Three days ago the Avast icon on my Win10 desktop showed a red X. When I tried to restart Avast it said UI service could not start. When I tried to reinstall Avast I got a message saying Windows install/update could not execute. I could not install/reinstall anything. Today I reformatted the HD and installed Win7. I installed all updates and Avast Internet Security and it ran fine for 8 hours. A few minutes after plugging in my external backup HD (also plugged in originally) same thing. Avast showed red X and no programs will install or uninstall. I cannot install any virus/malware software. What can disable Avast in this way? Any help is appreciated.
Your external drive is infected (possibly a backup of whatever infected the system originally).
Do you have access to a separate system that we can start downloading scanners / tools to?
Yes I have a laptop that is on a separate network.
Thirst thing to do is installing MCschield.
Next download (and use ofcourse) the tools mentioned here > https://forum.avast.com/index.php?topic=194892.0
Attach the logs to your next post.
MCShield AllScans.txt <<<
MCShield ::Anti-Malware Tool:: http://www.mcshield.net/
v 3.0.5.28 / DB: 2016.2.21.1 / Windows 7 <<<
9/4/2017 10:05:43 AM > Drive C: - scan started (no label ~910 GB, NTFS HDD )…
=> The drive is clean.
9/4/2017 10:05:43 AM > Drive D: - scan started (BACKUP ~932 GB, NTFS HDD )…
=> The drive is clean.
9/4/2017 10:05:44 AM > Drive J: - scan started (no label ~1849 GB, NTFS HDD )…
=> The drive is clean.
MCShield ::Anti-Malware Tool:: http://www.mcshield.net/
v 3.0.5.28 / DB: 2016.2.21.1 / Windows 7 <<<
9/4/2017 10:09:06 AM > Drive P: - scan started (Seagate Backup Plus Drive ~3726 GB, NTFS HDD )…
P:\autorun.inf.vir - Malware > Deleted. (17.09.04. 10.09 autorun.inf.vir.405880; MD5: 8dea303ee9370ea48d29e780eb5c41f0)
=> Malicious files : 1/1 deleted.
::::: Scan duration: 1sec ::::::::::::::::::
Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 9/4/17
Scan Time: 12:44 PM
Log File: 26d4e0bc-91a1-11e7-af31-f8b156dcf273.json
Administrator: Yes
-Software Information-
Version: 3.2.2.2018
Components Version: 1.0.188
Update Package Version: 1.0.2725
License: Trial
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Michael-PC\Michael
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 284646
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 2 min, 19 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
(end)
Here are the FRST logs.
There seems to be some system files that need correcting:
Please open a Command Prompt window (Start > type cmd.exe in the search box > right click on the program and select Run as administrator)
Type in SFC /SCANNOW and press enter.
Are there any files that this can not fix?
It says “Windows Resource Protection did not find any integrity violations.”
And rebooting into Normal Boot mode shows Avast as disabled?
Normal mode; Avast will not load, FRST will not run, Malwarebytes will not run. MCShield runs and says all drives are clean.
What messages do you get when you try to run Avast or Malwarebytes? Any error messages or they just refuse to start?
Avast still has red X thru icon and clicking gets a “AV service cannot start.” Malwarebytes does nothing when clicked. FRST starts but locks up (not responding) as soon as scan starts.
[*]Download random’s system information tool (RSIT) by random/random from 64bit here and save the file to your desktop.
[*]Double click on RSIT64.exe to run the scanner.
[*]Click Continue at the disclaimer screen.
[*]Once it has finished, two logs will open. Please attach both log.txt (<<will be maximized) and info.txt (<<will be minimized) in a reply post here.