AVAST Installation not successful after uninstalling 360 Total Security

Viruses and worms
1

Hi,
I am using a Dell Laptop. Intel Core 2 Duo. OS Windows 7 Ultimate. 32 bit. 2 GB RAM.
I uninstalled 360 Total Security using Windows Uninstall Program.
After uninstallation, 360 TS is not in the “Programs and Features” list under “Control Panel”

I tried to install AVAST Free AntiVirus. I get a “You are UNPROTECTED. Avast background service is not running” message that is followed by “Resolve All”. Nothing happens when I click “Resolve All”. “File System Shield”, “Mail Shield”, and “Web Shield” are off. I can not turn them on.

I chose “Repair” Avast. Repair was done. But the 3 Shields are still off. I can right click and scan a stick. I scheduled a boot-time scan but it did not start when I restarted the computer.

Please help me to install Avast.

2

Clean Install of Avast:
https://goo.gl/4Ptzkf

3

You need to remove 360 Total Security completely first as it is a rogue av.
Un-install through the control panel is not doing that.

4

If it is Qihoo 360 then it is a valid program
http://uk.pcmag.com/360-internet-security-2013/4692/review/qihoo-360-total-security-essential-86

This may help > https://www.youtube.com/watch?v=kL5rw12FZ0U

5

Thanks to Be Secure, Eddy, and Pondus for the help. I still have a problem. Avast shields are OFF.

I am using Windows 7 XP Ultimate. Service Pack 2

  1. I was using Qihoo 360 Total Security.
  2. When I originally uninstalled 360, I used Control Programs to uninstall it. The youtube video recommended by Pondus, shows that the folder 360 is to be deleted. I did not do that when I uninstalled. Later, after seeing the video, I deleted the folder.
  3. I ran Ccleaner
  4. I uninstalled Avast.
  5. I tried to install Avast in Safe Mode. Avast says that the Base Filtering Engine is not running.
  6. I tried to Start Base Filtering Engine in Safe Mode by using services.msc. I get the message that Start Base Filtering Engine will not start in Safe Mode. Error 1084: This service cannot be started in Safe Mode.
  7. In Normal Mode, Base Filtering Engine is running.
  8. I uninstalled Avast using the method (AvastClear) suggested by Be Secure. It was done in Safe Mode. Then I ran Ccleaner.
  9. I tried to install Avast Free in Normal Mode. The shields are still off.
  10. I uninstalled Avast in Safe Mode using AvastClear.
    11.I tried to install Avast in Safe Mode. Avast still says “The Base Filtering Engine is not running. Please ensure the service is enabled before installing Avast”

Please help me to turn the Avast Shields ON.

6

avast will not work/install in safe mode.
Please attach the farbar log files (Addition.txt and FRST.txt) to your next post so we can check if 360 is really gone and perhaps find other problems.

7

Please download Farbar Recovery Scan Tool 32bit and save it to your Desktop.

[*]Right click the FRST file on your desktop and select “Run as Administrator…” (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]If an update is available, the program will inform you and download the update. Allow it do this please.
[*]Once the tool shows “The tool is ready to use.” message, please press the Scan button.
[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach the log back here.
[*]The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe). Please also attach that along with the FRST.txt into your reply.

8

Thanks, Eddy and dbrisendine for your suggestions.

The Windows 7 Ultimate computer with a problem belongs to a friend. I got it today and followed your suggestions.

The FRST and Addition files are attached.

Thanks for your help.

9

The problem is not that Qihoo was installed, but that the system is infected and is not up-to-date with the latest updates/(security)patches.

10

FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

Free YouTube Download version 3.2.53.128
Google Chrome Packages
WSE_Vosteran

To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.

SECOND >>>>

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[b] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/b]
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

- Right-click on

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
- Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.

LAST >>>>

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST that is on your Desktop by double clicking and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.

When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt in the Optional Scans section of FRST.

Press Scan button.

It will make two logs (FRST.txt and Addition.txt) on your Desktop. Please attach the logs in your reply back.

Also, tell me how your system is acting now. Thanks.

11

Thanks, dbrisendine for your detailed instructions. I have downloaded your file. As the computer is not mine and not with me, it will take me a few days to report back.

12

Hi dbrisendine,

Should I try to install Avast after running all 3 steps?

Or, wait till you analyze the FRST and Addition files?

13

Don’t install/change anything till dbrisendine tells you to do so.

14

Please wait until I can look at the fresh FRST logs (after the script run) before installing Avast. There may be some additional work to remove the infection(s).

15

Hi dbrisendine and Eddy

I followed your instructions.

I uninstalled
Free YouTube Download version 3.2.53.128
Google Chrome Packages
WSE_Vosteran was not there in the list of programs but I think it was uninstalled when Google Chrome Packages was uninstalled.
The Fixlog file is attached.

Addition.txt was still there in the folder and I ran FRST again.
The FRST.txt and Addition.txt files are attached.

I copied some files to the computer after this but did not run any programs. The computer is ok.

Thanks for your help.

16

They are already looking a lot better than the first log files, but there still are some things to remove/clean-up.
I’ll leave it to dbrisendine to guide you with it.

17

The logs do look better but there is still an issue on a left-over driver that needs to go …

Please download Malwarebytes Anti-Rootkit from here

[*]Unzip the contents to a folder in a convenient location.
[*]Open the folder where the contents were unzipped and run mbar.exe
[*]Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
[*]Click on the Cleanup button to remove any threats and reboot if prompted to do so.
[*]Wait while the system shuts down and the cleanup process is performed.
[*]Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
[*]When done, please post the two logs produced they will be in the MBAR folder… mbar-log.txt and system-log.txt

18

Thanks, again, dbrisendine and Eddy. I will post the logs when they are ready.

19

Hi, dbrisendine and Eddy,

I ran mbar twice.

The first time, I got this message:
DDA Driver installation error.
Driver installed on boot. Reboot required.

The reboot was hanging for a long time. So, I long-pressed the power button. When it booted, mbar was running.
Then, I got this message
Infected: C:\Temp\TrustedInstaller.exe → [Trojan.Agent.NR]
A restore point was created and the cleanup was done.

Then, I ran mbar again.
This time, no infection was found.

Both sets of logs are attached.

Thanks, again for your help.

20

That is better. Now we need a fresh set of FRST logs and see what needs to be done next.

The directions are going to be a little different than you did before so please follow these:

If you still have a Addition.txt log file on your desktop, please delete it now.

Start FRST64 that is on your Desktop by right clicking on the file, selecting “Run as Administrator” and allowing the software to run when the User Access Control asks (if it does).

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Select Additional.txt in the Optional Scans section of FRST64. Also select 90 Days Files in the Optional Scans section.

Press Scan button.

It will make two logs (FRST.txt and addition.txt) on your Desktop. Please attach the logs in your reply back. Thanks.