PG Music Home Forums General Discussion Help! Tech S.O.S (Off topic) I need some computer help

I need some professional computer help. The problem is my Defender will not open and the setting/window defender options are all gray. This 64 bit Win 10 off-line (it is only online for updates and program authorization) computer has not an OS update for about a year: it wasn't broke so I didn't fix it.

The following programs found not mal-ware or viruses:
1-anti malwarebytes
2-Rkill - but it did find other problems see below
3-adwcleaner
4-Windows on-line virus checker

Also hijack this found other problems also, including the fact that there is no host file.
Ccleaner found no problems with the registry

My best guess is that either I have a very bad virus or, more probably, my disk drive is failing. My guess it is the later.

I should add that I installed the Kontakt 5.71 update and the Olympus Micro Choir Element Kontakt program but even after these I could turn Defender on and off. It was a couple of days later the problems started.

I appolgize for the length of this message but I wanted to give you as much information as I could. I also thank you very much for your time and talents.

Following is the Rkill and hijack this text logs and the defender error message.

Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 10/26/2017 07:59:23 PM in x64 mode.
Windows Version: Windows 10 Pro

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Automatic Updates Disabled

[HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate" = dword:00000001

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* AeLookupSvc [Missing Service]
* AllUserInstallAgent [Missing Service]
* hkmsvc [Missing Service]
* THREADORDER [Missing Service]
* adp94xx [Missing Service]
* adpahci [Missing Service]
* adpu320 [Missing Service]
* arc [Missing Service]
* discache [Missing Service]
* FxPPM [Missing Service]
* HdAudAddService [Missing Service]
* HyperVideo [Missing Service]
* iirsp [Missing Service]
* LSI_SAS2 [Missing Service]
* LSI_SCSI [Missing Service]
* nfrd960 [Missing Service]
* viaide [Missing Service]
* Wd [Missing Service]

* napagent [Missing ImagePath]
* WPCSvc [Missing ImagePath]

* MMCSS => \SystemRoot\system32\drivers\mmcss.sys [Incorrect ImagePath]
* SystemEventsBroker => %SystemRoot%\system32\svchost.exe -k DcomLaunch [Incorrect ImagePath]
* WSService => %SystemRoot%\System32\svchost.exe -k wsappx [Incorrect ImagePath]
* CompositeBus => \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys [Incorrect ImagePath]

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 10/26/2017 08:00:19 PM
Execution time: 0 hours(s), 0 minute(s), and 55 seconds(s)
------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 4:16:57 PM, on 10/27/2017
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.10586.0545)

FIREFOX: 47.0.2 (x86 en-US)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
C:\Users\Owner\AppData\Local\Microsoft\BingSvc\BingSvc.exe
C:\Users\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AcronisTibMounterMonitor] C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [FUFAXRCV] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe"
O4 - HKLM\..\Run: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [BingSvc] C:\Users\Owner\AppData\Local\Microsoft\BingSvc\BingSvc.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O18 - Protocol: windows.tbauth - {14654CA6-5711-491D-B89A-58E571679951} - C:\Windows\SysWOW64\tbauth.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: AdobeUpdateService - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
O23 - Service: Adobe Genuine Software Integrity Service (AGSService) - Adobe Systems, Incorporated - C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\WINDOWS\system32\atiesrxx.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.ServiceRes.dll,-1000 (diagnosticshub.standardcollector.service) - Unknown owner - C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (file missing)
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: EpsonCustomerResearchParticipation - SEIKO EPSON CORPORATION - C:\Program Files\EPSON\EpsonCustomerResearchParticipation\EPCP.exe
O23 - Service: Epson Scanner Service (EpsonScanSvc) - Unknown owner - C:\WINDOWS\system32\EscSvc64.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Malwarebytes Service (MBAMService) - Malwarebytes - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
O23 - Service: Acronis Managed Machine Service Mini (mmsminisrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)
O23 - Service: @mqutil.dll,-6102 (MSMQ) - Unknown owner - C:\WINDOWS\system32\mqsvc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: PACE License Services (PaceLicenseDServices) - PACE Anti-Piracy, Inc. - C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SensorDataService.exe,-101 (SensorDataService) - Unknown owner - C:\WINDOWS\System32\SensorDataService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\TieringEngineService.exe,-702 (TieringEngineService) - Unknown owner - C:\WINDOWS\system32\TieringEngineService.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)
O23 - Service: USB MIDI Series Audio Device Monitor (USBMIDIAudioDevMon) - M-Audio - C:\Program Files (x86)\M-Audio\USB MIDI Series\AudioDevMon.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8047 bytes

Details, Mario. We need details!

