CMDservice is getting more out of control

Do you know how to work in the registry?

Regedit??? Yes been there a few times with specific directions I can handle it.

Backup your Registry…
- Press "CTRL - ALT - DEL" keys all at the same time to start "Task Manager"
- In the Task Manager window click on "File", then from the drop-down menu select "New Task (Run…)"
- In the "Create New Task" window enter\type "regedit" (without quotes)
- Once Regedit opens click on the FILE menu and select Export
- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL




Click "Start"> "Run"> type in Regedit tap Enter Key

Work your way to these keys:
HKEY-Local-Machine\system\controlset002\services
HKEY-Local-Machine\system\controlset004\services
HKEY-Local-Machine\system\CurrentControlset\services

Delete these: cmdservice and old cmdservice


HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
Delete this if listed:

defender"="c:\\\\dfndrb_2.exe"


[HKEY_USERS\.default\software\microsoft\windows\currentversion\run
Delete these Keys if listed:

"hncng"="C:\\WINDOWS\\system32\\lyqufu.exe reg_run"
"Notn"="\"C:\\WINDOWS\\system32\\SKS~1\\netdde.exe\" -vt yazr"
"sys_up1"="C:\\Program Files\\Common Files\\svchostsys\\svchostsys.exe"



[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run
Delete these Keys if listed:

"hncng"="C:\\WINDOWS\\system32\\lyqufu.exe reg_run"
"Notn"="\"C:\\WINDOWS\\system32\\SKS~1\\netdde.exe\" -vt yazr"
"sys_up1"="C:\\Program Files\\Common Files\\svchostsys\\svchostsys.exe"


Close Regedit.


Empty Recycle Bin

Reboot

Doubleclick combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.

When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

BEFORE I START A COUPLE QUESTIONS:

1)- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL

Do you mean Save as type to "All Files"

2) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
Delete this if listed:

defender"="c:\\\\dfndrb_2.exe"

I have run and run- clicking on the run- folder in the right window is:

Name Type Data

Defender Reg_SZ C:\\dfndrb_2.exe
(default) Reg_SZ Value Not Set

DELETE THE RUN- FOLDER OR JUST WHAT IS INSIDE??

BEFORE I START A COUPLE QUESTIONS:

1)- Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL

Do you mean Save as type to "All Files"

Yes, call it backup.reg



2) HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
Delete this if listed:

defender"="c:\\\\dfndrb_2.exe"

I have run and run- clicking on the run- folder in the right window is:

Name Type Data

Defender Reg_SZ C:\\dfndrb_2.exe <–Just kill this file
(default) Reg_SZ Value Not Set

DELETE THE RUN- FOLDER OR JUST WHAT IS INSIDE?? <–NOT the Run folder.

CMDService could NOT be deleted inside these two. There is a folder under CMDService called ENUM and then there are files inside that folder should I attempt to delete the files inside?

HKEY-Local-Machine\system\controlset002\services

HKEY-Local-Machine\system\CurrentControlset\services

I'd rather try this.

Launch Notepad, and copy/paste everything in the codebox below into the new document, including the word REGEDIT4. Go up to "File Save As" and click the drop-down box to change the "Save As Type" to "All Files" and save it to your desktop as fixme.reg.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService] 

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cmdService]

3. Locate fixme.reg on your Desktop and double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer Yes and wait for a message to appear similar to Merged Successfully.

Now see if they are gone

It did not remove it…..

CMDService could NOT be deleted inside these two. There is a folder under CMDService called ENUM and then there are files inside that folder should I attempt to delete the files inside?

Try to kill the ENUM then the CMDService .

ENUM can not be deleted or anything inside.

Right Click on ENUM and select Permissions. Hightlite your user name and add Full Control.
Now try to kill it

In Controlset002\services changing permission I was able to delete CMDService BUT when I went to CurrentControlset\service I get the error message "Unable to display security info"

In Controlset002\services changing permission I was able to delete CMDService BUT when I went to CurrentControlset\service I get the error message "Unable to display security info"

Couple things to try:
Reboot in Safe Mode and try it.

OR:
Go to start > run and copy and paste next commands in the field:

sc delete CMDService Hit enter

UPDATE: I closed REGEDIT reopened it and checked again it was gone.. I did notice that in two areas there is a folder called "CMDide" Now what?

Post a new HJT log and let me know how it's running.