usigetskin error need help with registry

[ozarklady]

Hi, I recently updated spybot S&D and it said I had a brainbuster virus which I looked up on the web. Then I ran Spybot and had it fix things. Then when I ran my Avast, I got errors about usigetskins. I then realized that the things Spybot fixed were used by Avast. I tried to repair thru control panel. Then tried uninstalling and reinstalling with no luck. Right now, I have uninstalled a third time and am needing help with removing the registry keys for Avast so that I can do a clean install and see if that works. I did delete the Alwil folder in the registry but there is more that I don't know about and can't find. I did find references to Avast in the ODBC folder in my registry but had no idea if I should remove that or not. I've used Avast personal for home a couple of years and love it. Spybot never has done anything like this before. I sure hope someone can help me do a clean uninstall so that I can try reinstalling Avast again. Thanks ahead and sorry I'm not very technical. I run XP sp2.

[ozarklady]

P.S. I did a restore or undo from spybot so that it would put back what it took away before I did anything else but that didn't fix the problem. Also, I noticed ashmaisv still runs in my startup so I know i didn't get everything clean. Thanks again.

[techie101]

OL,

Spybot has its own Recovery utility which would have restored the files that were removed.

Have you tried that?

What else have you done to the system besides try to uninstall Avast?

How did you attempt to remove Avast?

If you go to the www.avast.com site and look under Downloads....you will see the Avast Uninstall Utility.
This will remove all remnants of the program.

[ozarklady]

Hi Techie101, Thanks so much for help. I tried to repair thru Avast own ability to repair itself in the control panel. I did so before and after running the restore in Spybot but it didn't work. That is when I uninstalled avast thru my control panel and tried reinstalling. But nothing got rid of the error. So I uninstalled again and then removed the Alwil folder in the registry. I just found the uninstall utility but I geuss I would need to reinstall before I could use it. Is this correct? Because when I ran the utility it asked which folder I wanted to delete. But of course, I have no Avast folders now. I thank you for your response and knowledge in this.

[techie101]

Hi Techie101, Thanks so much for help.

No problem.  I will do the best that I can.
Brainbuster Brainbot is not spyware. ( I think)  In order to display and use the "skins" of Avast, these files are needed.  When you removed the "bot", Avast could no longer obtain the "skins", and therefore you received the "usiskin" error.
There was nothing for Avast to "Get".  

I tried to repair thru Avast own ability to repair itself in the control panel. I did so before and after running the restore in Spybot but it didn't work.

Um...That is not a good indication.  Spybot Repair should have restored the files and thus the system to its' previous state.  

That is when I uninstalled avast thru my control panel and tried reinstalling. But nothing got rid of the error.

Exactly what error are you receiving?

So I uninstalled again and then removed the Alwil folder in the registry.

What made you remove the folder in the registry?  What key did you specifically remove and under what Hkey?  
Once you removed the Avast folder, there are no more files left.

What we need to do is this.  Let's start by using the System Restore function of XP.  You will find it under the Help and Support menu which you can get to from the Start menu.
Go back to a Restore point just prior to  your running Spybot.

Once this is done, I want you to uninstall Avast completely by using the Avast Uninstall Utility which you said you found.
If not, find it here:
http://www.avast.com/eng/download/programs/avast_uninstall_util.html

Reboot computer.  Install Avast again.  Reboot again.

Start Avast and tell me if you receive any errors.
If none, then run a system scan.

If Avast detects any viruses, move them to the chest for now.  
Any other error message:  Provide......
1.  the full error message
2.  the full pathway contained in any message
3.  the exact name of any "potential virus"

Ok?

[techie101]

OL,

An after thought....
You have SP2 which means that the Windows Security Console is operating.  Go into the Console and insure that it is not preventing Avast from fully loading.  I have not become too familiar with SP2 yet since I have not installed it myself.  I have enough "3rdparty" security programs to do what SP2 claims to do, so you will have to look around in SP2 for an "exceptions" list and enter Avast.

Not sure if this is part of the problem, but SP2 has been doing some strange things to users systems.

Getting late,
Good nite.

[bob3160]

Sp2 doesn't block avast! unless you're using the windows firewall and blocked it in there.

