AVAST Installation not successful after uninstalling 360 Total Security

[Eddy]

They are already looking a lot better than the first log files, but there still are some things to remove/clean-up.
I'll leave it to dbrisendine to guide you with it.

[dbrisendine]

The logs do look better but there is still an issue on a left-over driver that needs to go ....


Please download Malwarebytes Anti-Rootkit from here

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
  
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt
  

[REDACTED]

Thanks, again, dbrisendine and Eddy. I will post the logs when they are ready.

[REDACTED]

Hi, dbrisendine and Eddy,

I ran mbar twice.

The first time, I got this message:
DDA Driver installation error.
Driver installed on boot. Reboot required.

The reboot was hanging for a long time. So, I long-pressed the power button. When it booted, mbar was running.
Then, I got this message
Infected: C:\Temp\TrustedInstaller.exe --> [Trojan.Agent.NR]
A restore point was created and the cleanup was done.

Then, I ran mbar again.
This time, no infection was found.

Both sets of logs are attached.

Thanks, again for your help.

[dbrisendine]

That is better.  Now we need a fresh set of FRST logs and see what needs to be done next.

The directions are going to be a little different than you did before so please follow these:

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST64 that is on your Desktop by right clicking on the file, selecting "Run as Administrator" and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt in the Optional Scans section of FRST64.  Also select 90 Days Files in the Optional Scans section.

Press Scan button.

It will make two logs (FRST.txt and addition.txt) on your Desktop. Please attach the logs in your reply back.   Thanks.

[REDACTED]

Hi, dbrisendine and Eddy,

PFA FRST and Addition files.

Thanks again and again for your help.

[dbrisendine]

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Google Chrome Packages

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window. 

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.


SECOND >>>>

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

[REDACTED]

Hi, dbrisendine and Eddy,

Thanks again for your help.

When I opened Control Panel to Uninstall Programs, Google Chrome Packages is in the list.
The "Installed On" date is in 2015. Nothing is shown in the Size column.

When I clicked on uninstall Google Chrome Packages, I got this message:
You have already uninstalled all the offers that came with Google Chrome Packages or that the installation is still in progress.
So, I clicked on CLOSE.

Then, I ran FRST and clicked on Fix. The Fixlog.txt file is attached.

Then, I saw the list of programs using Control Panel. Google Chrome Packages is still there. When I click on Uninstall, I get the same message as before.
The date is still in 2015 and the size is not shown.

Thanks again.

[dbrisendine]

Run a few searchs with FRST.

First a registry search.

• Right click on FRST on your desktop and select "Run as Administrator..." When the tool opens click Yes to disclaimer.
• Type Google Chrome Packages into the Search Box.
• Press the Search Registry button.
• It will produce a log called SearchReg.txt in the same directory the tool is run from.
• Please attach the log file back here.

Run a File Search with FRST.

• Right click on FRST on your desktop and select "Run as Administrator..." When the tool opens click Yes to disclaimer.
• Type Google Chrome Packages into the Search Box.
• Press the Search Files button.
• It will produce a log called SearchFiles.txt or Search.txtin the same directory the tool is run from.
• Please attach the log file back here.

[REDACTED]

Hi, dbrisendine and Eddy,

Thanks again for your help.

I have attached the Search and SearchReg files. I have also attached a Screen Shot of the Processes that are running.
It shows that AvasuUI is running but nothing happens when a right-click on a filename is followed by a Scan with Avast.

Thanks.

[dbrisendine]

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

[REDACTED]

Hi dbrisendine,

Great news. I followed your instructions. After running FRST Fix, Google Chrome Packages is no longer running in the computer.
PFA the Fixlog file.

I uninstalled the Avast program. I have downloaded the off-line Avast installer using another computer. Should I install Avast using the off-line installer or ...? There is no anti-virus running in the computer now.

Thanks again.

[dbrisendine]

Install Avast using the offline installation file.  Once installed, please reboot the system (if the installer does not ask for it) and then run a update in Avast until it tells you there are no more updates.

Tell us how this progresses for you.

[REDACTED]

Hi dbrisendine,

Avast Free Anitvirus is now running. It is seen in Programs and Features. Google Chrome Packages is not there in the list.

Avast icons is there in the Notification area.

However, I see "You are unprotected. Avast background service is not running". Clicking on "Start Now" or "Resolve All" seems to do nothing.
Under components, File Sys Shield, Mail Shield, and Web Shield are OFF.
Software Updater, Browser Cleanup, and others are ON.


I tried to Update. The current version of the program is 12.3.2280 (build 12.3.3154.0). Release date 1/1/1970.

For virus definitions, when I try to update, it says "Failed to update. The Avast service is not running".

I restarted. Then did an Update on the program. I was offered Essential update or Essential update + internet Security. I chose Essential. There is no change in the Program Current Version number. For virus definitions, Current version is unknown. Update failed.

Will registration of Avast help? I will ask the owner to do so using owner's email id.

Thanks and thanks again.

[REDACTED]

The registration is valid till next month, it says.

When I click on register now, I get a "The AAVM subsystem detected a RPC error" message.