(kidding). I'm not seeing anything jump out here. I have never had Windows Defender go off, not turned it off manually.

You said you've left your PC offline for a long time. Are you sure it isn't just in the process of a lot of updating? I have that with my camp computer, which you've seen. When I visit, it takes a long time, maybe 20 minutes, to load all the updates. Task manager shows the CPU running at over 90%. While it's doing that, everything is unresponsive. In your case, it has a lot to do and I would let it alone overnight.

ps I like ADWCleaner. Even though it's owned now my Malwarebytes I run both (MWBPro), but ADW is the one that finds the problems.

It's possible some of your other anti-virus/anti-spyware is interfering with it.

Don't know if it helps, but here's something to look at:

http://www.thewindowsclub.com/unable-to-turn-on-windows-defender

This concerns me. Actually, I think you antivirus is conflicting and causing the shutdown of Defender, but while I also turn off the OS updates in Services, I do turn them back on every couple months or so. Or when I am having a problem which I can't figure out, like maybe what you are seeing now.

When you turn updates back on, it will take you two days to get everything downloaded and installed, then you can turn it off again.

Before anything else can you boot into safe mode?

If you can - then see what was the latest programs installed and if you see something suspicious that you did not install UNINSTALL IT

INFO for later ----------

you may need to run DSIM btu before you get there you DO have a Win 10 USB you built when you installed/upgrade to WIN 10 - or a local network to another GOOD win 10 PC? You might need it to recover any Win 10 system files it finds are missing or corrupt if it can't find a local (hidden) copy

https://www.windowscentral.com/how-use-dism-command-line-utility-repair-windows-10-image

if everything below fails then do this DSIM

end of info for later ---------------------


If you did a safeboot and you can't find anything then

If you think its a disk (and it COULD be) run a command prompt (Cmd) as Administrator and type:

"FSUTIL DIRTY QUERY C:"

if it comes back "Volume - C: is NOT Dirty"

I would next run (again from Command Prompt)

"SFC /Scannow"

if it comes back as says "Volume - C: IS Dirty"

you should type (again from command prompt)

"CHKDSK /F /R /X" (so it fixes errors and repairs/marks out bad sectors but LOCKS the volume only easy way to clear a "Dirty" set bit)


BEFORE WE DO THIS is it a HDD or a SDD? Do not do this on a SDD!

simply do a "CHKDSK /F /X" (leave out the "R")


(which will then tell you it will be run at next boot)

NOTE it it is a VERY large disk (over 1TB) it will take a LONG time and will happen at next boot

my 2TB drives take forever (many many hours) so I cheat if I corrupt part of one (I'm always mucking around)

"CHKDSK /F /R /C /I"

does same as above but a lot faster at risk of still missing stuff

/c Skips the checking of cycles within the folder structure.

/I Performs a simpler check of index entries.

Since you have bad parts (based on needing to run CHKDSK to fix the drive) you now probably also need to run "SFC /Scannow"


this is just ONE reference that tells you all this

http://www.howto-connect.com/sfc-scannow-dism-exe-chkdsk-windows-10/



GOOD LUCK

Larry




========================


PS I KNOW you use CCleaner (and similar tools but NOT including Malwarebytes and root killers) but you should NEVER let it or ANY tool MODIFY your Registry in ANYWAY (unless you have investigated that Registry KEY and its entries and YOU know what it is changing and its impact!).

These tools are TOO aggressive and frankly too dumb to not break OTHER stuff in the registry (and they also can be overly aggressive with uncommon but perfectly fine files, dlls, .coms, .exe'.s.

Matt,

I forgot to mention that I am using Win 10 Pro with the Win updates turned off. That is why this computer hasn't updated in over a year.

I also forgot to mention that I have tried run/services.msc and set startup type to automatic and also cmd (as administrator)/scannow. Again nothing found.

I also was in the registry trying to reset all of the defender data, again with no luck.

This one has me stumped. I do have a C:/ backup on an eternal HD but I do like to solve problems like this. The backup was about a month ago and I would lose only a couple of program updates that I could reinstall.

Thanx John,

But been there - done that with no luck.

