Avast not found in Safe Mode

[Aack]

Hello,

I am currently in the process of trying to remove the Windows 7 Internet Security Virus and need to run Combofix.exe in Safe Mode as I only get a black screen now in a normal start.

I need to disable Avast in order to run ComboFix but Avast is nowhere to be found in either the Control Panel Programs list, start--all programs, or anything that I could find in the Task Manager either.  I know it is still there because it appears in my DDS.txt log

AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

Also, when I try to start ComboFix I get a warning that it has detected that Avast is running and I need to disable it or risk damage to my computer if ComboFix runs while Avast is running.

I am using Windows 7 64 bit.
Avast 6(?)

How else can I find it?

Thank you.

[Gargamel360]

Combofix is the atomic weapon of removal programs, so if you are not running it under supervision, it can easily do more harm than good.

Follow this guide if you want our resident expert to clean you out (thoroughly and safely)>>http://forum.avast.com/index.php?topic=53253.0

[Aack]

Thank you.  Yes, I am using it under supervision.  I am currently in line with assistance from Malwarebytes but as I am kind of at a standstill with Avast, I thought I would ask in the Avast forum for this specific issue. 

I did see a few posts from the past few years about this issue, but I did not see where they got an answer, they didn't wait and ran it anyway--which I'm not willing to do. 

The virus has given me enough problems as it is

[Gargamel360]

Alright, you are in good hands, then.

Right-click the Avast! tray icon, you should see what you are looking for.

[ady4um]

Is the avast tray icon even there? I mean, the OP says he can't find avast, nowhere, so...

[DavidR]

@ Aack
Well avast doesn't run in safe mode so it shouldn't impede combofix. In fact you can run combofix in normal mode and use the avast tray icon, right click, avast! shield control and disable it there until the next reboot. Since you don't have the ability to run in normal mode, there won't be an avast tray icon to disable, but that shouldn't be required as the shields don't run in safe mode.

Whilst combofix may detect the services running it is OK to ignore the warning about avast running as the shield are disabled (in safe mode). This is recent not from years ago and from essexboy a highly qualified malware removal specialist on these forums and teacher at geekstogo.

What concerns me more is the fact that you can't see avast, if you mean in add remove programs or just in the tray (as that is normal in safe mode).

[essexboy]

It will be OK to run Combofix if the Avast drivers are loaded, so you can accept the warnings

Do you have a link to your thread at malwarebytes
 

[DavidR]

Thanks for the confirmation essexboy.

[Aack]

Hello again,

Thanks for all the replies!  Sorry, I didn't mean to imply Avast has had this problem for "years".

No, I cannot click on the tray icon as it is nowhere to be seen.  I also tried looking in processes and applications in the Task Manager and there is no hint of anything Avast related.

Ditto for the Add/Remove programs list.  The only way I know Avast is on my computer (somewhere) is I put it there, it appears in the DDS.txt log, and the ComboFix warning.

Here is the link to my Malwarebytes forum

http://forums.malwarebytes.org/index.php?s=277773d96103343ed5706d6fd6f97328&showtopic=103337&st=0&p=513630&hl=hackersbyte&fromsearch=1&#entry513630

From one of my posts there;" I had Avast 6 free on the computer but now Avast said the system was off, the file system shield needed to be turned on, etc. none of which I was able to do. I had last updated the program when everything crashed so I did a scan anyway. It only took 29 minutes as opposed to the normal 1 plus hours and found nothing."

In re-reading this I can certainly say I don't remember if it's still installed or not, but as I said earlier, the DDS.txt log and ComboFix indicate it is(?)  Should I still go ahead and run ComboFix?

This all started the beginning of the year so please forgive my memory lapse.

Thank you all again for your help on this particular issue.

[essexboy]

It will be safe for you to run Combofix

So go ahead with that - just do not allow Avast to quarantine or sandbox anything during the run

[ady4um]

I don't think this has something to do with Safe Mode or Normal Mode. If avast is not even listed in the "Add / Remove Programs", then "something" got corrupted, somehow. It could be just the entry not being there (in "Add / Remove Programs" I mean), and the rest of the program may be "almost" working. To be sure, if it were my system I would perform a reinstall (over the current one) of the latest stable version of avast (Free/Pro/AIS, whichever edition is supposed to be already installed) and reboot.

Of course this may be in addition to whatever else might be going on in the system, or independently of the reason to the disappearance of the program from the "Add / Remove Programs" list. So following essexboy's instructions is anyway recommended.

[Aack]

Thanks very much for your help.  I will run ComboFix overnight as I understand it can take quite some time.  I think I will wait on the reinstall over the current version.

Unfortunately, I do not have the spare time to babysit my laptop while it's running so hopefully I won't run into any troubles with the quarantine or sandbox...has me a bit nervous though.

I'll let you know how it turns out at the end.

Thanks again!

[Aack]

Hello,
I was able to run ComboFix successfully.  I did not have to reinstall Avast.  I had a nasty infection and I had no access to Avast in Safe Mode.

[DavidR]

That is the point of safe mode, a limited set of applications run, avast! (and other AVs) don't run in safe mode, you would have to manually start it.

[essexboy]

Could you post the log please and let me know the current state of play