Recourring popups from avast

[oldman]

Hi tweaker,

They don't look like accounts based on the screenshot. Let's have a look and see if some registry keys are in order then we should be able to remove the appData and hedev "accounts".

Click start

• In the search box type cmd
  
• hit enter
  
• copy and paste the following lines one at a time into the run box.
• hit enter after each one.
  
  

Code: [Select]

REG QUERY HKU

REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s

• after the second one has finished right click the black window and click select all
  
• click the small c:\ in the upper right hand corner
  
• highlight edit
  
• click copy
  

You will now be able to paste the output into your next reply.

[tweaker]

5-21-1634204230-2477496727-1112962895-1000
    ProfileImagePath    REG_EXPAND_SZ    C:\Users\kris
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x100
    Sid    REG_BINARY    01050000000000051500000046FA67619799AB934F775642E803000
0
    ProfileLoadTimeLow    REG_DWORD    0x0
    ProfileLoadTimeHigh    REG_DWORD    0x0
    RefCount    REG_DWORD    0x1
    RunLogonScriptSync    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-21-1634204230-2477496727-1112962895-1010
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x204
    Sid    REG_BINARY    01050000000000051500000046FA67619799AB934F775642F203000
0
    ProfileLoadTimeLow    REG_DWORD    0x0
    ProfileLoadTimeHigh    REG_DWORD    0x0
    RefCount    REG_DWORD    0x0
    RunLogonScriptSync    REG_DWORD    0x0


C:\Users\kris>

[oldman]

Hi tweaker,

That didn't come out quite as expected.

Please copy and paste the text in the code box into a notepad.

Code: [Select]

cd e:\
REG QUERY "HKU" > %USERPROFILE%\Desktop\profile.txt
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s >> %USERPROFILE%\Desktop\profile.txt
start %USERPROFILE%\Desktop\profile.txt
In the notepad click file > save as

• Make sure the Save as box is set to Desktop
  
• In the filename box type profile.bat
  
• click save
  

You should now have a file on your desktop named profile.bat. It will have an icon with a couple of gears in it.

• Right click the file and click run as Adminstator
  
• ok the UAC
• a black window will open
• when the window closes a notepad named profile.txt will open
  
• it will also be saved to your desktop

Please post the contents of profile.txt

[tweaker]

ok here it is

[oldman]

Hi tweaker,

The only thing that may be out of the "ordinary" is entry that doesn't seem to be related to an account. Let me look over the logs again to see what we can do.

[tweaker]

ok i'll await your reply.

[oldman]

Hi tweaker,

Let's start with removing some of the junctions. Delete the copy of fixlist.txt you have and download the attached one. save it to your desktop. Post the fixlog.txt produced.

[tweaker]

ok here it is, also included the junction points.

thank you

[oldman]

Hi tweaker,

I spent most of my spare time on the weekend playing win Win7 on a VM. When you took ownership did you happen to either delete, move or copy any folders?

[tweaker]

most likely, when i get permission errors is usually because im trying to either save something to alocation like desktop or documents and get denied. Or sometimes its a desktop folder i want to delete but get denied.

[oldman]

Hi tweaker,

Is the error access denied, you do not have permissions?

It's off to bed soon then work then back to the VM.

[tweaker]

usually the error i get (when i get it) is do not have permission, however i havnt had that issue in a while

[oldman]

Hi tweaker,

Boy do I feel bad. I could have sworn that I replied but I don't see any post. I was wondering why I hadn't heard from you, now I know why.

I played around with this and the only way I could replicate a log similar to yours is by placing the junction inside a folder that I didn't have access to. With out the computer in front of me it's very difficult to say if that is the same situation as you are encountering.

Let me know what you want to do. A backup, reformat and reinstall might be the simplest and fastest solution.

Again I apologise for not posting.