windows security at glance / can't check windows update / cant open microsoft store.

[jordy5566]

Hello everyone,
I'm new here.
I wanna ask for help, mine is Windows 10 Pro.
I don't know when this problem occur again, because this problem once infected my PC before and it recovered by installing fresh win 10.
so here I am, got infected again with that malware and change my registry key.
that malware infect and disable/remove my winDef, firewall and many more service.
Already read many solution on this forum but there's no help.
and also I already using malwarebytes and got that malware quarantines,
here's some screenshot about the problem.

*Malwarebytes history.

Log Malwarebytes after scanning:

Malwarebytes

www.malwarebytes.com



-Log Details-

Scan Date: 11/28/20

Scan Time: 4:32 PM

Log File: 978d7324-315c-11eb-a01d-309c23b48462.json



-Software Information-

Version: 4.2.3.96

Components Version: 1.0.1122

Update Package Version: 1.0.33530

License: Trial



-System Information-

OS: Windows 10 (Build 19041.630)

CPU: x64

File System: NTFS



-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 323320

Threats Detected: 32

Threats Quarantined: 0

Time Elapsed: 2 min, 16 sec



-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect



-Scan Details-

Process: 2

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINRMSRV.EXE, No Action By User, 943, 767022, , , , , 462EE20E8ABBBB559BD1C4F8BE87B123, 5B85CEB558BAADED794E4DB8B8279E2AC42405896B143A63F8A334E6C6BBA3FB

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINLOGUI.EXE, No Action By User, 943, 767023, , , , , FB9F4EB58354E9D3D6B7F84F5D12B639, 91BFB82ED5C32979368EDDCD34861B631926D2352D16ADF189944C4BA8CCF4E1



Module: 2

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINRMSRV.EXE, No Action By User, 943, 767022, , , , , 462EE20E8ABBBB559BD1C4F8BE87B123, 5B85CEB558BAADED794E4DB8B8279E2AC42405896B143A63F8A334E6C6BBA3FB

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINLOGUI.EXE, No Action By User, 943, 767023, , , , , FB9F4EB58354E9D3D6B7F84F5D12B639, 91BFB82ED5C32979368EDDCD34861B631926D2352D16ADF189944C4BA8CCF4E1



Registry Key: 12

Backdoor.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\WDI\SrvHost, No Action By User, 883, 653659, , , , , ,

Backdoor.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{A08B8C4C-0C10-475E-926C-79220085DDBF}, No Action By User, 883, 653659, , , , , ,

Backdoor.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{A08B8C4C-0C10-475E-926C-79220085DDBF}, No Action By User, 883, 653659, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\Windows Error Reporting\winrmsrv, No Action By User, 503, 780529, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BC8E5CDF-69F8-4ED7-8BAF-689443C5CB53}, No Action By User, 503, 780529, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{BC8E5CDF-69F8-4ED7-8BAF-689443C5CB53}, No Action By User, 503, 780529, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Microsoft\Windows\Application Experience\StartupCheckLibrary, No Action By User, 503, 735770, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{09C27E85-93F6-4676-916D-B98200CBA773}, No Action By User, 503, 735770, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{09C27E85-93F6-4676-916D-B98200CBA773}, No Action By User, 503, 735770, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2DBF508E-AEE2-4965-9F4C-EFC51A32B048}, No Action By User, 503, 780231, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\LOGON\{2DBF508E-AEE2-4965-9F4C-EFC51A32B048}, No Action By User, 503, 780231, , , , , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\MICROSOFT\WINDOWS\WININET\Winlogui, No Action By User, 503, 780231, 1.0.33530, , ame, , ,



Registry Value: 5

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{09C27E85-93F6-4676-916D-B98200CBA773}|PATH, No Action By User, 503, 782993, 1.0.33530, , ame, , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{2DBF508E-AEE2-4965-9F4C-EFC51A32B048}|PATH, No Action By User, 503, 780232, 1.0.33530, , ame, , ,