[ozarklady]

I removed the folder ALWil that was listed in the HKEY Local Machine Software because I was following the below suggestions given to Volans by S.Z.C.
1.) completely uninstall avast! (no matter you already tried it)
2.) reboot your system
3.) clean all registry keys regarding avast!
4.) reboot again
5.) perform clean install of avast! one more time.
The error that I was getting was something like:
UNKNOWN ERROR
The program can't load the skin. The function "usiGetSkin" is failed.
It's probably too late to do a system restore because I installed SP2 a couple of days after the problem arose with the usigetskin error. I have the firewall on sp2 turned off because I have always used DSL to access the net and it has it's own firewall which was never a problem. The following is a log from spybot which lists the keys that I "fixed" upon my next run of spybot. I don't think anything is going to work now because instead of running around unprotected I downloaded a trial version of another antivirus and now I saw on thier site that you have to have a special uninstall utility to totally remove all the registry keys and you have to contact thier support people to get the special utility. Who knows how long that might take. I will go ahead and show the spybot log before I ran it again and "Fixed" the items. I think this might get too complicated for me to be able to fix. I am protected for right now. I will contact the other antivirus support and see if I can get the uninstall utility and then see about reinstalling Avast after I clean out the other program. Thanks for your help though and bless you for your efforts in this forum. I wonder why ashmaisv still runs at startup though.
 --- Search result list ---
Brainbuster brainbot: Root class (Registry key, nothing done)
  HKEY_CLASSES_ROOT\ActiveSkin4.Skin

Brainbuster brainbot: Root class (Registry key, nothing done)
  HKEY_CLASSES_ROOT\ActiveSkin4.Skin.1

Brainbuster brainbot: Class ID (Registry key, nothing done)
  HKEY_CLASSES_ROOT\CLSID\{0944D16C-D0F4-4389-982A-A085595A9EB3}

Brainbuster brainbot: Root class (Registry key, nothing done)
  HKEY_CLASSES_ROOT\ActiveSkin4.SkinLabel

Brainbuster brainbot: Root class (Registry key, nothing done)
  HKEY_CLASSES_ROOT\ActiveSkin4.SkinLabel.1

Brainbuster brainbot: Class ID (Registry key, nothing done)
  HKEY_CLASSES_ROOT\CLSID\{5954EA75-9BFA-461A-BD34-CEA3A861FF19}

Brainbuster brainbot: Settings (Registry key, nothing done)
  HKEY_CLASSES_ROOT\Component Categories\{010E0B1F-1A47-4D07-A83F-43A819E39CCF}

Brainbuster brainbot: Settings (Registry key, nothing done)
  HKEY_CLASSES_ROOT\Interface\{4921908C-7090-4D37-A6B3-FC447F08378A}

Brainbuster brainbot: Settings (Registry key, nothing done)
  HKEY_CLASSES_ROOT\Interface\{750FC67C-0311-4391-9864-A2EFED49BD28}

Brainbuster brainbot: Settings (Registry key, nothing done)
  HKEY_CLASSES_ROOT\Interface\{F3FC950C-7583-4377-BAD8-EFBEAA33273C}

Brainbuster brainbot: Settings (Registry key, nothing done)
  HKEY_CLASSES_ROOT\TypeLib\{90F3D7B3-92E7-44BA-B444-6A8E2A3BC375}

MS Office 9.0: Recently used files  (28 files) (Directory, nothing done)
  C:\Documents and Settings\Debra\Application Data\Microsoft\Office\Recent\

Log:  Activity: COM+.log (Backup file, nothing done)
  C:\WINDOWS\COM+.log

Log:  Activity: SchedLgU.Txt (Backup file, nothing done)
  C:\WINDOWS\SchedLgU.Txt

Log:  Install: setupact.log (Backup file, nothing done)
  C:\WINDOWS\setupact.log

Log:  Install: setupapi.log (Backup file, nothing done)
  C:\WINDOWS\setupapi.log

Log:  Shutdown: System32\wbem\logs\mofcomp.log (Backup file, nothing done)
  C:\WINDOWS\System32\wbem\logs\mofcomp.log

Log:  Shutdown: System32\wbem\logs\wbemess.lo_ (Backup file, nothing done)
  C:\WINDOWS\System32\wbem\logs\wbemess.lo_

Log:  Shutdown: System32\wbem\logs\wbemess.log (Backup file, nothing done)
  C:\WINDOWS\System32\wbem\logs\wbemess.log

Log:  Shutdown: System32\wbem\logs\winmgmt.log (Backup file, nothing done)
  C:\WINDOWS\System32\wbem\logs\winmgmt.log

Log:  Shutdown: System32\wbem\logs\wmiprov.log (Backup file, nothing done)
  C:\WINDOWS\System32\wbem\logs\wmiprov.log

Cookie: Cookie (6) (Cookie, nothing done)
 


--- Spybot - Search & Destroy version: 1.3 .1 (build: 20040801) ---
 

[S.Z.Craftec]

Nothing wrong with SP2 at all. Brainbuster Brainbot is spyware, but the problem is in Spybot 'cause it's recognizing some Active skin parts as spyware (of course by mistake)

[techie101]

OL,

Do not despair.  Now we have to undue most of what was done before beginning again, but I do not see from the log that anything insurmountable was performed to the system.

