Avast will not install

Avast Free Antivirus / Premium Security
1

Avast will not install at all. It keeps giving me error code 2 0x000000000002

Already tried the Avast unisntall tool first in safe mode which did not work an in my desktop.
Tried everything else i could think of like malwarebytes, CCleaner, SuperAntiSpyware, Trend Micro products , Kraspersky products, an many others. Everything now comes up as no threats at all in the system. Downloaded ComboFix went through the logs myself but didn’t get to finish because of a BSOD.

Please help I am sure this machine is infected with RootKits an everything from A-Z. Browser is hijacked no matter what i do. Home page changed, Malwarebytes constantly blocking incoming connections the list just goes on. I really don’t want to do a fresh install(yet) an Avast always does the job when the others fall short so its really pissing me of that it will not install! >:(

Thanks in advanced. Oh sorry if i posted in wrong section :stuck_out_tongue:

2

Follow the instructions in the first post http://forum.avast.com/index.php?topic=53253.0 and attach the logs to your next post back here for one of the malware team members to look over.

3

Here you go. Sorry again an for the late reply.

4

I’ve notified Essexboy to look into your logs but it will be several hours before he is on the forum so please be patient.

5

First could you uninstall Immunet then run this OTL fix

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]

:OTL
SRV - [2013/11/27 00:41:58 | 000,807,800 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
IE - HKU\S-1-5-21-3409787176-1844054892-2030423763-1000\..\SearchScopes\{84FD9A80-F4DF-46BB-B610-21DFC5DC8E6E}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3310511&CUI=UN26015779061912940&UM=2
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
[2013/12/04 17:49:54 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\cjuatqjj.sys
[2013/12/03 22:33:18 | 000,000,272 | ---- | M] () -- C:\Windows\tasks\Driver Booster Update.job


:Commands
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

6

Thank you. Also to clarify after running OTL with code provided as you said Essexboy after PC rebooted OTL was ran without LOP Check an Purity Check anticked. Thanks again.

7

Are your browsers still being hijacked ?

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

8

Browser is not getting hijacked but my homepage was i deleted it manually but still get sent somewhere else as well as my default search engine… PC runs way better now though. Avast still will not install.

9

Could you temporarily uninstall Threatfire and all Iobit programmes

Run this small programme and then try a re-install of Avast

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

10

Here you go

Avast installs now thanks ;D

Still having issues with chrome. It keeps opening yahoo as my homepage an replaces google search as well

11

Are you able to manually change the chrome home and search page ?

12

Yes but every time I do an run chrome again its back on

13

OK lets track it down

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please copy and paste log back here.
[*]The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

14

Thanks! I still think there is a rootkit on this system. Avast scans says no threats.

Anyways here you go

15

Why do you think you have a rootkit ?

Download the attached fixlist.txt to the same location as FRST
Run FRST and press fix
A log will be generated post that

Chrome should now be good

16

I cant remember the scanner but it had picked up two different rookits during a scan but before it finished system froze an had to restart. After restart i scanned again an it picked up nothing this time.

That did not fix chrome but after i did it i uninstalled chrome then re installed an now all is right.

17

Any further problems ?