[RESOLVED] avast 6.0.1 free wont update

[SafeSurf]

Have you tried uninstalling Spyboot completely to see if this resolves your problem?

FYI -- I would turn on your Windows firewall (FW) for some protection.

[galocza]

not until now. unfortunately it doesnt.

[SafeSurf]

SB won't uninstall?  I just need to clarify what you wrote.  I'm suggesting that you uninstall as a test to see if this is causing your problem; you can always reinstall should there be no problem.

Try this again:

Uninstall Spybot S&D with Teatimer: http://www.safer-networking.org/en/howto/uninstall.html.
- How to disable Spybot-S&D (temporarily).  http://www.safer-networking.org/en/howto/disable.html .  Even though it says temporarily, the resident parts of SpyBot Search & Destroy must be enabled manually if disabled in this manner.  TeaTimer doesn't load into memory at all when disabled.

Remember to reboot after you uninstall.  Let me know how this goes.  Thank you.

[galocza]

sorry that i wasnt clear.
i uninstalled sb comletely (not only disabled when offered that option), rebooted and still nothing.

[Zyndstoff (aka Steven Gail)]

Sometimes it is a malware related issue.

It did solve problems on someone else's thread when he scanned with Malwarebytes Antimalware. See here: http://forum.avast.com/index.php?topic=74980.msg621810#msg621810
Please try that.
MBAM Quick Scan is sufficient.

Just to make sure it's not malware that prevents the update.

[galocza]

i did it already (i read about it here in the forum), but now i run it again. nothing unexpected:
4/3/2011 8:47:11 AM
mbam-log-2011-04-03 (08-47-05).txt

Scan type: Quick scan
Objects scanned: 152461
Time elapsed: 1 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[SafeSurf]

You have a problem...you are infected but you "took no action" when you ran the MBAM scan.  You need to put the infected items into quarantine when you run the MBAM scan.

Also, you did not give me the complete MBAM log.  When you cut and paste, I need the complete log from the very top so I  know the version of MBAM you are using, the complete fingerprints included, etc. (so I know if you updated prior to scanning).

So now after you ran MBAM, you are still infected.  What you need to do is update MBAM again, then Click the “remove selected” button to quarantine anything found."  Then post your complete MBAM log.  Thank you. 

[galocza]

it is solved. i searched for this kind of problem in general, and i found a hint to check the temp folder environment variables.
user variables were ok but to my surprise system variables were set to f:\something\win_temp (i think something was temp, so it was f:\temp\win_temp). f: is a dvddrive, so avast could not download to it. i guess avast uses a different method (or user temp variable) to download via the add/remove programs method, so using that i succeeded updating.
for all of those who have the same problem, go to:

start menu/settings/control panel/system/advanced tab/environment variables

and check variables "tmp" and "temp" in both user and system variables. by default they should point to c:\windows\temp (although they might contain other variables like %systemroot%).

and let me add:
THANKS TO EVERYONE WHO TOOK THE TIME AND EFFORT TO HELP US WITH THIS ELUSIVE PROBLEM!

btw in the meantime i ran a few malware detectors none of them found anything.
the "infected" values mbab found are intentional to keep my winxp the way it is (not to show start menu items help and search, force classic control panel etc).
im not sure how i managed to get the system temp variables mixed up, but im happy that its solved, and hope that the others in this topic have the same source of the problem so it can be fixed this easy.

i really missed the few first lines of the log, here is a new one:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6253

Windows 5.2.3790 Service Pack 2
Internet Explorer 8.0.6001.18702

4/3/2011 1:01:56 PM
mbam-log-2011-04-03 (13-01-51).txt

Scan type: Quick scan
Objects scanned: 152149
Time elapsed: 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[YoKenny]

You still took no action!

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Value: ForceClassicControlPanel -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (PUM.Hijack.Help) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

You need to do as SafeSurf says

Click the “remove selected” button to quarantine anything found." 

[SafeSurf]

@ YoKenny,  I mentioned this to the OP already, but I will comment again.  Thanks.

@ galocza,

If you claim that you need the items that MBAM is flagging as "infected" malware for an international setting and you are absolutely certain this is not malware (infection), then you should enter these item(s) in MBAM under the tab labelled "Ignore List" so it is not flagged again in future scans.  However, I must admit, I've never heard of such international settings.

Are the items that MBAM flagged ever picked up in Avast scans?

Also, I noticed that you are using XP SP2.  You really should update to SP3 since there are many security holes by not updating and this puts you at great risk for getting malware and SP is no longer supported.  Go to MS/Windows Updates to update your machine and any other patches from MS.

You may also want to do a free Secunia scan http://secunia.com/vulnerability_scanning/personal/ to see if any of your software is out of date as well.  This site will give you the direct vendor's download link if you need to upgrade.  Many of us here scan our machines weekly since software changes so often, and having out of date software also puts you at risk.

