PC no longer boots up -- Avast related?

[REDACTED]

My PC was recently updated (by a family member) to Windows 10 and has been working fine for a few weeks. Over the weekend,  an Avast (free version) message indicating that it had found and deleted a virus came up (I don't have the exact message, but it looked legit FWIW). Regardless, the next time I powered up the machine it wouldn't boot up and gave various options for repair (system restore, PC reset, etc.). I tried the system restore using all of the date/time stamps listed, but to no avail. The PC Reset also didn't work.

The one clue that came up while attempting the second system restore was the following message:

System Restore failed to replace the file (D:\Program files\AlwilSoftware\Avast5\Setup\prod-vps.vpx) with its original copy from the restore point. An unspecified error occurred during system restore. (0x80070002)

Any thoughts on how to move forward here? Perhaps the version of Avast being run isn't compatible with Windows 10. It's hard to know what to do when the computer won't even boot up.

Thanks in advance for any help.

[essexboy]

We  need to get to get to the command prompt, is that one of the options available to you ?

If so then :

Download  Farbar Recovery Scan Tool x64  and save to a USB drive

Insert the USB and access the command prompt

At the command prompt type the following  :   
   


The notepad opens. Under File menu select Open. 
Select "Computer" and find your flash drive letter and close the notepad. 
In the command window type e:\frst64.exe and press Enter 
Note: Replace letter e with the drive letter of your flash drive. 
The tool will start to run. 
When the tool opens click Yes to disclaimer. 

Press Scan button. 
It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

[REDACTED]

Thanks, I'll try this out and see what happens.

[REDACTED]

I ran the frst64.exe program as requested and have attached the frst.txt.

Thanks again for your help.

[essexboy]

S5 t;  <===== ATTENTION: Locked Service
S5
;  <===== ATTENTION: Locked Service

This appears to be the problem, Have you tried to run refresh http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html

[REDACTED]

Thanks, Essexboy. I had tried option one in this http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html to reset the PC previously, and tried again, receiving the same message (after only a few minutes):

"There was a problem resetting your PC. No changes were made."

FYI... I never get prompted to 'Insert Media'.

I unfortunately can't try option 2 in those instructions because I can't get past the boot screen.

Any other thoughts on what I can do?

[essexboy]

Unfortunately my tools are not strong enough to remove those entries

You could try this

Create an emergency repair USB drive:
Download Dr Web Live USB to your desktop

• Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
• Launch drwebliveusb.exe.
• The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).

• To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
• Files will be copied automatically.
• Once the copying process is completed, press the Exit button to close the application.
• Reboot the infected computer with the USB in the drive
• Ensure that the first boot device is USB - If you are not sure about that then see this page for instructions
  
• As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

• Use arrow keys to select  DrWeb-LiveCD (Default)

• Press select objects for scanning

• When the system is loaded, check the disks or folders you want to scan, and click on Start.
• The programme will now scan for and cure/delete any malware that it finds.  Allow it to do so 

• When it has completed

• Select Open Report and copy to the USB
• Once completed reboot to normal windows, and attach the report here

[REDACTED]

I will have to find another computer to do this on as my work PC won't allow me to run this drwebliveusb.exe file, unless I can run it from the USB on the problem computer?

[essexboy]

Yes, create the USB on a serviceable system and then run on the affected one

[REDACTED]

Hi, I followed the instructions -- had to borrow a friends computer to run the .exe, and was able to run the Dr Web Live USB on the impacted PC (it ran for 23 hours).  However, after running it there was no prompt to save the log and I couldn't find the log even after using the help to tell me where it was located. I was able to at take a pic at the end of the scan but the file was too large to attach, So I've typed out what it showed I'll try further to find the log.

-----
Unfortunately, not all detected threats were neutralized.
Dr. Web CureIt! was unable to neutralize all detected threats

Threats detected: 13
Threats neutralized: 7

Object   Threat   Action   Path
Hosts   Probably DFH:HOS…   Cured   g:\windows\system32\drivers\etc\hosts

SafeBoot   Probably DRH:SafeB..   Cured   HKLM\SYSTEM\ControlSet001\Control\SafeBoot
Bitguard.exe, De..   Probably DRH:IFEO…   Cured   HKLM\Software\Microsoft\Windows NT\Curre…\bitguard.exe, Debugger
Bprotect.exe, De..   Probably DRH:IFEO…   Cured   HKLM\Software\Microsoft\Windows NT\Curre…\bprotect.exe, Debugger
Browserdefender   Probably DRH:IFEO…   Cured   HKLM\Software\Microsoft\Windows…\browserderender.exe, Debugger
Browserprotect   Probably DRH:IFEO   Cured   HKLM\Software\Microsoft\Windows N..\browserprotect.exe,Debugger
Winlogon, Userinit   Probably DRH:User1   Cured   HKLM\SOFTWARE\Wow6432Node\Microsoft\Wind…\Winlogon, Userinit
JuniperSetupXP…   Infected container   Move error   G:\Documents and Settings\Thom\AppData\Roa…\JuniperSetupXP.exe
DatamngrUI.exe   Adware.Bandoo.244   Move error   G:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe
DatamngrCoordin   Adware.Bandoo.244   Move error   G:\Program Files (x86)\Movies Toolbar\Data…\DatamngrCoordinator.exe
JuniperSetupXP…   Infected container   Move error   G:\Users\Thom\AppData\Roaming\Juniper Netwo..\JuniperSetupXP.exe
JuniperSetupXP…   Infected container   Move error   G:\Users\Thom\Application Data\Juniper Network…\JumiperSetupXP.exe
CouponPrinter.ocx   Adware.Coupons.44   Move error   G:\Windows\CouponPrinter.ocx
-----

[essexboy]

The only other option is to try a regback

Download the attached fix list to the same location as FRST
Start FRST and press fix
On completion try a normal boot

[REDACTED]

I copied that .txt file to the flash drive, and went through the steps again.

This was the fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:09-05-2016
Ran by SYSTEM (2016-05-16 09:07:09) Run:1
Running from j:\
Boot Mode: Recovery
==============================================

fixlist content:
*****************
LastRegBack: 2016-05-01 12:04

*****************

DEFAULT => copied successfully to System32\config\HiveBackup
DEFAULT => restored successfully from registry back up
SAM => copied successfully to System32\config\HiveBackup
SAM => restored successfully from registry back up
SECURITY => copied successfully to System32\config\HiveBackup
SECURITY => restored successfully from registry back up
SOFTWARE => copied successfully to System32\config\HiveBackup
SOFTWARE => restored successfully from registry back up
SYSTEM => copied successfully to System32\config\HiveBackup
SYSTEM => restored successfully from registry back up

==== End of Fixlog 09:07:30 ====

Now it appears that the machine has booted normally. Thank you very much. What other actions (if any) should I take with regard to avast (was this problem really avast related?) to avoid this happening in the future?

[essexboy]

I do not believe it was Avast related except that it may not have cleanly removed the malware

If you wish I can take a look to see what is present

[REDACTED]

Sure, if you are able to check, that would be great. What information do you need from me in order to do so?

[essexboy]

Lets start easy

Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Select  additions at the bottom
• Press Scan button.
  
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please attach both logs generated.