Trojan.BitCoinMiner, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{8CF2E784-34EE-42E9-929A-3965043C7E06}, No Action By User, 943, 840273, 1.0.33530, , ame, , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{A08B8C4C-0C10-475E-926C-79220085DDBF}|PATH, No Action By User, 503, 784920, 1.0.33530, , ame, , ,

Trojan.Agent, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{BC8E5CDF-69F8-4ED7-8BAF-689443C5CB53}|PATH, No Action By User, 503, 780528, 1.0.33530, , ame, , ,



Registry Data: 3

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|ANTIVIRUSDISABLENOTIFY, No Action By User, 14085, 293294, 1.0.33530, , ame, , ,

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FIREWALLDISABLENOTIFY, No Action By User, 14085, 293295, 1.0.33530, , ame, , ,

PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UPDATESDISABLENOTIFY, No Action By User, 14085, 293296, 1.0.33530, , ame, , ,



Data Stream: 0

(No malicious items detected)



Folder: 0

(No malicious items detected)



File: 8

Backdoor.Agent, C:\WINDOWS\SYSTEM32\TASKS\Microsoft\Windows\WDI\SrvHost, No Action By User, 883, 653659, , , , , 403D7BBBCEAB066DAB197B14A064B35D, 1E55ED90FD3370CFBF6DC9A307C8E7F83D16CAB966434C3D6DE57C96C8BD985F

Backdoor.Agent, C:\WINDOWS\SYSTEM32\WINSCOMRSSRV.DLL, No Action By User, 883, 653659, 1.0.33530, , ame, , 919611928882E781ABAB300BF9227374, CBDD93BA08E87007665250C3253A1FE9AD38511E4A8A2E5305ADC0F36E43AB44

Trojan.Agent, C:\WINDOWS\SYSTEM32\TASKS\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WINRMSRV, No Action By User, 503, 780529, 1.0.33530, , ame, , 51141535057D55CEE3A698FBA639E2E5, 6D14926A027BAB0C0E5107EF6F621BD19EA5E87102F1CDBABE439338EC82CC40

Trojan.Agent, C:\WINDOWS\SYSTEM32\TASKS\MICROSOFT\WINDOWS\APPLICATION EXPERIENCE\STARTUPCHECKLIBRARY, No Action By User, 503, 735770, 1.0.33530, , ame, , 6A4853B07D29E96054C2476508689D49, 40FC511C38766F52BD9B407A2057EC601B6A3D536E5887FBC732D785D59109C2

Trojan.Agent, C:\WINDOWS\SYSTEM32\TASKS\MICROSOFT\WINDOWS\WININET\WINLOGUI, No Action By User, 503, 780231, , , , , 3BB16A706C21AD0956B905700FD4BBE3, 3079C0970A5B36FB5890E921666A4D7823D26B5FA7B6F1DD2A1E700EF0D22519

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINRMSRV.EXE, No Action By User, 943, 767022, 1.0.33530, , ame, , 462EE20E8ABBBB559BD1C4F8BE87B123, 5B85CEB558BAADED794E4DB8B8279E2AC42405896B143A63F8A334E6C6BBA3FB

Trojan.BitCoinMiner, C:\WINDOWS\SYSTEM32\WINLOGUI.EXE, No Action By User, 943, 767023, 1.0.33530, , ame, , FB9F4EB58354E9D3D6B7F84F5D12B639, 91BFB82ED5C32979368EDDCD34861B631926D2352D16ADF189944C4BA8CCF4E1

Trojan.FakeMS.TskLnk, C:\WINDOWS\SYSTEM32\STARTUPCHECKLIBRARY.DLL, No Action By User, 4104, 676770, 1.0.33530, , ame, , 250532B95FBF3154FE571B65217D4B11, 8F8C635949FD4A315DC7C2D30FC9A6A18149621E72B9598ABF50D54A4BF116AC



Physical Sector: 0

(No malicious items detected)

WMI: 0
(No malicious items detected)
(end)


*Windows Security




*Windows Update


*Microsoft Store




this problem occur maybe because that malware already change my registry/delete some service.
is it clear if any potential malware is clean by malwarebytes?
if yes, then how can I recover that services or the key registry that have been changed ?
Please help. its driving me crazy cause it happen twice now.

Continue reading...