Avast WEBforum
Other => Viruses and worms => Topic started by: liquidnite on May 02, 2014, 08:31:43 PM
-
I came home from out of town last night to my beloved desktop which I missed dearly (not a fan of my laptop). I am running Win7 32bit on that system. I was prompted by Avast to perform a program update, to which I agreed because I had never experienced any troubles doing so before. When it finished, I told it to reboot later because I was in the middle of writing an e-mail. After I had finished what I needed to do, I restarted my system. It was strange, thoug, because I noticed that the system did not actually restart... I saw the logging off & shutting down screen but all my hardware remained on after my monitor faded to black. I decided to force shutdown at that point (after waiting for about 5 min). Upon restart, I got stuck on the Starting Windows screen (waited for b/t 1-2 minutes and decided it was stuck). I forced shutdown again and tried to boot to safe mode. This is when I noted that I was stuck on aswrvrt.sys. After waiting for about 10 min, I forced shutdown again. I double checked BIOS for any potential errors and found nothing. Then I went to the F8 advanced startup menu to try to perform system repair. Incidentally, I found out I don't have that option listed. Didn't matter, though, because I had my Win7 installation usb key. I rebooted and booted from said usb key. I tried to go through the automatic repair prompts. They didn't help, though, as I still could not boot (experiencing the same symptoms as described above). At this point, I did some google searches and happened upon a couple of posts on this forum:
http://195.74.76.34/index.php?topic=144131.0
and http://forum.avast.com/index.php?topic=135244.0
I managed to figure out how to pull up the cmd via the win7 usb system repair. I was able to run FRST but then following along those threads, I realized I didn't know what sort of a fix file to use. Nevertheless, I decided to follow the instructions to use the Bootrec /FixBoot & /FixMBR functions. After that, I was able to successfully boot to safe mode (I did not try normal boot just yet). From Safe Mode, I seemingly successfully uninstalled Avast using the uninstall tool. Before allowing restart, I figured I would try to run through FRST & AdwCleaner. I got stuck during the AdwCleaner process on the step where it was scanning my Web Browsers (waited at least half an hour). At that point, I figured I could try the scan again later after rebooting since I had supposed that a normal reboot would work after safe mode worked and uninstalling Avast. I was mistaken because I was met with the same symptom of being stuck on Starting Windows. I then tried, again, to boot to Safe Mode and found myself back to square one --- stuck on aswrvrt.sys. I then tried the same process I had previously performed to be able to get into Safe Mode, but it wasn't working this time. Considering it was past 1:30 AM and I had already worked on it for 3 hours, I decided to give it a rest at that point. This morning, I tried to tackle the problem again, but after running chkdsk /r on the boot drive and still being unable to boot after trying various more suggestions I found off the aforementioned threads, I have decided it would be in my best interest to create my own thread and get some personal help.
So that's where I'm at.... I would greatly appreciate any help from any party to try to get this resolved. I would really like to avoid a reformat because honestly I haven't backed up in a while due to personal complications in my life... almost died 3 Sundays ago, but that's beside the point. I look forward to hearing your responses. Thanks.
-
Could you attach an FRST log please and I will take a shufti
-
Thanks for the reply. Surely. The one I've attached I'm pretty sure is what was the result of the FRST scan after I had booted to safe mode. I also Addition.txt for your reference if applicable.
-
If this fails could you remove the two additional hard drives on the system so that only the windows drive is connected
Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that
-
Here it is
-
Are you able to boot now ?
-
i will try now. i was awaiting a response incase there were any actions you'd want me to take before moving on to try restart.
-
yes, proceeded to boot albeit slowly. what actions should i take now to assure this problem does not reoccur?
btw, the following error message popped up:
AvastUI.exe - applicationerror
The exception Breakpoint... A breakpoint has been reached (0x80000003) occured in the application at location 0x66396b80.
I am supposing this is due to my previous attempt to uninstall avast
-
well, i was prompted to perform windows updates. i told it to postpone 10 minutes then went afk for a little while and came back to an autorestart. again, it would not boot -- i was met with the same problem as before (stuck on starting windows screen).
-
Could you provide a fresh FRST log please
-
glad our heads are at the same place. i was already on it. here it is.
btw, i unplugged my additional drives so the only active hard drive should be my boot drive
-
well i'm sad that i havent heard back, but i'm sure you have good reason. whenever you get the opportunity to consider my situation again, please do so. i am still struggling with the same issue. thanks.
-
I am on GMT time zone so there will be a difference between when we are online
After this fix has run reboot to normal mode, run the Avast uninstall utility, but do not accept the option to boot to safe mode. Run it from normal mode
Download Avast Uninstall Utility (http://www.avast.com/en-gb/uninstall-utility) to your Desktop.
Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that
-
that's okay, i figured as much (from your sn :P)
i ran FRST & fixed as you said. i then booted windows normally successfully (with less delay than yesterday). i ran the avast uninstall utility without restarting to safe mode (ran in normal mode). it seemed to have worked successfully. should i restart now as per the prompt?
-
Yep now try a restart please
-
restart was successful! huzzah!
at this point, i suppose i should reinstall avast. any other steps i should be taking to prevent this from happening again? should i try rebooting with my other drives and usb peripheral accessories connected as well? id assume i should wait on the latter til after any further steps.
-
Insert one drive at a time and then reboot
If each boots successfully then you will be good to go
-
okay, cool. i'll work on that and report any problems if they arise. so there aren't any other processes i should run through, then, such as the ones listed by TwinHeadedEagle @ http://195.74.76.34/index.php?topic=144131.msg1046400#msg1046400 ?
-
There was a bit of adware but we will remove that once the boot is confirmed as fixed :)
-
oh, okay. i was running malawarebytes while waiting for your response previously. should i hold off on that til after i confirm successful reboots? or is it fine to do that now?
-
No, continue. I will be using AdwCleaner as MBAM may not get it all
-
kk. i will report back after confirming restarts adding a drive at a time.
-
so im not sure if you're aware of the 2 supplemental drives i have, but one is a 1 TB storage drive and the other is another SSD on which i install programs i don't use as regularly (i.e. games ... the ones i would use more regularly go on my boot drive)
i plugged the SSD back in first and experienced no problems on boot. i realized that i had forgotten to install avast previously to reconnecting the drive, so i did that during this startup.
i then tried rebooting with my storage drive connected as well. although startup was successful, it was slower than before (i suppose that can be expected considering drive speeds), but then after logging in, my typical applications startup got stuck on skype, which is loaded on my boot drive. so im not sure if there's some sort of interference or miscommunication between my drives.
-
okay, i wasn't able to do anything on my system at that point. it just got stuck. so i shut down (not manually.. the shut down command from start menu still worked). double checked my hardware connections. started up again. and it's running fine. what's next?
-
OK now to see what adware you have :)
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
-
how long does the scan typically take? it scanned the first few things really quickly but it's been on "analyzing browsers..." for about 5-6 min as of now
i wonder b/c the progress bar doesn't seem to be moving and i had believed earlier in the process (as i described in my original post) that the scan stalled on this step. according to my task manager, it looks like it is still working, though.
-
Stop the adwcleaner scan and run this instead
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your Desktop
Secondary link (http://www.itxassociates.com/OT-Tools/OTL.exe)
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
(https://dl.dropboxusercontent.com/u/73555776/OTL_Main_Tutorial.gif)
- Select All Users
- Select LOP and Purity
- Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
c:\program files (x86)\Google\Desktop
c:\program files\Google\Desktop
dir "%systemdrive%\*" /S /A:L /C
/md5start
rpcss.dll
/md5stop
CREATERESTOREPOINT
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Attach both logs
-
is the custom scan box text very important? i jumped the gun and pressed run scan before pasting that text in =\
i tried to stop the scan and restart it as soon as i noticed but i didn't see a way to do so without ending the process in task manager, so i let it be
-
i forgot to attach these to my previous post.
should i run another scan with the custom text inputted?
-
i decided it probably wouldnt hurt to do it. not sure why but only 1 .txt file came out of it (no extras.txt). the new otl.txt is attached.
i await your next instruction. based on the reference thread, it looks like you'll provide me with custom code for the otl fix and then it'll be onto combofix?
-
No need for combofix :)
On completion of this let me know of any problems
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:Commands
[CREATERESTOREPOINT]
:OTL
IE - HKU\S-1-5-21-1780703873-3060701200-248834442-1000\..\SearchScopes\{68A7778D-EC94-4EBA-9627-47A972823643}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468&UP=SPFB27D38C-0A37-406B-B095-8AEA64EAA8B2&SSPV=
:Commands
[resethosts]
[emptytemp]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
okay, done. here it is.
-
How is the computer behaving now ?
-
so far so good! the only thing i've noticed is that startup is a little slower than it used to be, but it's consistently starting up without any problems now. :)
if you've any other suggestions, i'm happy to hear it. otherwise, i think we're good at this point. either way, thank you so very much! you're awesome! :D
-
Just let me know if anything untoward happens in the next few days
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Download and run Delfix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix)
(https://dl.dropboxusercontent.com/u/73555776/delfix.JPG)
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article (http://www.forbes.com/sites/eliseackerman/2013/01/11/us-department-of-homeland-security-calls-on-computer-users-to-disable-java/) and this article (http://www.nbcnews.com/technology/technolog/us-warns-java-software-security-concerns-escalate-1B7938755).
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser (http://www.geekstogo.com/2600/how-to-disable-java-in-your-web-browser/) and How to unplug Java from the browser (http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/))
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent (http://www.foolishit.com/vb6-projects/cryptoprevent/) install this programme to lock down and prevent crypto ransome ware
(https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG)
Malwarebytes (http://www.malwarebytes.org/mbam-download.php).
Update and run weekly to keep your system clean
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/)Keep safe :wave:
-
kk cool. thanks again!
-
well, i don't know what set it off, but i am experiencing the exact same problem all over again after being fine for a few days.
stuck on starting windows ... reboot, try safe mode -> stuck on aswRvrt.sys ... tried system repair restore point & got nothin.
i've gone ahead and attached for you my FRST.
(FYI, unfortunately, my school term has started so my correspondence will be slow.)
-
oh i think i might've realized what set it off since i just remembered your advice about java. i had to re-enable it to use a program (or so the program indicated). the program in question is pdfill tools, which i use to convert images to pdf. when i opened it, it prompted me to install java, which i did... is that the culprit? =\
-
OK lets run back the registry initially
Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that
-
hiya essexboy, thanks for your prompt reply. sorry i couldn't be as rapid with mine. i just got home from class and ran the fix. log is attached. upon restart, i still got stuck on starting windows screen. tried safe mode, and same as before -- stuck on aswRvrt.sys. since my laptop was being slow, i decided to run FRST scan again, so also attached is that log.
-
Did you install anything else apart from Java ?
Download the attached Fixlist.txt to the same location as FRST
Run FRST and press Fix
On completion a log will be generated please post that
Then try a normal boot
-
nothing else comes to mind... i was in class all morning and into the early afternoon... came home, did my typical internet routine... just browsing the web. watched some nba. the only thing i can think of out of the ordinary was the java.
-
here's the fixlog. still stuck on starting windows screen upon normal reboot.
-
Hmm that was after fully removing Avast, methinks there may be a hardware problem here somewhere
I will have a rummage around
-
hm i think you're right. i just d/ced all my peripherals (usb and hd) and it booted. i will connect one at a time and let you know what the culprit is.
-
My guess would be the HD. You need another copy of Avast Ooops
Let me know if you find the culprit. If it appears to work then it may be an intermittent fault on one of the USB ports
-
looks like it's my 1TB storage drive.
-
Are you able to plug it in after the computer has started with no ill effect ?
-
yes, it appears that is the case
-
i've run a malawarebytes scan on all drives. didn't find anything. reinstalled avast and currently running full system scan.
-
well, after system scan and bootscan, things seem to be working. i don't want to jinx myself, though, because i have some pending windows updates and i understand sometimes those can mess things up... will do the updates and restart after i do what i need to do for the evening.
-
It may be worth leaving the external drive unplugged until after the computer has booted
-
it is actually an internal drive, but i see your point. it booted fine after the windows updates with the drive connected, so maybe w/e the issue was was resolved in the bootscan. regardless, i will keep what you've said in mind in the future. any other ideas for diagnosing a specific problem? thanks again for all your assistance. i really appreciate it!
-
The only thing I can think of is to check the condition of the ribbon and ensure it is fully connected