Can't Uninstall Avast 5.0

[Zyndstoff (aka Steven Gail)]

Ok sorry guys.....jsut try to help here 

No problem, anybody's help is highly appreciated. 
But it's not advisable at this stage in this particular thread.
Keep it up!

Zyndstoff

[barry1976]

ok no problem bro , I know how frustrating it can be when someone is trying to help another person with there problems and everybody else is trying to interfere....But If anybody has any malware problems ; I just wanted everybody here to know ; At your service!!!!

[14wolfe88]

Have you tried REVO UNINSTALLER?

Revo is not recommended for uninstalling security software, especially antivirus.

I still need to find out from the OP if he/she can get into normal mode, and if so run an MBAM scan since he/she is using outdated AV and could possibly have malware.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6330

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/11/2011 9:41:10 AM
mbam-log-2011-04-11 (09-41-10).txt

Scan type: Full scan (C:\|)
Objects scanned: 375618
Time elapsed: 2 hour(s), 32 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\secfile\shell\open\command\(default) (Rogue.MultipleAV) -> Value: (default) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\image-line\Shared\DSP_IPP\uninstall.exe (Rootkit.Agent) -> Quarantined and deleted successfully.

[Zyndstoff (aka Steven Gail)]

So, MBAM did find and quarantine some stuff.

Is the problem solved now or do problems persist?

[14wolfe88]

So, MBAM did find and quarantine some stuff.

Is the problem solved now or do problems persist?

I still can't get it to uninstall. I just noticed that when I take the checkmark off the self defence module for Avast! and apply the settings, and go back to it, the box is still checked off.

[Zyndstoff (aka Steven Gail)]

Rerun MBAM (Do an update first in the GUI! Quick Scan is good enough and it only takes minutes).
Rerun it, until the log is clear.
Try again then.

Did that help?

I notified the forum expert malware fighter. He'll look into this. Nick is "essexboy". Wait for his assistance please.

[essexboy]

Hi we will need to fix the no safe boot problem first

Download OTS to your Desktop and double-click on it to run it

• Make sure you close all other programs and don't use the PC while the scan runs.
  
• Select All Users
  
• Under additional scans select the following

Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check

• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
CREATERESTOREPOINT

• Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
  
• When the scan is complete Notepad will open with the report file loaded in it.
• Please attach the log in your next post.

[14wolfe88]

First part

[14wolfe88]

Second part.

[Zyndstoff (aka Steven Gail)]

Ok, thanks for the logs.
Please be patient, as essexboy can't be around here 24 hrs. 

He will further assist you. Do not follow anyone else's proposals until then.

Cheers
Zyndstoff

[SafeSurf]

@ 14wolfe88,

I didn't abandon you and I'm glad Zyndstoff stepped in as I had no electricity due to storms.  Thank you Zyndstoff for notifying Essexboy. 

Essexboy is on late UK time zone, so please check this thread at least daily and he will give you further instructions.  Please do not make any further changes to your machine now that you have provided the logs (MBAM and OTS).  Thank you.

[Zyndstoff (aka Steven Gail)]

@ 14wolfe88,

I'm glad Zyndstoff stepped in as I had no electricity due to storms.  Thank you Zyndstoff for notifying Essexboy. 

No sweat. 

[essexboy]

Here you go

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Registry - Safe List]
< Run [HKEY_USERS\S-1-5-21-343818398-2049760794-725345543-1003\] > -> HKEY_USERS\S-1-5-21-343818398-2049760794-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Desura" -> [C:\Program Files\Desura\Desura\desura.exe -autostart]
[Registry - Additional Scans - Safe List]
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > ->
*netsvcs* -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs
YY -> RPCQT -> C:\WINDOWS\system32\Rpcqt.dll
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost > ->
[Files/Folders - Modified Within 30 Days]
NY ->  At1.job -> C:\WINDOWS\tasks\At1.job
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
 
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.