Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on May 10, 2016, 10:34:37 PM
-
My PC was recently updated (by a family member) to Windows 10 and has been working fine for a few weeks. Over the weekend, an Avast (free version) message indicating that it had found and deleted a virus came up (I don't have the exact message, but it looked legit FWIW). Regardless, the next time I powered up the machine it wouldn't boot up and gave various options for repair (system restore, PC reset, etc.). I tried the system restore using all of the date/time stamps listed, but to no avail. The PC Reset also didn't work.
The one clue that came up while attempting the second system restore was the following message:
System Restore failed to replace the file (D:\Program files\AlwilSoftware\Avast5\Setup\prod-vps.vpx) with its original copy from the restore point. An unspecified error occurred during system restore. (0x80070002)
Any thoughts on how to move forward here? Perhaps the version of Avast being run isn't compatible with Windows 10. It's hard to know what to do when the computer won't even boot up.
Thanks in advance for any help.
-
We need to get to get to the command prompt, is that one of the options available to you ?
If so then :
Download Farbar Recovery Scan Tool x64 (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) and save to a USB drive
Insert the USB and access the command prompt
At the command prompt type the following :
(https://dl.dropbox.com/u/73555776/notepad.JPG)
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
(https://dl.dropboxusercontent.com/u/73555776/frst.JPG)
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.
-
Thanks, I'll try this out and see what happens.
-
I ran the frst64.exe program as requested and have attached the frst.txt.
Thanks again for your help.
-
S5 t; <===== ATTENTION: Locked Service
S5
; <===== ATTENTION: Locked Service
This appears to be the problem, Have you tried to run refresh http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html
-
Thanks, Essexboy. I had tried option one in this http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html to reset the PC previously, and tried again, receiving the same message (after only a few minutes):
"There was a problem resetting your PC. No changes were made."
FYI... I never get prompted to 'Insert Media'.
I unfortunately can't try option 2 in those instructions because I can't get past the boot screen.
Any other thoughts on what I can do?
-
Unfortunately my tools are not strong enough to remove those entries
You could try this
Create an emergency repair USB drive:
Download Dr Web Live USB (http://www.freedrweb.com/liveusb/?lng=en) to your desktop
- Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
- Launch drwebliveusb.exe.
- The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).
(https://dl.dropbox.com/u/73555776/liveusb_ru.jpg)
- To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
- Files will be copied automatically.
- Once the copying process is completed, press the Exit button to close the application.
- Reboot the infected computer with the USB in the drive
- Ensure that the first boot device is USB - If you are not sure about that then see this page (http://www.hiren.info/pages/bios-boot-cdrom) for instructions
- As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.
(https://dl.dropboxusercontent.com/u/73555776/Live%20boot%20screen.png)
- Use arrow keys to select DrWeb-LiveCD (Default)
(https://dl.dropboxusercontent.com/u/73555776/drwebselect.JPG)
- Press select objects for scanning
(https://dl.dropboxusercontent.com/u/73555776/drwebfolders.JPG)
- When the system is loaded, check the disks or folders you want to scan, and click on Start.
- The programme will now scan for and cure/delete any malware that it finds. Allow it to do so
(https://dl.dropboxusercontent.com/u/73555776/drwebscan.JPG)
(https://dl.dropboxusercontent.com/u/73555776/drwebscancomplete.JPG)
- Select Open Report and copy to the USB
- Once completed reboot to normal windows, and attach the report here
-
I will have to find another computer to do this on as my work PC won't allow me to run this drwebliveusb.exe file, unless I can run it from the USB on the problem computer?
-
Yes, create the USB on a serviceable system and then run on the affected one
-
Hi, I followed the instructions -- had to borrow a friends computer to run the .exe, and was able to run the Dr Web Live USB on the impacted PC (it ran for 23 hours). However, after running it there was no prompt to save the log and I couldn't find the log even after using the help to tell me where it was located. I was able to at take a pic at the end of the scan but the file was too large to attach, So I've typed out what it showed I'll try further to find the log.
-----
Unfortunately, not all detected threats were neutralized.
Dr. Web CureIt! was unable to neutralize all detected threats
Threats detected: 13
Threats neutralized: 7
Object Threat Action Path
Hosts Probably DFH:HOS… Cured g:\windows\system32\drivers\etc\hosts
SafeBoot Probably DRH:SafeB.. Cured HKLM\SYSTEM\ControlSet001\Control\SafeBoot
Bitguard.exe, De.. Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows NT\Curre…\bitguard.exe, Debugger
Bprotect.exe, De.. Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows NT\Curre…\bprotect.exe, Debugger
Browserdefender Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows…\browserderender.exe, Debugger
Browserprotect Probably DRH:IFEO Cured HKLM\Software\Microsoft\Windows N..\browserprotect.exe,Debugger
Winlogon, Userinit Probably DRH:User1 Cured HKLM\SOFTWARE\Wow6432Node\Microsoft\Wind…\Winlogon, Userinit
JuniperSetupXP… Infected container Move error G:\Documents and Settings\Thom\AppData\Roa…\JuniperSetupXP.exe
DatamngrUI.exe Adware.Bandoo.244 Move error G:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe
DatamngrCoordin Adware.Bandoo.244 Move error G:\Program Files (x86)\Movies Toolbar\Data…\DatamngrCoordinator.exe
JuniperSetupXP… Infected container Move error G:\Users\Thom\AppData\Roaming\Juniper Netwo..\JuniperSetupXP.exe
JuniperSetupXP… Infected container Move error G:\Users\Thom\Application Data\Juniper Network…\JumiperSetupXP.exe
CouponPrinter.ocx Adware.Coupons.44 Move error G:\Windows\CouponPrinter.ocx
-----
-
The only other option is to try a regback
Download the attached fix list to the same location as FRST
Start FRST and press fix
On completion try a normal boot
-
I copied that .txt file to the flash drive, and went through the steps again.
