Avast...Problem with updating

Avast Free Antivirus / Premium Security
1

Where to start…

I believe that I saw a post similar to my problrm but there was no response so hopefully someone can help me!!! :wink:

I have used Avast 4.7 home edition for a few years. I have been experencing problems with my computer, slowness etc but some of that could be the age of my comp which is almost 5 years old and may need more ram. Anyway, Lately I had Avast detect some type of win 32 worm I believe. Sorry, I didn’t write it down or copy it, just going from memory. I ran a whole system scan and it came up with one or two infected files which I promptly deleted. However, I still have Avast detecting infected files. I have only moved them to the chest and didn’t delete them yet. Should I be using your worm removal tool? The reason I ask that is that these past two days, I have had Avast have a red pop up screen saying something about my program not updating or a problem downloading. The next screen that comes up is the Avast antivirus setup which listes the summary as:

Information about current update:
Last encountered error: The package is broken.

Total time: 5:25

  • Vps: Updated
    (previous version: 000724-0, updated version: 000724-1)

Server: download37.avast.com (67.19.85.138)
Downloaded files: 5 (7.47 KB)
Download time: 48 s

Is there something wrong with my Avast or does it have to do with the infected files or worm?

2

The better and safer is always send the infected files to Chest for further analysis… then you can post the name and path of the files, the name of the viruses… etc.

Can you post name, path and virus name?

3

Thanks for your quick response and sorry about posting twice.

Here is the information as listed in the chest. Hopefully this is what you are looking for, there is 5 different files:
Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp267316844.tmp
FileID: 0000000055 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\vsamguii.dll New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp267316844.tmp\55.dll

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp267316844.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp267316844.tmp\55.dll Win32:VBStat-C [Trj]

Action was completed successfully!

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp105043608.tmp
FileID: 0000000054 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\tbnddpgi.exe New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp105043608.tmp\54.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp105043608.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp105043608.tmp\54.exe Win32:Trojan-gen. {Other}

Action was completed successfully!

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp143358889.tmp
FileID: 0000000056 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\srkfkkck.exe New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp143358889.tmp\56.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp143358889.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp143358889.tmp\56.exe Win32:Trojan-gen. {Other}

Action was completed successfully!

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp214315074.tmp
FileID: 0000000058 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\ndilwpni.dll New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp214315074.tmp\58.dll

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp214315074.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp214315074.tmp\58.dll Win32:VBStat-C [Trj]

Action was completed successfully!

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp78076947.tmp
FileID: 0000000057 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\brsplvkd.exe New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp78076947.tmp\57.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp78076947.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp78076947.tmp\57.exe Win32:Trojan-gen. {Other}

Action was completed successfully!

Sorry that the info is so long as scanning and then copying and pasting the detailed info was the only way that I could figure out ???
Thanks again.

4

Look, all files are temporary.
Clean your temporary files. You can use the Windows Advanced Care features for that or CCleaner.

After that, can you run a full scanning and post any info about infected files here?

5

I know that they are in the temp folder but why am I still getting them or where are they coming from? Avast places them in a temp folder when they are found, doesn’t it?

In the begining, I had cleaned out my temp folders and ran avast. Then I got more warnings (the ones listed below). I downloaded the windows advanced care as you suggested. I had also previously used AVG antispyware and smitfraudfix. I ran avast but to my understanding, because I didn’t request for a saved copy of the scan results before I ran avast, there was no data saved from it. also after I last ran avast and thought that my computer was good, I ended up with another warning (the most recent) and once again it is located in the temp folder:

Scanning of selected files

Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp85038675.tmp
FileID: 0000000059 Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\muxmjotm.exe New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp85038675.tmp\59.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp85038675.tmp

Action was completed with errors!

I am gonna run another scan and try to make sure I get a copy unless you are expecting something fromm the avast log viewer??
Thanks

6

If a virus is replicant (coming and coming again), you should:

  1. Enable/Disable System restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k.

  2. Clean your temporary files. You can use the Windows Advanced Care features for that.

  3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

  4. It will be good if you download, install, update and run other trojan remover tools: a-squared and/or Free AVG Antispyware (trojan removers). Some users recommend SUPERantispyware or Spyware Terminator.

  5. Use the immunization of [url=http://SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

When they’re scanned, not when they’re found. I mean, you can move to \data<moved> folder or move to Chest.

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp_avast4_\unp85038675.tmp
Is the one used while scanning.

