Avast WEBforum
Other => Viruses and worms => Topic started by: REDACTED on May 22, 2015, 06:36:13 PM
-
I noticed Avast background service is not running and getting error avast5/setup/setup.ini is corrupt. I went ahead and tried to uninstall using normal Add/Remove Program, got error The stub cannot run installer/updater executable 'C:\Program Files\Alwil Software\Avast5\setup\Sfx\instup.exe'(code 0x3)
I went ahead and tried using Avastclear, still got the same problem/error i.e The stub cannot run installer/updater executable 'C:\Program Files\Alwil Software\Avast5\setup\Sfx\instup.exe'(code 0x3)
I'm stuck.
-
See here https://forum.avast.com/index.php?topic=53253.0
Scroll down to Farbar Recovery Scan Tool (second picture) run as instructed and attach the two diagnostic logs in your next reply here
-
Thanks for the replay.
Let me follow the link you have provided and provide the attachments.
-
Please find the attachments
-
This fix must be run from safe mode otherwise it will fail
The main problem is that you have two directories for Avast, one for Avast 4 and the other for later versions
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5515496 2015-05-11] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll [2015-05-07] (Avast Software s.r.o.)
HKU\S-1-5-21-1645522239-1682526488-682003330-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-02-25]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-20]
S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-05-07] (Avast Software s.r.o.)
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24144 2015-05-07] ()
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [74976 2015-05-07] (Avast Software s.r.o.)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [55200 2015-05-07] (Avast Software s.r.o.)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49904 2015-05-07] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [787760 2015-05-07] (Avast Software s.r.o.)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [427992 2015-05-07] (Avast Software s.r.o.)
R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57888 2015-05-07] (Avast Software s.r.o.)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [209048 2015-05-07] ()
2015-05-22 03:33 - 2015-05-22 03:33 - 00000000 ____D () C:\Program Files\AVAST Software
2015-05-07 18:05 - 2015-05-07 18:04 - 00291312 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\aswBoot.exe
2015-05-07 18:04 - 2015-05-07 18:04 - 00043112 _____ (Avast Software s.r.o.) C:\WINDOWS\avastSS.scr
2015-05-22 19:18 - 2012-07-06 22:28 - 00000366 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job
2015-05-07 18:04 - 2014-05-13 02:05 - 00024144 _____ () C:\WINDOWS\system32\Drivers\aswHwid.sys
2015-05-07 18:04 - 2013-03-18 13:35 - 00209048 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys
2015-05-07 18:04 - 2013-03-18 13:35 - 00074976 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2015-05-07 18:04 - 2013-03-18 13:35 - 00049904 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys
2015-05-07 18:04 - 2011-02-25 02:11 - 00787760 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSnx.sys
2015-05-07 18:04 - 2009-09-08 04:28 - 00427992 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswSP.sys
2015-05-07 18:04 - 2009-09-08 04:28 - 00057888 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswTdi.sys
2015-05-07 18:04 - 2009-09-08 04:28 - 00055200 _____ (Avast Software s.r.o.) C:\WINDOWS\system32\Drivers\aswRdr.sys
C:\Windows\System32\runouce.exe
CustomCLSID: HKU\S-1-5-21-1645522239-1682526488-682003330-1003_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> No Filepath
CustomCLSID: HKU\S-1-5-21-1645522239-1682526488-682003330-1003_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> No Filepath
CustomCLSID: HKU\S-1-5-21-1645522239-1682526488-682003330-1003_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> No Filepath
Task: C:\WINDOWS\Tasks\avast! Emergency Update.job => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe
C:\Program Files\Alwil Software
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
-
Also remove everything from IObit.
-
Please find attached, also Avast still not running
-
Did you run the full fixlist ? As it only appears to have done half of the job
If it worked properly then Avast will no longer be on your computer
-
Removed IObit as suggested, then rerun the fixlist again and it has worked! Thank you.
-
Are you going to re-install now ?
-
Yes, I reinstalled and everything seem to be running okay.
-
Hey essexboy,please, could you help me?
I've had the same problem about this topic and I followed the steps described in the above link.
Find attached the documents: Malwarebytes document, Farbar documents and asw MBR document.
-
You also have McAfee installed which do you wish to keep
-
Yes! It was just Mcaffe support app, but now I just removed this program.
Even though I did it, my avast program doesn't run and I am not able to remove it.
-
My main goal is to remove the avast and afterwards install the mcafee.
But when I access th Control Panel it doesn't let me remove the avast.
When I try to remove the avast by its steps in its website so it show up this message which we are talking about.
-
OK this will remove both Avast and McAfee as they are blocking each other
This fix must be run in safe mode or it will fail
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [3460784 2011-04-18] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2011-04-18] (AVAST Software)
BHO: avast! WebRep -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-04-18] (AVAST Software)
BHO-x32: avast! WebRep -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18] (AVAST Software)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2011-04-18] (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2011-04-18] (AVAST Software)
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll [2014-12-08] (McAfee, Inc.)
CHR HKLM-x32\...\Chrome\Extension: [icmlaeflemplmjndnaapfdbbnpncnbda] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-08-08]
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [42184 2011-04-18] (AVAST Software)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [373704 2015-07-15] (McAfee, Inc.)
S3 mfevtp; C:\Windows\system32\mfevtps.exe [254792 2015-06-29] (McAfee, Inc.)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [22360 2011-04-18] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [64344 2011-04-18] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswRdr.sys [31064 2011-04-18] (AVAST Software)
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [600920 2011-04-18] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [287064 2011-04-18] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [53592 2011-04-18] (AVAST Software)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-07-02] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-07-02] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-07-02] (McAfee, Inc.)
2015-08-16 02:22 - 2015-08-16 02:22 - 00000000 ____D C:\Users\Vinícius\AppData\Roaming\McAfee
2015-08-16 02:21 - 2015-08-16 02:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-08-16 02:21 - 2015-08-16 02:21 - 00000000 ____D C:\Program Files (x86)\McAfee
2015-08-16 01:36 - 2015-08-16 01:37 - 00000000 ____D C:\Program Files\stinger
2015-08-16 01:36 - 2015-06-29 10:03 - 00254792 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe
2015-08-15 23:29 - 2015-08-15 23:29 - 00003254 _____ C:\Windows\System32\Tasks\{B420D7C6-6CCA-4294-A0C0-B1E3EF2D97ED}
2015-08-15 23:28 - 2015-08-16 02:21 - 00000000 ____D C:\Users\Todos os Usuários\McAfee
2015-08-15 23:28 - 2015-08-16 02:21 - 00000000 ____D C:\ProgramData\McAfee
2015-08-15 23:28 - 2015-08-15 23:28 - 00000000 ____D C:\Program Files\Common Files\McAfee
2015-08-15 21:23 - 2015-08-15 21:23 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-08-15 21:23 - 2015-08-15 21:23 - 00000000 ____D C:\Program Files\Common Files\AV
2015-08-06 23:03 - 2015-08-15 21:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
2015-08-06 23:03 - 2015-08-15 20:29 - 00000000 ____D C:\Users\Todos os Usuários\AVAST Software
2015-08-06 23:03 - 2015-08-15 20:29 - 00000000 ____D C:\ProgramData\AVAST Software
2015-08-06 23:03 - 2015-08-06 23:03 - 00001841 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2015-08-06 23:03 - 2015-08-06 23:03 - 00000000 ____D C:\Program Files\AVAST Software
2015-08-06 23:03 - 2011-04-18 14:25 - 00253888 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-08-06 23:03 - 2011-04-18 14:25 - 00199304 _____ (AVAST Software) C:\Windows\SysWOW64\aswBoot.exe
2015-08-06 23:03 - 2011-04-18 14:25 - 00040112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-08-06 23:03 - 2011-04-18 14:18 - 00287064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-08-06 23:03 - 2011-04-18 14:17 - 00600920 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-08-06 23:03 - 2011-04-18 14:16 - 00053592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2015-08-06 23:03 - 2011-04-18 14:13 - 00064344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-08-06 23:03 - 2011-04-18 14:13 - 00031064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2015-08-06 23:03 - 2011-04-18 14:13 - 00022360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
Task: {51375EE1-30B9-44AC-B6B8-1EC62E02BF43} - System32\Tasks\{B420D7C6-6CCA-4294-A0C0-B1E3EF2D97ED} => pcalua.exe -a "C:\Program Files\AVAST Software\Avast\aswRunDll.exe" -c "C:\Program Files\AVAST Software\Avast\Setup\setiface.dll" RunSetup
Task: {9238BED9-9422-418A-8A41-072A598F2894} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-08-15] (AVAST Software)
Task: {BD421E1D-F52D-4796-828A-61C681CED3C3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-08-08] (Avast Software s.r.o.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
C:\Program Files\AVAST Software
C:\Program Files\Common Files\McAfee
C:\Windows\System32\mfevtps.exe
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
-
Dear,
You are really a genius, my computer is 100% ok now.
Thanks for your help.
-
:)