This was the fixlog:
Fix result of Farbar Recovery Scan Tool (x64) Version:09-05-2016
Ran by SYSTEM (2016-05-16 09:07:09) Run:1
Running from j:\
Boot Mode: Recovery
==============================================
fixlist content:
*****************
LastRegBack: 2016-05-01 12:04
*****************
DEFAULT => copied successfully to System32\config\HiveBackup
DEFAULT => restored successfully from registry back up
SAM => copied successfully to System32\config\HiveBackup
SAM => restored successfully from registry back up
SECURITY => copied successfully to System32\config\HiveBackup
SECURITY => restored successfully from registry back up
SOFTWARE => copied successfully to System32\config\HiveBackup
SOFTWARE => restored successfully from registry back up
SYSTEM => copied successfully to System32\config\HiveBackup
SYSTEM => restored successfully from registry back up
==== End of Fixlog 09:07:30 ====
Now it appears that the machine has booted normally. Thank you very much. What other actions (if any) should I take with regard to avast (was this problem really avast related?) to avoid this happening in the future?
-
I do not believe it was Avast related except that it may not have cleanly removed the malware
If you wish I can take a look to see what is present
-
Sure, if you are able to check, that would be great. What information do you need from me in order to do so?
-
Lets start easy :)
Please download Farbar Recovery Scan Tool (http://www.geekstogo.com/forum/files/file/435-frst-farbars-recovery-scan-tool/) and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
- Select additions at the bottom
- Press Scan button.
(https://dl.dropboxusercontent.com/u/73555776/frst.JPG)
- It will produce a log called FRST.txt in the same directory the tool is run from.
- Please attach both logs generated.
-
Thanks, essexboy. The logs are attached.
-
Let me know of any problems after this
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-3047490936-217768153-4051942873-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3047490936-217768153-4051942873-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
2010-11-09 22:13 - 2010-11-09 22:13 - 0000006 _____ () C:\Users\Thom\AppData\Roaming\completescan
2010-11-09 22:09 - 2010-11-09 22:09 - 0000010 _____ () C:\Users\Thom\AppData\Roaming\install
2010-11-09 22:03 - 2010-11-09 22:03 - 0000175 _____ () C:\Users\Thom\AppData\Roaming\ssdfsfs.bat
2010-11-09 22:03 - 2010-11-09 22:03 - 0000000 _____ () C:\Users\Thom\AppData\Local\Llesoqa.bin
2010-11-09 22:03 - 2010-11-09 22:03 - 0000120 _____ () C:\Users\Thom\AppData\Local\Ysexa.dat
2012-01-19 22:50 - 2012-01-19 22:50 - 0000000 _____ () C:\Users\Thom\AppData\Local\{53B116C0-6E6D-48D6-A470-31320CA96E00}
2011-10-23 08:48 - 2011-10-23 08:48 - 0000000 _____ () C:\Users\Thom\AppData\Local\{B92AE9D4-797D-4B28-BD89-D6C6D4759BF2}
CustomCLSID: HKU\S-1-5-21-3047490936-217768153-4051942873-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Thom\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-3047490936-217768153-4051942873-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Thom\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
-
fixlog is attached; thank you.
-
Are you experiencing any problems ?
-
Sorry, had separate long issue with internet connection. As far as I can tell, there are no additional problems. Thanks again for your help, essexboy.
-
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Remove tools
Download and run Delfix (http://www.bleepingcomputer.com/download/delfix/)
Select the options as shown
(https://dl.dropboxusercontent.com/u/73555776/delfix.JPG)
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article (http://www.forbes.com/sites/eliseackerman/2013/01/11/us-department-of-homeland-security-calls-on-computer-users-to-disable-java/)
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser (http://www.geekstogo.com/2600/how-to-disable-java-in-your-web-browser/) and How to unplug Java from the browser (http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/))
If you do need to keep Java then download JavaRa (https://singularlabs.com/software/javara/javara-download/)
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version
(https://dl.dropboxusercontent.com/u/73555776/javara.JPG)
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
CryptoPrevent (http://www.foolishit.com/vb6-projects/cryptoprevent/) install this programme to lock down and prevent crypto ransome ware
(https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG)
Malwarebytes (http://www.malwarebytes.org/mbam-download.php)
Update and run weekly to keep your system clean
Unchecky (http://unchecky.com)
Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme ;)
It is critical to have both a firewall and anti virus to protect your system and to keep them updated.
To learn more about how to protect yourself while on the internet read this little guide Best security practices (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/)Keep safe :wave:
-
Thanks so much again, essexboy. I've following your advice and have everything set up except for the firewall and the Java piece that I need to still work on.