7

I’m also having problems in updating but it appears to be something different. I have two PC’s at home using Avast home both running 4.7. One of the PCs updates perfectly and the other began to fail a couple of days ago. The report in the setup log is telling me that the license key is invalid!

The PC is an IBM ThinkCentre 2.8 Ghz P4 I picked up through a friend as part of a clearance of surplus machines from business just before Christmas . I loaded a fresh install of XP Pro. I then downloaded a new copy of install files from Avast and applied for a separate license key for this PC when it was set up.

Last night I applied for a new license number but this hasn’t fixed the problem, the new key number is still reporting as invalid.

Here is the last part of the log. I have modified the key number. The log is showing 18 characters as is the key number in the registration area of the program. The last piece of the key after the hyphen appears to disappear in both the program and the update log. However when using the copy past technique in registering the program accepts the key number. ???

20.03.2007 19:42:15 package: GetPackages - set proxy for inet
20.03.2007 19:42:15 internet: SYNCER: Type: use IE settings
20.03.2007 19:42:15 internet: SYNCER: Auth: another authentication, use WinInet
20.03.2007 19:42:15 general: Used server: http://download40.avast.com/iavs4x
20.03.2007 19:42:16 general: Used server: http://download40.avast.com/iavs4x
20.03.2007 19:42:16 general: Part of license key: xxxxxxxxxxxxxxxx
20.03.2007 19:42:16 general: progress end - 1
20.03.2007 19:42:16 general: Err:The license key for this product is invalid

Is this a common problem? Could reinstalling the program fix this problem?

I have been using Avast for several years without any major problems. I have also set it up for several friends and helped them update license keys as they expired. So I am used to the way keys are entered.

Thanks in advance.

8

In About dialog and setup.log, you can see only first part of license key, that’s correct (for security reasons).

Can you compress the whole avast4 folder (including subfolders) and send it to me? Either to my email or upload it to ftp://ftp.avast.com/incoming (this ftp is write-only, you won’t see any files there, but upload should be successful).
If it’s too big for uploading, send me at least files prod-av_pro.vpu, jollyroger.vpu and setup.log from avast4\setup

After that, you can reinstall program (uninstall, restart, install), this should fix it. You don’t have to register again, just put the latest license key into avast.

9

Thanks for the prompt help. I have started the upload as a zip file. I have included the winxip log as I hadnt closed avast (it mightnt update but it is still working.) as the PC is permenantly conected to the web. I dont seem to have captured setup.log.

FTP has calculated to be nearly an hour off finishing. I might have a reasonable download speed but upload is as slow as.

Roadkill

10

Thanks, it will be helpful. Please send also exported registry key “HKEY_LOCAL_MACHINE\Software\Alwil Software” to my email (you’ll see it in my profile).

11

I don’t need the registry now.
The problem is in incorrectly downloaded file jollyroger.vpu that contains blacklisted licenses, making your license invalid.
You don’t have to reinstall, just try update to update if the file will be downloaded correctly.
Or download the file here:
http://files.avast.com/iavs4x/jollyroger.vpu
And copy to avast4\setup folder. Then try update again.

12

Woo hoo :slight_smile: I’ll let the log summary speak for its self.

Information about current update:
Total time: 56 s

  • Program: Already up to date
    (current version 4.7.942)
  • Vps: Updated
    (previous version: 000724-1, updated version: 000726-0)

Server: download65.avast.com (207.44.172.117)
Downloaded files: 9 (423.50 KB)
Download time: 12 s

Thanks
Roadkill

13

Hi tech,
I had disabled my system restore and ran the windows advanced as well as attempted to run a boot scan but once it started, it said that there was an error with my keyboard and to push the ESC to by pass the scan. The scan then proceeded to list what files it would of scanned with the number zero next to it. I try this twice with the same results. I also tried to run the scan in safe mode but I could not get the computer into safemode.

Once avast had completed it’s normal (not in any mode)scan of the comp It listed it’s results as this:

avast! Report

  • This file is generated automatically
  • Task ‘Simple user interface’ used
  • Started on Wednesday, March 21, 2007 11:39:08 PM
  • VPS: 000726-1, 03/21/2007

C:\WINDOWS\system32\ggejwpdu.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest…
C:\WINDOWS\system32\gvohhigh.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest…
C:\WINDOWS\system32\odvxlljy.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest…
C:\WINDOWS\system32\rsbpdbma.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest…
C:\WINDOWS\system32\vaejriba.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest…
C:\WINDOWS\system32\xbwtlwbk.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest…
Infected files: 6
Total files: 319677
Total folders: 5410
Total size: 25.2 GB

  • Task stopped: Thursday, March 22, 2007 7:30:40 AM
  • Run-time was 7 hour(s), 51 minute(s), 32 second(s)

What do you suggest?

