Lack of answer

[moroni]

However, when I got that link and attempt to respond, I can not  do so, as it says I must complete the field for Order ID, but will not accept my ticket number.  It is a ctach 22, as it says I must respond, or they will cancel the ticket, but the email was sent to me today, and they will not accept my ticket #, so it is impossible to respond. It appears they already canceled the order before sending me the email saying they will cancel the order, if I don't respond.

This is really crazy. What can i do? 

Hi,

Your refund has already been issued. The support ticket is being closed because the request has already been processed.
Closing the ticket doesn't mean cancelling your request
You actually don't need to reply, but in case you feel your case has not been resolved you can just reply to the email you received.

Thanks, Moroni!  Today I got an email saying my order has been processed and I will get the refund soon. Sorry if I got a bit upset there, but it was very confusing to get an email yesterday saying they were closing the ticket because they had heard nothing from me, as that was not at all the case.  In fact, it seems it was a case of the left hand not knowing what the right hand is up to. lol

These things happen. All's well that ends well. If I hadn't been so mixed up about this, I would have taken the discounted offer for Premier that I got last night, when I logged into my account. But didn't want to do anything before I know the ongoing ticket order had been sorted out. Afraid it might cause further confusion. lol  Oh, well, no biggie! Maybe next time. 

No problem! Glad to hear that it was just a misunderstanding

What was the offer about? Send me a PM

[REDACTED]

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

hopefully this is what you are asking for. please bare with me as i'm not even remotely IT proficient.

regards

Tom

[Asyn]

OK, now you've to wait a bit...

[essexboy]

OK I may need to run a stronger tool than these, but lets see first

On completion of this try and re-install Avast again and let me know if there is an error

