Avast update has stopped me connecting to the internet

Viruses and worms
1

Hi all,

I am having trouble with my laptop after doing an avast update last night.

So when i try and connect now i get an error saying the Diagnostic Policy Service needs to be started manually, but when i try and do that I get an error message saying:

Windows could not start the Diagnostic Policy Service on Local Computer
Error 5: Access is Denied

I have done most of the scans in this thread: http://forum.avast.com/index.php?topic=53253.0

Have done first step and attach the log file. I’m going to run MBAM now

This is the AdwCleaner log:

AdwCleaner v2.002 - Logfile created 09/21/2012 at 16:11:24

Updated 16/09/2012 by Xplode

Operating system : Windows Vista ™ Home Premium Service Pack 1 (32 bits)

User : Dan - DAN-PC

Boot Mode : Normal

Running from : G:\adwcleaner.exe

Option [Delete]

***** [Services] *****

***** [Files / Folders] *****

File Deleted : C:\Users\Dan\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\pgwi6ost.default\searchplugins\fast-browser-search.xml
Folder Deleted : C:\Users\Dan\AppData\Local\OpenCandy
Folder Deleted : C:\Users\Dan\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]

***** [Internet Browsers] *****

-\ Internet Explorer v7.0.6001.18000

Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\ Mozilla Firefox v12.0 (en-US)

Profile name : default
File : C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\pgwi6ost.default\prefs.js

C:\Users\Dan\AppData\Roaming\Mozilla\Firefox\Profiles\pgwi6ost.default\user.js … Deleted !

Deleted : user_pref(“browser.search.defaultthis.engineName”, “Fast Browser Search”);
Deleted : user_pref(“browser.search.defaulturl”, "hxxp://www.fastbrowsersearch.com/results/results.aspx?s=DEF&[…]
Deleted : user_pref(“browser.search.order.1”, “Fast Browser Search”);
Deleted : user_pref(“keyword.URL”, "hxxp://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={B92[…]

-\ Google Chrome v [Unable to get version]

File : C:\Users\Dan\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.13] : homepage = “hxxps://isearch.avg.com/?cid={1BBA899D-DACC-41EC-8AB3-8B399887AD9D}&mid=f204b280356e47d09f0601d9bae42bf1-5fdd5ad9e8be2d1fe522a7ba0085b6faaa7320d1&lang=en&ds=tt014&pr=sa&d=2012-09-20 19:56:00&v=13.0.0.7&sap=hp”,
Deleted [l.17] : urls_to_restore_on_startup = [ “hxxps://isearch.avg.com/?cid={1BBA899D-DACC-41EC-8AB3-8B399887AD9D}&mid=f204b280356e47d09f0601d9bae42bf1-5fdd5ad9e8be2d1fe522a7ba0085b6faaa7320d1&lang=en&ds=tt014&pr=sa&d=2012-09-20 19:56:00&v=13.0.0.7&sap=hp” ]
Deleted [l.1335] : homepage = “hxxps://isearch.avg.com/?cid={1BBA899D-DACC-41EC-8AB3-8B399887AD9D}&mid=f204b280356e47d09f0601d9bae42bf1-5fdd5ad9e8be2d1fe522a7ba0085b6faaa7320d1&lang=en&ds=tt014&pr=sa&d=2012-09-20 19:56:00&v=13.0.0.7&sap=hp”,
Deleted [l.2144] : urls_to_restore_on_startup = [ “hxxps://isearch.avg.com/?cid={1BBA899D-DACC-41EC-8AB3-8B399887AD9D}&mid=f204b280356e47d09f0601d9bae42bf1-5fdd5ad9e8be2d1fe522a7ba0085b6faaa7320d1&lang=en&ds=tt014&pr=sa&d=2012-09-20 19:56:00&v=13.0.0.7&sap=hp” ]

AdwCleaner[S2].txt - [3510 octets] - [21/09/2012 16:11:24]

########## EOF - C:\AdwCleaner[S2].txt - [3570 octets] ##########

2

Ok, the Mbam scan has finished, still cant get online, it did find a couple of things which it removed.

Here is the log:

Malwarebytes Anti-Malware (Trial) 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.07.13

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Dan :: DAN-PC [administrator]

Protection: Enabled

21/09/2012 16:40:21
mbam-log-2012-09-21 (16-40-21).txt

Scan type: Full scan (C:|D:|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 393630
Time elapsed: 2 hour(s), 33 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:$RECYCLE.BIN\S-1-5-21-1330044878-194030504-820351046-1000$RU5TYOY.exe (Affiliate.Downloader) → Quarantined and deleted successfully.
C:\Users\Dan\Downloads\DownloadSetup (1).exe (Affiliate.Downloader) → Quarantined and deleted successfully.
C:\Users\Dan\Downloads\DownloadSetup.exe (Affiliate.Downloader) → Quarantined and deleted successfully.

(end)

3

Here are the OTL Logs

4

Ok, so here is the aswMBR log

5

Just done an FSS scan and here is the log

6

Bump up

7

Please explain? ???

8

SOLVED I just had the same issue with a string of computer at the company i worked at. Login up under the administrator profile and DISABLE THE AUTO-SANDBOX FEATURE UNDER ADDITIONAL PROTECTION.