14
  1. You probably have a USB keyboard (?) and your BIOS doesn’t support it at boot, you can change the BIOS to enable support for USB devices at boot, unfortunately the chicken and egg scenario kicks in, you can’t adjust the BIOS as the USB keyboard isn’t enabled. If you have an old PS2 keyboard or can borrow one that may work and allow you to do a boot-time scan and or change the BIOS settings.

I’m a little surprised that the ESC key worked if the keyboard input previously didn’t work.

  1. You have done the right thing, ‘first do no harm’ don’t delete, send virus to the chest and investigate. I did a google search on all those file names detected and none of them return any hits, which in itself is suspicious, they look like randomly generated file names, see 4. below.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

  1. If you are able to resolve the problem with the keyboard at boot time as I mentioned schedule a boot-time scan and if it is clear you can enable system restore again.

  2. What we have to consider is what generated these infected files with random file names. If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode. The fact you can’t get into safe mode may also be an indication of malware blocking that option. http://www.pchell.com/support/safemode.shtml

Ewido, a.k.a. avg anti-spyware If using winXP. or a-Squared free if using win98/ME.

15

Thanks david for your response and all of your helpful responses!

Yes, I do have a wireless keyboard and mouse, unforunately, our old one was chucked as the keys were sticking horribly(thanks to my kids and bringing beverages to the comp) anyway, we opted for a wireless in an attempt for less wire cluttered in the back of the computer. I’m sorry but I’m not sure what you mean by changing the BIOS, how could I see if it can be done? Yes using the ESC key didn’t make sense to me either as my key board is working fine otherwise; unless as you suggested, the maleware could be preventing me from starting in safe mode…I tried atleast 10 failed attempts last night >:(.

The other funny thing I noticed is since I have a win xp, I also have my daughter as another user. She is only 8 and usually goes on my user account for her games, but upon opening hers and going on the net, I had pops coming on like crazy, not to mention the false security warnings with some company begining with ‘win’ in the title (sorry, I don’t remember the rest as I just kept canceling it) even though my pop up blocker is set at the highest level on hers.

A few weeks back, my older and very inexperienced niece was downloading some “files” in a p2p program. She also mentioned ( in another incident) something about a window poping up and telling her to downloaded what ever it was (if I got her story correct). I think she did but I haven’t noticed any new programs listed.

I do have AVG but my memory is so high (need more ram) that I don’t really run it as my comp is really slow with too many programs running.

Any other ideas or should I just wait a few weeks and then delete the files?

Thanks again!

16

It is just because drivers aren’t loaded at boot for USB devices, you keyboard would work in windows because it loads the drivers and supports USB devices. When your system is booting you can peck away at the Delete or F1 keys to interrupt the boot and enter the BIOS setup, unfortunately as I said you are unlikely to be able to do that if the USB keyboard isn’t enabled at boot. The setting if you get in are likely to be in the Peripherals section of the BIOS, but that may differ from manufacturer to manufacturer, so you would have to check the different sections.

Personally I still use a PS2 keyboard, I don’t need the bells and whistles and that is obviously a ‘legacy’ device and enabled at boot, that said I still have a spare. They really are a cheap commodity not to have a spare. I have a wireless optical mouse, but I also have a spare PS2 mouse.

You really need to consider installing software using ‘the administrator’ account that way it is available for all users, limited users included (which I assume your daughter is). It would appear that some of the protection on your account isn’t available on your daughters.

Check out this topic I contributed as it sounds similar to your pop-up alerts, http://forum.avast.com/index.php?topic=27297.0

I trust you mean AVG anti-spyware not anti-virus ?
If so the avg-as free version is on-demand only after the 30 trial, so that doesn’t use resources unless you are scanning. Periodically, weekly you should do an on-demand scan with avg-as, when you do this pause standard shield so there isn’t duplicate scanning, which should save resources.

As I said previously there is no rush to delete, they can’t do any harm in the chest and always check before deletion.

17

Part 1)
Ok…forget all my problems as previously posted!!! In the end, maybe all I will have to do is delete but I will let you be the judge of that.

