Windows 10: It appears that my Windows Defender has been tampered with and Sfc scannow logs tell me...

My computer was infected by bitcoin miners and Defender was disabled and tampered with.


Long story short, would "reset and keep files" completely reinstall Windows Defender and get rid of all viruses? Or do I need to format the drive and install Windows all over?


Thanks.

:)

 

SFC scannow not working but verify only is working

there is no problem in chkdsk I've checked When I select command prompt and sfc scannow from f8 and repair.. it shows that a reboot is required for pending repair and pending renames folder in winsxs is full of files.. what should I do??

 

sfc /scannow error

That's why Im asking the question. Am I correct in thinking that its perfectly normal that after the second running of sfc /scannow in your list you would get :-

Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.

Then after that..its the third sfc /scannow that you list that comes up clean .
Ivghandi was saying that he presumed that the second sfc /scannow you list showing "Windows Resource Protection found corrupt files and successfully repaired them" meant that he still had a problem.

The way I understand that DISM works is that it repairs the Component Store. Then when you run SFC /scannow again it can then repair the file corruptions it detected originally. Have I got that correct?

 

sfc /scannow won't complete

Hi,

As per the information, I suggest that you run SFC in Safe Mode with admin privileges and check if the same issue occurs.

If the issue persist, you can check for the following:

1. Scan the Hard Drive for Errors

The first thing to do is to tell Windows you want to perform a file system check on the hard drive to ensure there are no errors. If there are errors on the drive, 'sfc /scannow' may fail.

To scan the drive for errors, do the following:

• Open an administrative command prompt. In Windows XP, click Start -> Run, and type in "cmd.exe" and press Enter. Click Start and type in "cmd" (no quotes). Wait for Command Prompt or CMD.EXE to appear in the list of options and right click it, then select
  "Run as Administrator".
• A black command prompt window will appear on the screen. Highlight the following text with your mouse: "chkdsk /x /f /r" (do not include the quotes), then right click over the highlighted text and select Copy. Next, go to the command prompt and right click
  in the middle of the window and select Paste from the dialogue menu. The command you copied should have output to the command prompt. If it did not, repeat this step until it does. After the command is output, press Enter on your keyboard to execute it. When
  prompted, press "Y" to have chkdsk scan your hard drive for errors on the next reboot.

2. Enable the Hidden Administrator Account

Next we'll enable the hidden administrator account so that you can perform the 'sfc /scannow' command in a clean environment.

To do so:

• Highlight the following text with your mouse: "net user administrator /active:yes" (do not include the quotes), then right click over the highlighted text and select Copy. Next, go to the command prompt and right click in the middle of the window and select
  Paste from the dialogue menu. The command you copied should have output to the command prompt. If it did not, repeat this step until it does. After the command is output, press Enter on your keyboard to execute it.
• Please note that you will most likely want to disable the administrator account after you have finished making changes listed in this document, otherwise anyone will be able to login to your computer as the administrator user without using a password and
  make changes to the system without any authorization. You can disable the administrator account using the exact steps you just took above, except you would replace "net user administrator /active:yes" with "net user administrator /active:no".

Hope this helps

Regards