Avast! Has been disabled

[Alicia82]

My SAS scan picked up some Trojans this morning (which may be false positives...waiting to hear back from the SAS forums). When I restarted the computer, Avast! was disabled. I've clicked on the "Fix Now" button, but nothing happens.

Should I try reinstalling as soon as all the scans have cleared?

[DavidR]

What are the file names, locations and malware names given by SAS for these detections ?

Try a repair of avast:
XP - Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and select Repair, click next and follow.

Vista, win7 - Control Panel, Programs & Features, uninstall a program, select 'avast! Anti-Virus,' click the Uninstall/Change and select Repair, click next and follow.

You should reboot after the repair.

[Alicia82]

Hi, DavidR
   Looking at the SAS forums, it seems like a lot of people are having problems with SAS and Avast! today. I'm still waiting for the complete SAS scan to finish, if i can figure out how, I'll let you know if where the Trojans were detected.

If it helps, I'm running Vista 32-bit. (I took took my computer offline and I'm using an iPad until this gets sorted.) This stuff is way over my head!

[Alicia82]

I think the Trojans are false positives coming from Avast! My Avast! wasn't disabled, I had removed it when I removed the false positives via SAS.

I'll try reinstalling Avast and see what happens. :/

[Jobber]

I usually do a daily SaS Scan, and it said there were 4 Critical thingies and to remove and reboot.

After I rebooted, I received a message from Windows 7 that Avast! wasn't working ("SYSTEM IS UNSECURED); this is when I first became aware that Avast! was not working.

Tried the 'Fix It' button. Also the 'Start Program' button below that.

Avast! still isn't working.

Looks like Big Troubles and I don't know what to do.


(Maybe stop looking at all that internet porn      although I only browsed 3-4 websites yesterday.




So, is there a fix that will get Avast! running again?



OS: Windows 7

------------------------------------------------------------------------------------------------------------------------------------------------------------
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/21/2012 at 12:59 PM

Application Version : 5.6.1014

Core Rules Database Version : 9776
Trace Rules Database Version: 7588

Scan type       : Complete Scan
Total Scan Time : 00:18:19

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 638
Memory threats detected   : 0
Registry items scanned    : 76468
Registry threats detected : 0
File items scanned        : 90331
File threats detected     : 20

Adware.Tracking Cookie
   C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Cookies\0LHE2KX2.txt [ /atdmt.com ]
   C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Cookies\NEMZ3VOB.txt [ /c.atdmt.com ]
   C:\USERS\ALEX\AppData\Roaming\Microsoft\Windows\Cookies\Low\ABV234E8.txt [ Cookie:alex@casalemedia.com/ ]
   C:\USERS\ALEX\AppData\Roaming\Microsoft\Windows\Cookies\Low\QFQUCIR5.txt [ Cookie:alex@collective-media.net/ ]
   C:\USERS\ALEX\AppData\Roaming\Microsoft\Windows\Cookies\Low\LDHVHGTW.txt [ Cookie:alex@realmedia.com/ ]
   C:\USERS\ALEX\AppData\Roaming\Microsoft\Windows\Cookies\Low\N9B1JQ0S.txt [ Cookie:alex@questionmarket.com/ ]
   C:\USERS\ALEX\AppData\Roaming\Microsoft\Windows\Cookies\Low\VV1XER5U.txt [ Cookie:alex@ad.yieldmanager.com/ ]
   C:\USERS\ALEX\Cookies\0LHE2KX2.txt [ Cookie:alex@atdmt.com/ ]
   ads.crakmedia.com [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   ads.crakmedia.com [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .doubleclick.net [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .doubleclick.net [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .amazon-adsystem.com [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .yadro.ru [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
   .exoclick.com [ C:\USERS\ALEX\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

Trojan.Agent/Gen-AgentSmall
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWRUNDLL.EXE
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\DEFS\12122100\FWAUX.DLL

Trojan.Agent/Gen-Siggen
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWIDLE.DLL
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\SETUP\INF\ASWFSBLK.SYS

------------------------------------------------------------------------------------------------------------------------------------------------------------------

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.12.20.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Alex :: ALEX-PC [administrator]

12/21/2012 1:38:20 PM
mbam-log-2012-12-21 (13-38-20).txt

Scan type: Full scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 422716
Time elapsed: 10 minute(s), 15 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[Pondus]

have you tried restoring the avast files from SAS quarantine ?

Trojan.Agent/Gen-AgentSmall
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWRUNDLL.EXE
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\DEFS\12122100\FWAUX.DLL

Trojan.Agent/Gen-Siggen
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWIDLE.DLL
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\SETUP\INF\ASWFSBLK.SYS

you may need to run avast repair after that

[Jobber]

What are the file names, locations and malware names given by SAS for these detections ?

Try a repair of avast:
XP - Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and select Repair, click next and follow.

Vista, win7 - Control Panel, Programs & Features, uninstall a program, select 'avast! Anti-Virus,' click the Uninstall/Change and select Repair, click next and follow.

You should reboot after the repair.

I tried this Repair option first.

The Repair option isn't coming up; I receive an Error message as Attached below:

have you tried restoring the avast files from SAS quarantine ?

Trojan.Agent/Gen-AgentSmall
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWRUNDLL.EXE
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\DEFS\12122100\FWAUX.DLL

Trojan.Agent/Gen-Siggen
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\ASWIDLE.DLL
   C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\SETUP\INF\ASWFSBLK.SYS

you may need to run avast repair after that

OK, after the above stated Repair option didn't work,  I restored the avast files from SAS quarantine using the Manage Quarantine in SAS as Pondus suggested.


Then I tried to Repair Avast!:

Try a repair of avast:
XP - Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and select Repair, click next and follow.

Vista, win7 - Control Panel, Programs & Features, uninstall a program, select 'avast! Anti-Virus,' click the Uninstall/Change and select Repair, click next and follow.

You should reboot after the repair.

I'm getting the exact same error message as shown in the Attachment below.


No Repair window is showing after i click on "Uninstall/Change" ; I just get the Error message.


Tried the 'Fix It' button again. Also the 'Start Program' button below that.

Avast! still isn't running.



 

[Pondus]

try this

run avast uninstall tool from safe mode http://www.avast.com/uninstall-utility   and reboot
install avast again and reboot

and do not let SAS remove any avast files....i guess this is a FP that SAS must fix?
http://forums.superantispyware.com/index.php?/topic/7184-trojanagentgen-siggen-trojanagentgen-agent-trojanagentgen-agentsmall/

thay say it is fixed in that topic with latest SAS update..... see reply #15

[Dch48]

Wow, I'm glad I don't use SAS any more. I think Malwarebytes is much better and is the only supplemental scanner I now use.

[Jobber]

try this

run avast uninstall tool from safe mode http://www.avast.com/uninstall-utility   and reboot
install avast again and reboot

and do not let SAS remove any avast files....i guess this is a FP that SAS must fix?
http://forums.superantispyware.com/index.php?/topic/7184-trojanagentgen-siggen-trojanagentgen-agent-trojanagentgen-agentsmall/

thay say it is fixed in that topic with latest SAS update..... see reply #15

Got Avast! going again after following Pondus's advice.


It was quite easy.


Thank you for your help on this matter.

[tdtv-bkt432]

in the SUPERAntiSpyware Scan Log i think you crack your avast!