(Solved)Avast Free Full Scan Hangs After 10 Files on winlogon.exe

[REDACTED]

This is on Win7 Home Premium  64 bit system.
SuperAntiSpyware Quick scan was OK
Malwarebytes found spyware.hawkeyeKeyLogger, and fixed.
Avast Free full scan ran for an hour and only looked at 10 files and stopped on winlogon.exe each time ( 4 tries ).
Rebooted and tried again, same result.
Booted into Safe Mode to try.
Opening Avast it says I'm in not protected, the background service is not running ( probably because I'm in Safe Mode? ).
Try Full Scan and get the following message: Unable to start scan, there are no more endpoints available from the endpoint mapper.
SuperAntiSpyware quick scan ran fine in Safe Mode. Malwarebytes running now, looks normal.
Avast Free is the only one of these three that is always active, the other two I run as standalones.
Any help would be appreciated and thanks for your time.

[Pondus]

Repair and reset > https://www.avast.com/faq.php?article=AVKB204#artTitle

[REDACTED]

The repair went ok, but I still have the same scenario, a full scan stalls on winlogon.exe.
I tried a Quick Scan which ran fine.
I checked the scan history and in late August the full scan ran fine.
Now starting a full scan, the system locks up tighter than a crabs butt.. Task Manager doesn't even stop it. The Avast GUI grays out with a small blue spinning circle that doesn't stop.
Only way I've been able to break out of it is unplug from the AC and remove the battery.

[Eddy]

I suggest to follow these instructions > https://forum.avast.com/index.php?topic=53253.0
Let's see if there are things that can cause the problem.

[REDACTED]

Just to be sure of your instructions:
I've already ran Malwarebytes, it found a key logger the other day but hasn't since. It removed the file with no problem.
So you still need me to download and run Farbar Recovery Scan Tool and aswMBR.exe?
I don't have an infected USB stick and I can boot my machine, so I don't need to run MCShield and OPTPENet.exe?
Also. I'm not sure where to post the resultant logs.
Thanks for your time

[Pondus]

Only the two FRST logs are needed, and attach them here

[bob3160]

You attach them right here:

[REDACTED]

The Farbar files were ran from my Limited User account as an Administrator and the files ended up on that account's Desktop.
When I ran the aswMBR program, I couldn't find it on the Limited User Desktop ( I'm pretty sure I said to save it to the Desktop ) so I ran it again. When it ran the second time it seemed to run a lot quicker, I found it on the Desktop of the Admin account.
So here they are, please let me know if this is how you needed them.
Thanks again for your time.

[dbrisendine]

Can one of the moderators please move this thread to the Virus / Malware section.  Thank you.

pbmac => The reason for the scan stalling is that you have a possible ZeroAccess infection.  We will try and remove what we can with this script and then check to see what else we need to do.



FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Coupon Printer for Windows
QuickTime 7
Yahoo! Toolbar

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window. 

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.


SECOND >>>>

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file (located at the bottom of this post) and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.


LAST >>>>

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST64 that is on your Desktop by double clicking and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt in the Optional Scans section of FRST64.

Press Scan button.

It will make two logs (FRST.txt and Addition.txt) on your Desktop. Please attach the logs in your reply back.

[REDACTED]

Under "LAST>>>" you say to remove the Addition text file generated from the first time I ran FRST. Should I also remove the FRST text file as well? They both reside where the FRST app is, all on the Desktop. Or just rename them.Thanks.

[dbrisendine]

You can remove both log files (FRST.txt and Addition.txt); they are backed up in a separate directory if needed anyway.  We ask for the Addition.txt file to be deleted as FRST used to leave that file instead of replacing it.

[REDACTED]

Logs attached.
Thank you.

[dbrisendine]

The script seems to have fixed some issues but the rescan did not show everything needed.  Can you log in as the Main Admin and run the FRST scan again?  Thank you.

[REDACTED]

You probably think I'm crazy for this, but I wasn't sure if you wanted me to "Run As Administrator" or run the scan from the Main Account.
I did both just in case there is a difference.
The "*_1" logs were ran on the Main Admin account.
The "*_2" logs were from the Limited User account, but "Ran As Administrator".
Thank you.

[dbrisendine]

You have two different versions of Skype on the machine; I would uninstall from both users for the time being and decide on whether needed or not.  Also, why is ooVoo on the system?  It seems to be blocked by the firewall rules so is it needed?

After these uninstalls (or version correction for Skype), does a full scan by Avast under the Main Admin account (not Alex account) still hang?