AVAST errors continued...

Hi Avast help,

Last week I posted about my AVAST errors.
[I had two errors appear on my computer with avast and it seems to have stopped working. The first was “Error reading product data from C:\Program Files\AVAST Software\AVAST\setup\part-setup_ais-7d6.vpx”.Setup cannot continue. The second was “avast! A setiface error has occurred:2 Try to reinstall or contact support, please.” I did create a log file which I can send if you need it to help me. I had done a system restore and from what I was reading here, I didn’t disable something I should have first. I have AVAST Internet Security valid until August 2014. Can you help me? Thanks Mick]
Podus recommended a clean install of AVAST, which I did as instructed and things seemed to be working again.

Although, I may have spoke too soon.
I did reinstall avast, and since have had it act up twice. It stopped working the other day, and wouldn’t open. Yesterday the same thing. I went to the control panel and repaired avast. It then opened and ran a scan that said no threats detected. However a file on by computer completely disappeared, as well as a program icon off the desktop. Not sure what is happening, but whatever was there, still seems to be. I don’t want to system restore because that doesn’t get rid of the problem. It still exists whatever it is.
So I followed the instructions from forum post: http://forum.avast.com/index.php?topic=53253.0.

I am attaching the logs from AdwCleaner, Malwarebytes and OTL. Although there was only one log produced from OTL, not the second extras txt file.
Sure hope you can help me. Thanks in advance for your assistance. Mickie

Hi, I will assist you.
As I do not see malware in posted logs I shall deploy tools that can give me an deeper look.

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “List BCD” and “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

THEN

Please download GMER, the AntiRootKit tool from the link below and save it to your Desktop:

Gmer download link
Note: file will be random named

Double-clicking to run GMER.

[*]Wait for initial scan to finish - if there is any query, click No;
[*]Click [ Scan ] button and wait until the full scan is complete;
[*]Click [ Save … ] button - save the report to the Desktop (named ARK );

Please attach here Gmer’s (ARK.txt) logreports.

Thank you magna86.
I’m running them now. Mickie

Scans completed and farbar logs attached. another pose coming with gmer log. Thanks, Mickie

gmer log.

FYI, after I posted, computer completely froze. Had to shut off and restart. Just getting back on now. Nothing seems different. Mickie

Hi,
Please do not be alarm by Gmer’s "Rootkit Behavior"warnings. What Gmer has been seen are avast legit drivers.
Posted logs do not show traces of malware activity. I just wanna preform some additional check using FRSTScript.

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Start
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
File: C:\Windows\System32\url.dll
C:\Users\Mickie\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Mickie\AppData\Local\Temp\ose00001.exe
CMD: ipconfig /flushdns
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.

Fixlog attached. Thank you. Mickie

Nope, your system is clean. Logs doesn’t shows the sign of malware. Your system is clean. As problem isn’t malware related, therefore I shall remove used tools:

Please download DelFix by “Xplode” to your Desktop.

Run the tool and check the following boxes below;

[] Remove disinfection tools
[
] Create registry backup
[*] Purge System Restore

Now click on “Run” button. Wait for the programme completes his work.
All the tools we used should be gone.
Tool will create and open an log report (DelFix.txt)
Note: The report will also be stored on C:\DelFix.txt

I don’t need DelFix log report.

Thank you Manga86.
I’ll do the removal of the tools.
Regarding the file that dissapeared and the icon that left my desktop… I’ve run AVAST on my file backup and it shows clean, Would it be OK to restore that file as well as the shortcut icon now?
I’m so glad I purchased AVAST and asked this Forum for help.
Thanks again. You have been awesome.

Looks like hidden files and folders options are enabled. DelFix shall reset that to default.

Sorry Magna86, I maybe wasn’t clear on that… when I said a file disappeared, it didn’t hide, it’s completely gone from the computer, as in deleted, but not by me. I have it backed up on a back up drive, I checked that on another computer running AVAST and it showed clean. Is it ok to restore that file from my backup? Thanks, Mickie

Rather a folder with files in it. Sorry, Mickie

As I can tell this problem isn’t malware related ( if is logs would show that ), what now I’m think of is damaged sectors on HDD.
If bad sector is damaged, data on your HDD can’t be read, and system read that as unknow or non-existent data.
I shall give you a tool to test that.

Download MHDD utility from here:
MHDD download link

Unpack and burn as ISO …
Add and boot MHDD from disk ( in the same way as Live CD )

[*] When you load the file select option 1
[*] When the menu appears, select the disk that you’ll scan

Type in:

scan

…and hit enter

[*]In the next menu, click F4
[*]It will begin HDD scanning, allow him to finish scan.

If there is more than 3 inputs in the district UNC X then your hard disk is damaged.

just to make sure I understand…When you said…

Download MHDD utility from here:
MHDD download link
Unpack and burn as ISO …
Add and boot MHDD from disk ( in the same way as Live CD )

I burn the MHDD to a CD and then run it from the CD?

I extracted and burned MHDD to a blank CD. Then put in CD drive to run. It opened my Toshiba Disc Creator and didn’t give options you mentioned.

When I put it in to start computer to run MHDD, nothing happened either. Windows started.

What did I do wrong? Or should I have hit F12 Boot Utility to run MHDD?

mickmous, I do recommendet you to call someone who knows & understands this subject and help you to run this test.

Or you may google- it “iso burning” + “boot from CD” to learn how to preform MHDD scan.

Thanks Magna86. You’ve been a great help and it is much appreciated. I’ll do that.