Thanx Dan,

I only use Defender as my anti-virus so there are no other anti-viruses on my machine.

As a last resort I am going to take the time and update this machine. Again it wasn't broke so I wasn't going to fix it. I think its broke now!

The Windows update should restore Defender.

Hi Larry,

The first thing I did was to run safe mode and check all programs. There was nothing strange there. But I went into safe mode again and ran rkill and adwcleaner. Again no problems were indicated.

I ran fsutil dirty query c: and sfc/scannow (again) and no problems were indicated, i.e. c: is not dirty.

I think that I will just bit the bullet and upgrade Win 10. Like I said I do have a backup disk.

Yep, it looks like that is what I will have to do.

This is clearly closing the stable door after the horse has bolted but when you get 'er fixed - IMAGE (backup) the OS drive!

I thought you had/used Acronis? Maybe not, but in any case get and use something. Even PC's/laptop's that are used off-line need to be imaged, FREQUENTLY, for just such disasters.

Just the fact you turn on a PC puts them at risk of a SNAFU, let alone HDD, yes even SDD, errors in the worst possible place. Murphy is ALIVE and well and living in your system.

GOOD LUCK
Larry

Yes, I have Acronis and I do have an image backup on two external HDs. That is my backup plan if the updates mess up this computer.

I am going to update because I haven't done so in a little over a year. It is time I think. I think the latest Defender update on my old OS caused all of my problems as every test that I took came back with no problems indicated, even in safe mode.

Note that I do an image backup either every month or after a major change on my system.

FYI - I had to use my backup plan and load my Acronis image.

The problem was that Defender somehow got locked and nothing would allow it to change, not even a Win 10 update or services.msc/Windows Defender Service or Windows Defender Network. I have no idea how it got locked but that was the problem.

Its a good thing I believe in backing up may systems.

I was about to ping you to see if you had it solved or paved over it.

Only trouble with not knowing what caused "it" and what "it" was means: "it" could bite ya again.

Larry

It did bite me again. I installed the backup image and all was fine. I added the three Kontakt instruments and one Kontakt update (5.7.1) and all was well. With Defender turned off I shut down the computer for the night. The next day the Defender problem back.

So I ran Chkdsk c: and it found no bad sectors or other problems. I ran chkdsk c:/f/r/x and it went to 11% and stayed there for quite awhile. I turned off the monitor, turned it on about 6 hours later and the desktop was up. No chkdsk or chkdsk log! Is this normal if all is OK?

Normal for chkdsk to take that long? No, not usually but it’s not unheard of. I would keep an eye on it.

It is a 1TB drive. That is why I thought that it should take a long time.

Unfortunately, when you turn off stuff that Microsoft likes to maintain control of, there can be consequences. Good luck going forward.

A on my 2TB drives takes WELL over 5 hours, but there should have log

look in the Event viewer: run "eventvwr" look in Windows Logs -> Application and wait for it to update then look for event with source called chkdsk I guess date would have been yesterday(?)


In one case with a one bad sector it took closer to six hours but it was in a non-critical location (non-OS related).

That's why use the additional /C and /I switches (at first) - it may miss something on first run but it will find big problems a lot faster (MINUTES not hours).

But it sounds like a configuration (registry muck up)/conflict with other SW (other A/V and malware and firewalls) and/or Services issue(s) at this point, especially since you ran CHKDSK twice (before and after re-image) and you have already run SFC before with no issues


I think I missed the details on Windows Defender - you turned it off " or your OTHER A/V turned it off? In my case when I install my A/V install it turned off that part of windows defender ditto my firewall. Only thing I tuned off was the "App & browser Control" section (you don't need even more interrupts running) as well as "Family Options" but that's Win. Def. in update 1703

I Haven't allowed update 1709 on yet and I just put 1703 (spring update) on two weeks ago - and it was a much different Defender than were previous two (1603? or 1507)


hope you find it and squash it

Larry

==========
no help to you but I have multiple boot drives so I boot into Win 7 to run CHKDSK c: /f /r on my Win 10 drive (no need to use the dismount switch /X) and it actually runs faster, I reverse it for Win 7 drive - run chkdsk from Win 10.

Won't work from my Win XP drive becasue I have to hide both the Win 7 and Win 10 drives from Win XP (otherwise Win XP overwrites those OSs' restore points) - but WIN 7 and Win 10 see and can perform checks on the WIN XP drive.