As far as I know, the problems that I was having in regards to having trojans in my temp files (I believe) had disappeared after doing numerous things to try and get rid of them. I used:AVG anti spyware, spybot, ad-ware SE, and AVG 7.5. However, after doing this to eliminate any tojans, virus/worms on my computer, I still found that my comp was running horribly slow. I recently ran another scan and guess what…I still have a virus/worm on my computer but It appears to be in another area and not in my temp files as previously reported. I’m not sure how they got there or why I keep getting these problems. Is it possible I have a unknown backdoor??

I also noticed that I had alot of processes running, 36. I thought that was really high so I came upon a website that had listed all processes, what they were for and what risk level they were. Here is a list of what I have running (the high risk ones)
csrss.exe…W32.Gaobot.AOworm
lsass.exe…Win32.Agobot.AAvirus
hsvsvc.exe…hijacker.adware.win32.delfin
smss.exe…possible worm as I have to determine if this was safe or not. could be a reg process or a worm.
svchosts…this two had a few explainations and said that I had to figure out if they were indeed a risk to my computer.

Here is the latest copy of hijack this:
With my scans making this post longer than 10000 characters, I will have to post in 2 or 3 parts

18

Part2

Logfile of HijackThis v1.99.1
Scan saved at 8:42:07 AM, on 02/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\ColorByNumbers\CBNUCLSrvr.exe
C:\Program Files\ColorByNumbers\CBNUCLSrvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mytelus.com/new_homepage/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll
O2 - BHO: (no name) - {0F01FF26-18F5-4613-BFD6-14DE2FBA24C3} - blank (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {73F09C9D-0336-4C43-A60B-F0F8F6E49B2B} - C:\WINDOWS\system32\ddcya.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8B116AB2-8F9E-4E27-B033-B773DC8908Fc} - C:\WINDOWS\system32\surrkphr.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {C659C82E-6EF7-4658-9CAD-694305BFBAEa} - C:\WINDOWS\system32\esjmpeqf.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.2607.0\msgr.en-us.en-ca\msntb.dll
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [SoundService] rundll32.exe “C:\WINDOWS\system32\vyqjjccm.dll”,setvm
O4 - HKLM..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM..\Run: [type32] “C:\Program Files\Microsoft IntelliType Pro\type32.exe”
O4 - HKLM..\Run: [IntelliPoint] “C:\Program Files\Microsoft IntelliPoint\point32.exe”
O4 - HKCU..\Run: [Uniblue SpyEraser] “C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe” -m
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesca.dll
O9 - Extra ‘Tools’ menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesca.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra ‘Tools’ menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.10/cfweb_activex.camfrogweb.com-advanced-2.0.1.10_instmodule.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160013996265
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~2\MSGRAP~1.DLL
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)
O20 - Winlogon Notify: iifggec - iifggec.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

19

Part3

Ok, I am having problems pasting my antivirus scan results as it says that it is longer than 10000. Alot of the scan has files that couldn’t be scanned and I assume that they have corrupted files that are within the programs that I downloaded in order to get rid of trojans in the first place. here is the bottom part of the scan. I’m not sure if the 3rd file is all of the files that I mentioned above. If you like, I can try and split that in 2 or 3 parts.

C:\WINDOWS\system32\oobclcey.dll [L] Win32:Adware-gen. [Adw] (0)
File was successfully moved to chest…
C:\WINDOWS\system32\vdxwmwxw.dll [L] Win32:Adware-gen. [Adw] (0)
File was successfully moved to chest…
Infected files: 3
Total files: 324265
Total folders: 5215
Total size: 22.7 GB

20

Having two resident scanners installed is not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.

You need to decide what resident AV you have installed and uninstall the other, since you are receiving help from the avast forums, I know which way I would go. Not to mention support on the free version of AVG can be very lacking.

Ensure you have the latest version of JRE (JAVA Runtime Enviroment) jre1.5.0_11, because older versions can be vulnerable to malware. First remove All Older Versions From Add/Remove Programs.
Then get the latest update from here http://www.java.com/en/download/index.jsp

Suspect:
O2 - BHO: (no name) - {0F01FF26-18F5-4613-BFD6-14DE2FBA24C3} - blank (file missing)
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)
O20 - Winlogon Notify: iifggec - iifggec.dll (file missing)

Also see, anti-rootkit, detection, removal & protection http://www.antirootkit.com/software/index.htm.