly to http://ninite.com/

*hugs Google*

Upon refresh all my woes seem to have disappeared, with Defender now working and everything operating normally - there have been no security earnings about malicious URLs, and I can download stuff from the Windows Store.

Thanks for that link Pete, it looks very handy - this should speed things up!

Ninite reminded me of that weird program, Google Pack, that was around a few years ago. It died a rather silent death but I usdd it quite a bit for that precise purpose