AV Security 2012 isn't being removed by avast.

[toobusyforvirus]

oops. I forgot to click "all" in the boxes before running the custom scan, and I didn't see an "all users" option

[toobusyforvirus]

should i terminate the scan and check the all users box (I can't believe i missed that)

[toobusyforvirus]

There's only two users though. The one I'm logged in on and the admin account.

edit: It's said manual file scan for a while now. Is that normal?

[essexboy]

If you could attach the log - I will work from the initial one first, then look at all users later

[toobusyforvirus]

The log popped up, is it normal for the txt file to be really laggy?

Also, there is an OTL.txt, and an Extras.txt

[essexboy]

Until I remove the malware - yes
Attach the log like this

[toobusyforvirus]

I tried posting the OTL.txt, but it says the maximum length is 10000 characters

Okay, I see.

[essexboy]

Yes you need to attach it, use the additional options link at the bottom of the post
Browse to the log and post

[toobusyforvirus]

Here they are.

edit: running the "scan all users" version now.

[toobusyforvirus]

I think this is the one from the "all users" option. It may or may not have saved over the original file.

The "all users" version only took a few seconds, is that normal?

[essexboy]

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot



Download the attached fix.txt to the desktop of the affected system
Run OTL and press run fix
A dialogue will pop up asking for the location
Select the fix.txt on the desktop and press run fix again

[toobusyforvirus]

Here's the fix log from the first step.

[essexboy]

You ran the scan.txt again... Please use the one marked fix.txt

Or run it this way

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  SRV - File not found [On_Demand | Stopped] -- -- (MMMMEHZIL)
  O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
  O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
  O4 - HKLM..\Run: [HKK88fRZ9hYXjU8234A] C:\WINDOWS\system32\AV Security 2012v121.exe (Microsoft Corporation)
  [2011/11/11 08:32:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\PCwkUVrlOtPuSi
  [2011/11/11 08:32:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\mD3pnG5aQ6
  [2011/11/11 08:25:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\yF4pmH5sQ7E
  [2011/11/11 08:25:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\P6sWK7fRLgXjCkB
  [2011/11/11 01:05:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Start Menu\Programs\AV Security 2012
  [2011/11/11 01:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\kYYCCekIVrzOyx0
  [2011/11/11 01:05:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\DHH6ssWJ7fELgTq
  [2011/11/11 01:05:03 | 000,000,000 | ---D | C] -- C:\Program Files\C7448
  [2011/11/11 01:04:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\A48C7
  [2011/11/11 01:04:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\bFF33mG5sQ6dE8R
  [2011/11/11 01:04:41 | 002,914,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\AV Security 2012v121.exe
  [2011/11/11 01:04:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\RED\Application Data\P6ddEEK8gRZhYwk
  [2011/11/11 01:04:41 | 002,914,816 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\AV Security 2012v121.exe
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
  
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[toobusyforvirus]

Oh, okay, I thought I clicked on run fix. My bad, I'll try again.

[essexboy]

I will be going offline shortly but once you have run the fix - you should be nearly back to normal

Once the fix has completed and rebooted the computer then run Mawarebytes