avast is blocked by group policy

Viruses and worms
1

Hi

I think you have seen and dealt with this problem before, and I have attached the two files from FarBar

Please help

Cheers
Dean

2

Remover notified. I can see your issue.

3

You have leftovers Symantec and Kaspersky.
Here is the uninstall tools

http://singularlabs.com/uninstallers/security-software/

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system


Start
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Symantec <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\AVAST Software <====== ATTENTION
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: {20234bfe-9c22-11e3-89a0-14dae92129e6} - G:\SETUP.EXE
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: {511d3f98-d647-11e0-947c-806e6f6e6963} - D:\.\Bin\ASSETUP.exe
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: {b4dea707-e6e6-11e0-b50c-14dae92129e6} - G:\LaunchU3.exe -a
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: {c024f895-210b-11e3-aa9e-14dae92129e6} - G:\SETUP.EXE
HKU\S-1-5-21-3316425435-3350266274-315999975-1000\...\MountPoints2: {d09f233b-9645-11e2-9f52-14dae92129e6} - G:\SETUP.EXE
URLSearchHook: HKLM-x32 - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File
URLSearchHook: HKCU - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File
EmptyTemp:
End

2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
.

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.

[*]Click on the Scan button.
[*]After the scan has finished click on the Clean button.

Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.

[*]After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
[*]Post logfile will also be saved in the C:\AdwCleaner folder.

4

Thanks Guys, you’re awesome.

Avast is now backup and running. I have included the Fixlog.txt attached.

Avast is also reporting that AdwCleaner has a virus?
Infection blocked
“URL hxxp://download.bleepingcomputer.com/dl/95e2720c638b716db2b40da5680b56f9/543cfc5c/windows/security/security-utilities/a/adwcleaner/AdwCleaner.exe
Infection Win32:Evo-gen [Susp]”

This is the details reported from Avast.
http://www.avast.com/en-gb/lp-fr-virus-alert?p_ext=&utm_campaign=Virus_alert&utm_source=prg_fav_90_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fen-gb%2Fvirus-alert-default&p_vir=V2luMzI6RXZvLWdlbiBbU3VzcF0&p_prc=C:\Users\Smart\AppData\Local\Google\Chrome\Application\chrome.exe&p_obj=aHR0cDovL2Rvd25sb2FkLmJsZWVwaW5nY29tcHV0ZXIuY29tL2RsLzk1ZTI3MjBjNjM4YjcxNmRiMmI0MGRhNTY4MGI1NmY5LzU0M2NmYzVjL3dpbmRvd3Mvc2VjdXJpdHkvc2VjdXJpdHktdXRpbGl0aWVzL2EvYWR3Y2xlYW5lci9BZHdDbGVhbmVyLmV4ZQ&p_var=.%2Ffa%2Fen-gb%2Fvirus-alert-default&p_elm=7&p_lex=240&p_lid=en-gb&p_lng=en&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_pro=0&p_bld=chr2%3Btris1&p_vep=9&p_ves=0&p_vbd=2021&p_hid=64fd3e2f-5bcf-45ca-9c98-e294f6c3256b&p_ram=16345&p_cpu=7.5

Please advise!

Thank you again
Dean

5

It was a false alarm.
Turn off Avast and run adwcleaner.

6

OK thanks argus

I have run adwcleaner

All done,

Thank you very much for all your help

Dean

7

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.