Brainbuster bot only crippled Avast from functioning.  This is correctable.  Ashmaisv was apparently not removed and thus will continue to appear in the Startup but this also can be fixed.

IM me with the name of the other AV....Urrrrrr  :'( and I will see if I can get the uninstall utility for you or at least see if it can be safely removed without it.
Other recommendations would have been made had you asked for an alternative AV .

Ok, if you installed SP2 after the problem, then there is little change of restoration, but I still would check the System Restore to see if any Restore points were retained.  I am not sure what files are overwritten by SP2.
It does replace the Windows FW with the newer Security Console, but I am not sure if the System Restore is updated or modified.  Check it anyway.  What can you loose?

Our goal here is the remove all AVs present on the system completely.
Then we can carefully install Avast Home.

Once this is done, the Usiskin error should be gone, but if not, it is usually a small change to the Avast ini file that needs to be made.

If you go into Start/Run and type MSConfig, it brings up the Startup menu.  Open the Tab Startup.  Go down the checkboxes for Ashmaisv and uncheck it.  Click Apply, then Ok.  System should ask for reboot.  Reboot.
Ashmaisv will still be in the drive, but will not load on startup.  It will be removed later on with the Avast Uninstall Utility.
Let me know when you are ready to proceed.

and you can do anything you put your mind too!  
I and others here will help.  Follow instructions carefully and ask for clarification if you do not understand.  The rest is easy.  
Good luck.

[techie101]

Sasha,

Never said SP2 was bad.  It has caused problems with at least 3 users I know of.  Systems crashed.

Do you have a reference for Brainbuster bot as spyware?

What I could find on it indicated that it was not and Avast uses it to run the "skins".  You know more of this than I so could you elaborate a bit for my understanding.

Thanks.

[bob3160]

I didn't find anything indicating that this is malware but, I did find this:

 ATTENTION - anyone also using Avast! Antivirus DON'T fix those entries in Spybot, as fixing them may corrupt the application that controls Avast's skins and Avast will be unable to load at all.

[techie101]

bob,

That is interesting.  Very similar to what I found.  I am wondering if Brainbuster modifies any of the Registry entries that Avast uses.

I need to look over OL's log again.

[ozarklady]

Well, I have no system restore points because Ad-aware said it found CWS.msconfig. I looked that up at the major security forums and they said to disable system restore, delete internet temp files, go into safe mode, run CWShredder, spybot, ad-aware, and anti-virus and delete the CWS.msconfig. I have emailed the other av and asked for the uninstall utilty. But don't know if I will get it because I have not paid for the AV but am only using trial version. It appears you might have to be a paid user to get the utility. Am waiting to hear from them. If it is anything like norton to remove, it could leave lots of leftovers to interfere with the installation of any other AV. I sent a IM to Techie101 with the name. I did run msconfig and uncheced ashmaisv but still don't know why it's still there. I looked on web for info on the brainbot brainbuster trojan and found very little this week except for new links that let people know that this is to be ignored in Spybot. Thank goodness that others will see that and not end up in my shoes. All I found this week was BackDoor.BOrifice, BackDoor.Brainbot(7), BackDoor.Generic.840,
http://asv-pc.ru/gugol.shtml
Note: trojan BrainBot beta 0.9
http://www.securitydigger.com/history07.html
   Thanks again for all help.

[CharleyO]

*

The link ozarklady gave for brainbot took me to a page of a long list of such stuff. After much searching of that page, the brainbot link took me to an log-in error page for the site with the brainbot info.

But, with a google search, I was able to come up with these links. It will give you more insight to brainbot.

http://www.ilusion-free.com/forum/index.php

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

WARNING !  The forum at the link below uses very bad language. Do not go there if you are easily offended!

http://www.zone-h.org/en/forum/thread/forum=3/thread=417155/

*