Help needed Virus

[Dwwop]

Hi guys,

so recently I've tried to install an app from third party site, and instead of getting the app, I've ended up with bunch of viruses. Yeah, I know, I'm stupid...

So I've done couple scans using different apps, and deleted every single file from appdata, roaming, program files, chrome extensions, etc.

that sounded little fishy. I've also unninstalled every newly added app.

 

All in all, I still got 2 main issues that I can't fix on my own. When I use chrome it doesn't show the browser logo, but instead it shows the internet explorer logo and the second issue is, that I can't update windows via the update center in settings. When I try to scan for any new updates I end up with 0x80070424 error code and when I try to install the manually it says the same error message with text "the specified service does not exist as an installed service". When I tried to find "windows update" service in services, it simply wasn't there.

 

I'd appreciate any help, since I don't know what to do now.

Thanks in advance.

Sorry for my english

[LukeSavenije]

tried any antimalware? and startup scans? 

[Overbuilder]

Does windows update appear anywhere in the registry ? it could be set to 0 in the registry

[Dwwop]

2 minutes ago, LukeSavenije said:

tried any antimalware? and startup scans? 

Tried a few, deleted bunch of malware. But haven't tried any start up scan

[Overbuilder]

As for the IE icon in google chrome, just use a program called resource hacker, and change the icon of chrome.exe in program files.

 

 

[Overbuilder]

https://www.howtogeek.com/75983/stupid-geek-tricks-how-to-modify-the-icon-of-an-.exe-file/

 

found a how-to-geek link for you.  

[LukeSavenije]

4 minutes ago, Dwwop said:

Tried a few, deleted bunch of malware. But haven't tried any start up scan

well try it. it can detect virusses that are not loaded yet.

[Overbuilder]

Found a link to a forum which should help. As i suspected it has been removed from the registry by the virus.

 

https://answers.microsoft.com/en-us/windows/forum/all/windows-update-is-missing-from-servicesmsc/d6a15c18-80bf-4f09-a402-44bfeebb0ab9

 

start-up scan has no access to the registry... so don't bother.

[Overbuilder]

could be easier to just do a system restore... not a reset, but should fix any registry issues you might have.

[xKyric]

19 minutes ago, Overbuilder said:

could be easier to just do a system restore... not a reset, but should fix any registry issues you might have.

If I were you, I'd preform a clean install of Windows. 

I like to be sure that all viruses have been removed. 

[Overbuilder]

It seems like the virus is gone now, he just needs to use cmd and regedit to ''repair'' windows update and he's good to go.

 

i have had viruses like this before, and i never reset,so...

[Dwwop]

7 minutes ago, Overbuilder said:

It seems like the virus is gone now, he just needs to use cmd and regedit to ''repair'' windows update and he's good to go.

 

i have had viruses like this before, and i never reset,so...

So, yeah I've repaired the registry keys. Yeah, they were missing. and now the Windows Update service is up and running. 

But I still can't find any updates, 'cause error 0x80070006 pops up now...

 

[Overbuilder]

1 minute ago, Dwwop said:

10 minutes ago, Overbuilder said:

It seems like the virus is gone now, he just needs to use cmd and regedit to ''repair'' windows update and he's good to go.

 

i have had viruses like this before, and i never reset,so...

So, yeah I've repaired the registry keys. Yeah, they were missing. and now the Windows Update service is up and running. 

But I still can't find any updates, 'cause error 0x80070006 pops up now...

 I know it seems silly, but try installing the windows 10 update assistant. If that doesn't work i reccomend a system restore

[Overbuilder]

in  a system restore your personal files and programs are kept, but the system files get modified.

[Overbuilder]

merry christmas !

[Overbuilder]

Hopefully you come to a better solution, make sure not to visit too may evil websites. Just stick to CPY games.

[Amazonsucks]

6 hours ago, Dwwop said:

Hi guys,

so recently I've tried to install an app from third party site, and instead of getting the app, I've ended up with bunch of viruses. Yeah, I know, I'm stupid...

So I've done couple scans using different apps, and deleted every single file from appdata, roaming, program files, chrome extensions, etc.

that sounded little fishy. I've also unninstalled every newly added app.

 

All in all, I still got 2 main issues that I can't fix on my own. When I use chrome it doesn't show the browser logo, but instead it shows the internet explorer logo and the second issue is, that I can't update windows via the update center in settings. When I try to scan for any new updates I end up with 0x80070424 error code and when I try to install the manually it says the same error message with text "the specified service does not exist as an installed service". When I tried to find "windows update" service in services, it simply wasn't there.

 

I'd appreciate any help, since I don't know what to do now.

Thanks in advance.

Sorry for my english

Follow the instructions in this guide i wrote and you should be fine.

 

But TLDR since its an emergency: 

 

First install

 

https://www.malwarebytes.com

 

Turn on rootkit detection in settings BEFORE you scan! Then do a threat scan.

 

Then run:

 

https://www.malwarebytes.com/adwcleaner/

 

Then run:

 

https://www.f-secure.com/en/web/home_global/f-secure-online-scanner

 

Then do the DISM and SFC scans i explain in my thread amd secure your PC accordingly.

 

 

[Falkentyne]

Do exactly what @Amazonsucks said.

And next time have malwarebytes running before going to suspicious sites and be careful next time.

There are also hosts file patches you can download that will automatically block suspicious sites and will be updated weekly (don't remember the name though).

Unfortunately one of them blocked dreamaquarium.com (the best looking virtual fish aquarium out there--written by someone who worked in Hollywood animation for a time) and that was annoying to have to unblock.