Hi,
I am new here. My computer is truly infected with 2 things called
Hijack.windowsupdates
I ran Malwarebytes Anti-malware and it susses out these 2 offenders. My brother who is an accomplished IT guy said these agents are nasty and that I should appeal here for help. I am not that knowledgable…all I know is that these 2 things are causing my computer to see every internet site as not having a valid certificate (re: security).
If this helps the Malware found this:
Hijack.windowsupdates Registry data HKEY_LOCAL_MACHINE\SystemCurrentControlSet\Services\wauservI\magePath(Data:%fystemroot%\system32\svchost.exe-k netsvcs
and the other nasty is
Hijack.windowsupdates Registry data HKEY_LOCAL_MACHINE\SystemCurrentControlSet\Services\BITS\ImagePath(Data:%fystemroot%\system32\svchost.exe-k netsvcs
I emphasized in bold type the 2 sections that differ (above)..if that helps to identify the culprit, and suggest a REMEDY for these invaders on my PC.
Any help appreciatted. I did have my brother read the other posts here..and he could not find help specific to my problem…close but not the same..and furthermore..the closest thread didnt end with any feedback saying "Yes!! thats the fix!..just do so an so".
So any help appreciatted, and I respectfully admit I am not all that tech savy…so a recipe would be VERY Helpful.
Thank you..
George
Hello GtrGeorge and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instruction I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.
If an update is found, it will download and install the latest version.
The program will close to update and reopen.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Double-click gmer.exe. The program will begin to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT"entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button. Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.
Hi,
thank you for the advice….
I think I am out of the woods.
After looking at the Malware results I saw that the Malware program only Quarantined the "bad guys". On a hunch I went further and deleted those guys. I wasnt sure if it would work..but so far..I havent had any more symptoms!!!!!
No more websites being flagged as unsafe, or uncertified…so I am thinking I have this problem fixed.
Can I get an all clear?
GtrGeorge,
It sounds like you at least made good progress with MBAM. Absence of your symptoms though does not necessarily mean that you are all clean. The only way I can tell is by reviewing the two logs I asked for. If you choose not to continue, please let us know so we can close the thread, but I recommend that you post the logs.