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$ec2ae66688b4b9dd54a4b07736df2a38\n. <==== ATTENTION
HKU\S-1-5-21-697015470-4189967249-1225989827-1000\...\Run: [TOY5KNQ8OC] => C:\Users\THOMAS~1\AppData\Local\Temp\Zhd.exe <===== ATTENTION
HKU\S-1-5-21-697015470-4189967249-1225989827-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-697015470-4189967249-1225989827-1000\$ec2ae66688b4b9dd54a4b07736df2a38\n. ATTENTION
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
Winsock: Catalog5 01 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
SearchScopes: HKU\S-1-5-21-697015470-4189967249-1225989827-1000 -> {B6FFFBC1-429A-4F03-A24B-AE2DD7DB4C6F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutDtDtBtAyD0AtDzytCyEyByBtAtA0DzytN0D0Tzu0CyDtBzztN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu1R1F1F1I1H1B1Q&cr=2129092172&ir=
Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKU\S-1-5-21-697015470-4189967249-1225989827-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKU\S-1-5-21-697015470-4189967249-1225989827-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
FF Plugin HKU\S-1-5-21-697015470-4189967249-1225989827-1000: @facebook.com/FBPlugin,version=1.0.1 -> C:\Users\Thomas Kemp\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll [No File]
FF Plugin HKU\S-1-5-21-697015470-4189967249-1225989827-1000: @hola.org/FlashPlayer -> C:\Users\Thomas Kemp\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2015-10-14] ()
FF Plugin HKU\S-1-5-21-697015470-4189967249-1225989827-1000: @hola.org/vlc -> C:\Users\Thomas Kemp\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2015-10-14] (Hola)
CHR HKLM\...\Chrome\Extension: [nbmafkdmkkckhggblphicnnhlgljnoje] - C:\Program Files\TornTV.com\torn2_10.crx <not found>
CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\THOMAS~1\AppData\Local\mysearchdial_speedial_v9.0.2.crx [2013-06-11]
CHR HKU\S-1-5-21-697015470-4189967249-1225989827-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\THOMAS~1\AppData\Local\mysearchdial_speedial_v9.0.2.crx [2013-06-11]
2016-01-19 19:18 - 2016-01-19 19:19 - 00000000 ____D C:\Users\Thomas Kemp\AppData\Local\{A947A434-6B57-46B9-AAAC-0E64B62AAA82}
2016-02-07 10:34 - 2010-02-17 18:39 - 00000252 ____H C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
2016-02-07 10:27 - 2010-02-17 18:39 - 00000304 ____H C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
2013-06-11 17:16 - 2013-06-11 17:16 - 0423709 _____ () C:\Users\Thomas Kemp\AppData\Local\mysearchdial_speedial_v9.0.2.crx
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{F7117AE6-81F2-45B8-96EE-56F6FD357A48}\InprocServer32 -> C:\ProgramData\{49A0BAC7-3326-4433-9373-4AA8793ABB5C}\mydocs.dll => No File
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\$Recycle.Bin ()
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{83A4D5A6-E2C1-4edd-AD48-1A1C50BD06EF}\InprocServer32 -> C:\Users\Thomas Kemp\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\ImageUploade (the data entry has 17 more characters).
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{94AB719E-1300-4098-8C18-B2A765327D15}\InprocServer32 -> C:\Users\Thomas Kemp\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\ImageUploade (the data entry has 17 more characters).
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{BA6272FD-A7AD-4498-9476-552040B7EDD4}\InprocServer32 -> C:\Users\Thomas Kemp\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\ImageUploade (the data entry has 17 more characters).
CustomCLSID: HKU\S-1-5-21-697015470-4189967249-1225989827-1000_Classes\CLSID\{BF357E76-2001-47F1-8057-46DEE9627DFD}\InprocServer32 -> C:\Users\Thomas Kemp\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\ImageUploade (the data entry has 17 more characters).
Task: {376F122B-F7DA-4A05-BA4B-F89802A294AE} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {3E14308E-C15F-44F6-9620-0DD5F85C1056} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: {02CCF9B5-243C-44A9-A619-FD3DB220257A} - System32\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C} => C:\Windows\msb.exe
Task: {A1B3F2AE-1F63-4283-AB66-1F4FC6117408} - System32\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015} => C:\Users\THOMAS~1\AppData\Local\Temp\Zhd.exe <==== ATTENTION
Task: {FA258DA9-E914-4C0B-86A2-6C95D669E8DB} - System32\Tasks\{8629FF29-F786-440A-B8E8-606B4D893BC0} => pcalua.exe -a "C:\Users\Thomas Kemp\Downloads\MP10Setup.exe" -d "C:\Users\Thomas Kemp\Downloads"
Task: {FB27EDCC-1834-4A83-8F6E-A7486FFFA42D} - System32\Tasks\{117FE413-0BF5-4355-B758-0C3A27FECFBF} => pcalua.exe -a "C:\Users\Thomas Kemp\Desktop\Warchiefs\autorun.exe" -d "C:\Users\Thomas Kemp\Desktop\Warchiefs"
Task: C:\Windows\Tasks\Ad-Aware Update (Weekly).job => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job => C:\Windows\msb.exe
Task: C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job => C:\Users\THOMAS~1\AppData\Local\Temp\Zhd.exe <==== ATTENTION
IE trusted site: HKU\S-1-5-21-697015470-4189967249-1225989827-1000\...\hola.org -> hxxp://hola.org
C:\$Recycle.Bin\S-1-5-21-697015470-4189967249-1225989827-1000\$ec2ae66688b4b9dd54a4b07736df2a38
C:\$Recycle.Bin\S-1-5-18\$ec2ae66688b4b9dd54a4b07736df2a38
C:\Windows\msb.exe
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S0].txt as well.
  

Download the correct version of Avast 
Avast Free
Avast Pro
Avast Internet Security
Avast Premier

[REDACTED]

the program you gave me has been running for hours and keeps saying that the farbar recovery tool is not responding. I don't want to cancel it in case it causes issues. what is the best course of action?

[essexboy]

Cancel the programme , reboot and then do the following

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[REDACTED]

ok I ran combo fix and the log is attached.

[essexboy]

Could you now run a fresh FRST scan please and try Avast again

[REDACTED]

Sorry for the lack of reply. I have been away with work the last few days. Scan logs as requested are attached. I have also been able to successfully download and install the latest version of avast pro and it has accepted the license avast provided me with.

regards,

Tom

[essexboy]

Logs look good, any further problems ?

[REDACTED]

No it all seems ok. The entire system seems quicker which for a laptop of this age is a nice surprise. Many thanks for your help. It's nice to see that people who have a talent for computers and software are willing to help those who do not. Not just write and publish malevolent  viruses and spyware.

Regards

Tom

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Remove Combofix

Click  Start  then Run.
On Windows7 or Vista  you may use  Start Search  field if  Run  is not available.
In the box copy/paste the following command:

ComboFix  /Uninstall

Note that there is a space between "  ComboFix  " and "  /Uninstall  " .

Then click  OK  (or press  Enter ).
Wait for the uninstall process to complete.

Remove tools

Download and run Delfix
Select the options as shown



: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select  Remove Java Runtime.  Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme 

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide  Best security practices Keep safe  :wave: