Avast blocked by group policy - paulonio

Viruses and worms
1

Hi!
I have the same problem which was posted here: https://forum.avast.com/index.php?topic=150769.0
I tried to do everything I can. I remove the key in registry in: “HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\Codeidentifiers\0\P​aths”
which contained path “C:\Documents and Settings\All User\Aplication Data\Avast Software”. Then I scan with adw cleaner and try to re-install avast. But all of this doesn’t work, avast still can’t run (I reboot after each try of course).
Help me please if you can. I attach three log files from FRST and one from adw.

edit: sorry for polish language in files :slight_smile:

2

Be careful digging around in the registry

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

HKLM Group Policy restriction on software: C:\Program Files\Microsoft Security Essentials <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\McAfee.com <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\ArcaBit <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Alwil Software <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files (x86)\McAfee <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files (x86)\Symantec <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files (x86)\Security Task Manager <====== ATTENTION HKLM Group Policy restriction on software: C:\Program Files\Alwil Software <====== ATTENTION HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKLM-x32 -> DefaultScope value is missing. SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File CHR HKU\S-1-5-21-779939916-2656375791-2883545272-1000\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - No Path CHR HKU\S-1-5-21-779939916-2656375791-2883545272-1000\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - No Path CHR HKLM-x32\...\Chrome\Extension: [aaaajccikcnncidhbokfncpooceanool] - C:\ProgramData\AskPartnerNetwork\Toolbar\SPCV7\CRX\ToolbarCR.crx [Not Found] EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

FINALLY

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the “Scan” button to start scan

https://dl.dropboxusercontent.com/u/73555776/AswMBR%20scan.JPG

On completion of the scan click save log, save it to your desktop and post in your next reply

3

Thank you very much for help! :slight_smile:
I made fully first and second step. After first system was loading too long, but then avast started correctly. The program from last step is crashing at some time, so I can’t run full scan. Oh and I had blue screen of death (if I call it that way in win7 :wink: )

What is the cause of the problems ? And what can I do to protect my computer in the future ?

4

How is the system running now ? The first reboot may have been Avast rebuilding the virtual machine

As for the malware, I have not yet been able to put a name to it, all it appears to do is disable any antivirus that it can see

Did you run Malwarebytes initially ?

http://www.malwarebytes.org/forums/style_images/1/bf_new.gif
Please download Malwarebytes’ Anti-Malware from Here.

Double Click mbam-setup-2.0…exe to install the application. (The revision number may vary.)

[*]Select the language and click OK
[*]Accept the agreement
[*]Make sure a checkmark is not placed next to Enable the Free Trial and Launch Malwarebytes’ Anti-Malware, then click on finish
[*]If an update is found, it will download and install the latest version
[*]Once the program has loaded, select "Scan Now
[*]The scan may take some time to finish,so please be patient
[*]When the scan is complete, click on [b]Quarantine All[/b
[*]When disinfection is completed, a dialog will open and you may be prompted to Restart.(See Extra Note
[*]Upon restart, launch Malwarebytes Antimalware and select History
[*]Double click on the last scan done, then on Copy to Clipboard.
[]To submit your reply, click on Add Reply, then right click on the window and select Paste
[]Submit your reply
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

5

Somehow the log file didn’t save. Program found some objects and I moved them into quarantine. One of the objects is “Trojan.Malpak”. There are screen presenting files. May I remove them all ?

http://i60.tinypic.com/2gudzc7.png

http://i59.tinypic.com/29zwjlx.png

Computer is working ok now.

6

Yes remove the lot. How is the computer behaving ?

7

Computer is behaving normal. Thank you again ; )

8

In that case methinks I will send you on your merry way :slight_smile:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave: