Problems with Avast!

[Lisandro]

Is Kasperky installed?

Please, post the last 300-350 lines of avast log: C:\Program Files\Alwil Software\Avast4\DATA\log\Setup.log

[Skooter]

See attachment. No, Kapersky is not installed.

[Mr.Agent]

its strange the problem i read all fast but if im not wrong maybe a virus is attacked his pc im not sure but im thinking

[Lisandro]

Code: [Select]

10.03.2009 13:05:49.000 1236708349 package Tried to download servers.def but failed with error 0x000004C7.Please, post the last 200-250 lines of avast log: C:\Program Files\Alwil Software\Avast4\DATA\log\Setup.log
All you need to know about updates and IP addresses: http://www.avast.com/eng/updates2.html#idt_1366

Also check:

1) If your subscription allows the update right now (i.e., if it is not expired). Home (free) version need registering each 14 months.

2) If your firewall settings and allow avast.setup to connect.
    If you're not sure, just turn off your firewall (to be sure the update failure is not due to it).
    Maybe you should 'remove' avast.setup entry, try to update, receiving a new alert from the firewall, allowing it and checking it to remember.

3)  Check your proxy settings into avast!:
     Left click the avast icon > Settings
     Update (Basic) > Details > Proxy
     Make sure your browser is not set to "Work Offline" (this option is generally in the File menu).
     If it doesn't help, try switching from "Auto-detect" to "No proxy" (I'm assuming you're not connecting to the Internet via proxy).

4) Also you can try changing update service's login account, follow this:
    Open services control panel (e.g. Start->Run, and type: services.msc
    Double-click on avast! iAVS4 Control Service to show properties. Switch to LogOn page.
    Enter administrator account name and password.
    Do the same for avast! Antivirus service.
    Then start update again.

5) The last option, check if the servers.def file is corrupt or 0KB (C:\Program Files\Alwil Software\Avast4\Setup\servers.def).
    You can try and download the servers.def file, http://files.avast.com/iavs4x/servers.def and replace the one in the avast setup folder.

[Skooter]

1.) can't update.

2.)Firewall is currently off.

3.)No proxy is on now.

4.)Avast! doesn't appear on services...

5.)The smallest server.def is 4kb.

[Lisandro]

4.)Avast! doesn't appear on services...

Very strange... your installation is deeply corrupted...
Which was your old antivirus? How did you uninstall it?

[Skooter]

Stop-sign. I uninstalled it through the built-in uninstaller. I think there could be some traces of it left over that is causing this though. Any idea how to check and if there is how to delete it?

[Lisandro]

Stop-sign. I uninstalled it through the built-in uninstaller.

Which antivirus?

[CharleyO]

***

It is Stop Sign antivirus, Tech.

Not a very good program at all.

Click the image below to enlarge.


***

[scythe944]

I found this info on how to remove StopSign on their site.  http://support.stopsign.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=168&nav=0,33

I hope it helps.

[Skooter]

Yeah, that's how I un-installed it. The potential problem is left over registry entries...

[CharleyO]

***

Please download HiJackThis from the link below and we will see if we can find some remains.

Download it to the hard drive and not to the desktop. Copy & Paste the log in this thread OR attach it to your next post.


***

[Skooter]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:16:52 PM, on 3/28/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCM3.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1217613169515
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe

[CharleyO]

***

There is no ending.

Is that all of it?


***

[.: L' arc :.]

-= Me too.. I suffer that AAVM RPC Error.. It was after my latest update a few days ago & moreover, I don't have any previous antivirus.. I started a topic about this but can't find any solutions yet.. The problem does not persist in other antiviruses like Avira and AVG..

-= Is this due to a malware or a conflicting program..?