What are you using for a firewall (FW)?  If you are using the XP FW, this only provides 1-way protection and not 2-way protection, which is recommended.  We can give you a list of compatible FW's with Avast if needed or use Avast IS (AIS).

I'm glad you were finally able to install Avast.  I don't know how or why it tried to install on your F:/drive instead of your HDD, but at least that is resolved.

Report back on the other questions I posted above.  Thanks. 

[YoKenny]

Also, I noticed that you are using XP SP2.  You really should update to SP3 since there are many security holes by not updating and this puts you at great risk for getting malware and SP is no longer supported.  Go to MS/Windows Updates to update your machine and any other patches from MS.

They are running windows (xp x64) and it only has SP2

Since 64-bit Windows XP Is Not Getting Service Pack 3
http://news.softpedia.com/news/Since-64-bit-Windows-XP-Is-Not-Getting-Service-Pack-3-76409.shtml

[Asyn]

They are running windows (xp x64) and it only has SP2

You're right, Kenny.

[galocza]

hi SafeSurf,

mbam people are aware of these values:
http://forums.malwarebytes.org/index.php?showtopic=18970

service pack: as Kenny explained.

program update: i regularly update all my security related software (including web browser, flash player), those that have automatic update check, instanteniously (including os).

and now something that i will be resented for: i dont have a firewall. never seemed to need them. sorry

the following is general musing and might be boring and uninteresting (maybe not easy to follow), read at your own risk!
...
i thought about it, and im not sure its possible but i think somehow my windows got this variable from another windows.
let me explain.
i use nlite for years now and in the past (4-5 years ago) i experimented with various settings, including the temp environment variables. then i found out that the install modifies only the user temp dir (not system temp dir) and since then i edit those only after installing windows, i dont modify these when creating the new nlite install image anymore. then - 4 years ago - i might have hade something like f:\temp\win_temp for windows temp dir. i checked just now - i always keep the last nlite install image - the recent install has the default %USERPROFILE%\Local Settings\Temp, just like expected. i cannot imagine that i set those variables wrong after installing, because since i have raid (a bit more than 4 years) the windows temp dir is always d:\temp\wintemp. i cannot imagine that i mistyped twice, first f: then win_temp instead of wintemp.
on the other hand in the last weeks i had two boot hdds in my computer a few times because of lightscribe - i had 3 hdd deaths in the last few years, so i always have an installed winxp on an old hdd, a "rescue" hdd if you will - and although i cannot explain how, maybe this setting was "imported" from the old windows to the new. it doesnt seem very possible, and even the old windows should be newer than having this variable.
ok, the truth is i still have no idea.
...
boring part ends here

thanks for all your posts, ideas and advices,
g

[SafeSurf]

Sorry for misreading your OS...it was past my bedtime.  I understand that you keep your machine up to date updates, which is a good thing. 

It is up to you regarding the use of a firewall since this is your machine.

After reading your last post, I can see how perhaps the installation of Avast may have gotten messed up and installed in the wrong place on your machine, but at least you got it sorted out.

At this point, is everything resolved now and working correctly?  ::fingers crossed::

[norhuma]

Hey Zyndstoff, galocza, SafeSurf, thanks a lot for your continued efforts!

I already posted on page 1 of this thread, and unfortunately, my own update problem persists. I understand that this thread is getting a bit bloated so let me quickly recap:

(1) galocza's problem was that his environment variables were corrupted, and changing them back solved his update problem. In my case, that's not the problem (I just checked it, both 'tmp' and 'temp' point to "%USERPROFILE%\AppData\Local\Temp", which should be correct for my Win 7.

(2) My OS: Windows 7 Professional, Service Pack 1.

(3) My problem: updating definitions or the program via GUI doesn't work, but updating them via 'add/remove programs' menu *does* work.

(4) I tried to 'repair' Avast, as well as a complete un-, then re-install (with the provided uninstall program).

(5) I just ran Malwarebytes Anti-Malware: no detections.

(6) One potential cause for my problem: I have one more AV program running in parallel (Avira AntiVir).

<DISCLAIMER> I am aware of the problems related to running 2 AV programs in parallel. I observe them closely for potential conflicts, and had none so far.</DISCLAIMER>

Anyway, I just uninstalled Avira, repaired Avast, rebooted, but the problem is still there, so I guess that wasn't the cause.

(7) Please note the following observation I made:

In the Avast GUI, under the 'maintenance' window, it says that "a newer program version" and "newer virus definition" have been found, and it then lists those new versions as "0.0.0" and "000000-0", respectively. Additionaly, in the same window, Avast says the last update attempt was on "1.1.1970". This is presumably some kind of bug and perhaps related to my problem.


Alright, that's all I can think of... Anybody got any ideas what I should do next?