Can't register / Activate Avast Free

Hello,

I installed Avast Free last night for the first time (used to be an AVG user, but after some PC fixes decided to try this instead).

I downloaded the installer and ran it, and (as far as I remember) it said it installed fine. This morning the system tray icon says my ‘system is unsecured’.

The Home page says ‘You are unprotected, Avast background service is not running’ and has a link for ‘Start Now’ and a button for ‘Resolve All’. I’ve clicked on both, and nothing happens at all.

Settings → Active Protection says that the File System, Mail and Web shields are off, but clicking on the switches does nothing.

Settings → Registration says ‘You are registered’ and ‘current status: Registered, expiring 8/6/2016, registered 9/5/16’ (i.e. just one month).

Settings → About Avast says ‘Program version: 11.2.2262, Virus definitions version: Unknown, Number of definitions: Unknown.’

Settings → Update says ‘Current version: Unknown, Release Date: Unknown, Connection: Connection not established for the virus definitions’, and has a release date of 1/1/1970 for the program.

I’ve looked at the help files on the Avast site, and notably neither when I installed the program, nor when I clicked on Register did it ask for any personal details (email address etc.).

Anyone know what went wrong, and how I can get the program working?

Piers.

You need to remove avg (and any other previous installed av) completely before installing avast.

I did try to remove AVG, through a combination of manually deleting files, and running their own removal tool.

When I first tried to install Avast, it told me that it had found AVG, so obviously I hadn’t got rid of all of it. After a lengthy session trawling through the hard disk and the registry deleting everything I could find (I even started up from a Linux Live disk to allow me to delete files still in use) I re-ran the installer and it didn’t say anything about finding another virus program, so I assumed it would be OK.

Would the pre-existance of another virus scanner, though, cause the failure to register properly that I’m seeing?

Whatever the reason, what do I do now?

Thanks,

Piers.

P.S. Forgot to say: Win XP SP3 (yes, I know it’s out of date, I’m in the process of transferring to another PC)

Try: https://www.avast.com/registration-free-antivirus.php

Hello,

Thanks for the link to the registration page.

I followed the instructions, entered my details, and have received a license key. Unfortunately it doesn’t work.

The instructions in the email I received are:

  1. Highlight the license key above, then right-click it and select “Copy”.
  2. Open your Avast Free Antivirus controls and select the “Settings” tab.
  3. Next, click the “Registration” tab.
  4. Click the arrow next to “Offline registration” to expand this option.
  5. Click the “Insert the license key” button.
  6. Right-click in the empty Registration box and select “Paste”.
  7. Click “OK” – your license key is now inserted and your Avast antivirus software can now be used free of charge for a further 12 months.

The problem is that my copy of Avast seems to think that I’ve registered already, so it doesn’t have a section for offline registration or a button to insert the license key.

At this point is there anything I can do, or do I just have to remove the program and try starting from scratch?

Piers.

First, be sure to get rid of all remnants of your prior installed AV(s)…!!
https://www.avast.com/faq.php?article=AVKB11#artTitle

Then:

  1. Download Avast Free Antivirus: https://files.avast.com/iavs9x/avast_free_antivirus_setup.exe
  2. Follow instructions: https://www.avast.com/uninstall-utility (Run this tool for all prior installed Avast versions…!!)
  3. Reinstall Avast with the downloaded installer from point 1.
  4. Reboot.

Hello again,

OK, well I did what you (Asyn) suggested, and it did seem like Avast had installed OK. It didn’t ask me for an email address or anything, so I suppose I should have known there was something wrong, but for a short time the Active Protection seemed to be on.

After a restart, however, it’s not working again. The File, Mail and Web Shields are off, the Update page says the virus definitions current version is unknown and the connection not established. Registration says the program will expire on 10/5/2017, however, so I appear to have been given the full year of access (if only it worked).

I do have an ongoing issue with this PC, which is that it won’t shut down properly, it gets half way there and then hangs with a blue screen (no error codes, though), so I have to hold the power button down to switch it off.

Is it possible that Avast needs a perfect shut-down to be able to start itself again properly? That doesn’t really make sense, as any restart after a power outage would leave the PC unprotected.

Anyway, whatever the issue, it’s not working for me, so unless someone can come up with a good suggestion I think I’ll be forced to give up and go to another anti-virus…

Piers.

Anyway, whatever the issue, it's not working for me, so unless someone can come up with a good suggestion I think I'll be forced to give up and go to another anti-virus...

can you provide these diagnostic logs

See instructions here >> https://forum.avast.com/index.php?topic=53253.0
Scroll down to second picture > Farbar Recovery Scan Tool < Run as instructed and attach the two diagnostic logs

See below the box you write in … Attachments and other options

When done, Essexboy will have a look … tomorrow

Pondus,

Thanks for the reply. I’ve attached the FRST scans as requested.

I’ve also attached a screen grab of an error message that popped up when I ran it.

Piers.

Did you set this proxy ?

ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => wgate.npl.co.uk:8080
AutoConfigURL: [.DEFAULT] => wgate.npl.co.uk:8080

After this you may need to do a clean install of Avast

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: S2 vToolbarUpdater18.9.0; "C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.9.0\ToolbarUpdater.exe" [X] S3 AvgAMPS; "C:\Program Files\AVG\Av\avgamps.exe" [X] S2 AVGIDSAgent; "C:\Program Files\AVG\Av\avgidsagent.exe" [X] S2 avgsvc; "C:\Program Files\AVG\Framework\Common\avgsvcx.exe" [X] S2 avgwd; "C:\Program Files\AVG\Av\avgwdsvcx.exe" [X] S1 Avgdiskx; system32\DRIVERS\avgdiskx.sys [X] S1 AVGIDSDriverl; system32\DRIVERS\avgidsdriverlx.sys [X] S0 AVGIDSHX; system32\DRIVERS\avgidshx.sys [X] S1 AVGIDSShim; system32\DRIVERS\avgidsshimx.sys [X] S1 Avgldx86; system32\DRIVERS\avgldx86.sys [X] S0 Avglogx; system32\DRIVERS\avglogx.sys [X] S0 Avgmfx86; system32\DRIVERS\avgmfx86.sys [X] S0 Avgrkx86; system32\DRIVERS\avgrkx86.sys [X] S1 Avgtdix; system32\DRIVERS\avgtdix.sys [X] S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe" [X] CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> "43.0.2357.124\delegate_execute.exe" => No File CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{D166BD15-03AF-413A-BEFD-0679FF410B49}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> no filepath CustomCLSID: HKU\S-1-5-21-1083223032-1218742381-3483612442-500_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> no filepath Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

Hello,

Here’s the fixlog.

I also re-ran the FRST scan, so you’ve got fresh copies of the other logs as well.

Piers.

How is Avast now ?

Hello,

No change to Avast from last time. I haven’t tried updating it yet, in case you had any further comments from the log files.

From looking at the FRST logs it seems to me like all the deletions relating to remnants of AVG haven’t stuck. They’ve all come back following a re-boot. I previously tried getting rid of them with WindowexeAllKiller, but as with FRST it can’t have dealt with the root cause. There’s obviously some kind of process running all the time which repopulates the registry and start-up service list ready for the next reboot. It doesn’t actually start AVG, of course, because I’ve removed all the program components I could find, but it does lead to the errors in the event log.

I have posted a request in the AVG forum asking for help deleting these remnants, and have received instructions for contacting their senior technical team. With any luck they’ll manage where FRST has failed. I’m planning on doing that next (unless you have something else you’d like me to try first?).

Questions:

Do you really think that these remnants of AVG are the problem with Avast, or are we looking in the wrong place?

Do you think the shut-down issues I’ve been having have got anything to do with it?

Piers.

The probability exists as you do have errors as windows tries to load the services and drivers. I did see that on the FRST log they had come back…

Did you use the AVG remover ? http://www.avg.com/gb-en/utilities

Hello,

I used the AVG remover, but after uninstalling through Windows, so I guess it’s possible that the remover tool couldn’t work properly because Windows had deleted some critical components for it. I’ve run it again, and it says there’s no installation.

I don’t really want to do this, but I’ve seen a suggestion elsewhere to reinstall AVG to a fully working system, just so that it can then be removed!

Piers.

That would have been my next suggestion, install it and then uninstall using Revo uninstaller

Hello again,

Do you know if there’s anywhere I can find an explanation of how programs like AVG manage to prevent deletion like this, and how do get round it?

I get that the point of a good virus scanner is to prevent itself being deleted through external attack, but it seems there must a be a logical method, even if it means booting to another operating system (e.g. Linux as I’ve done) so that you can delete critical files.

Piers.

What’s ‘Revo’?

OK lets now run the fix from safe mode and that will negate any self defence

Reboot to safe mode to run this fix otherwise it may fail

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

BootExecute: autocheck autochk /p \??\C:autocheck autochk * sdnclean.exeC:\PROGRA~1\AVG\Av\avgrsx.exe /sync /restart HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "" <======= ATTENTION Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - No File CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - S3 AvgAMPS; "C:\Program Files\AVG\Av\avgamps.exe" [X] S2 AVGIDSAgent; "C:\Program Files\AVG\Av\avgidsagent.exe" [X] S2 avgsvc; "C:\Program Files\AVG\Framework\Common\avgsvcx.exe" [X] S2 avgwd; "C:\Program Files\AVG\Av\avgwdsvcx.exe" [X] S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe" [X] S2 vToolbarUpdater18.9.0; "C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.9.0\ToolbarUpdater.exe" [X] S2 RUBotSrv; C:\Program Files\Trend Micro\RUBotted\RUBotSrv.exe [X] S1 Avgdiskx; system32\DRIVERS\avgdiskx.sys [X] S1 AVGIDSDriverl; system32\DRIVERS\avgidsdriverlx.sys [X] S0 AVGIDSHX; system32\DRIVERS\avgidshx.sys [X] S1 AVGIDSShim; system32\DRIVERS\avgidsshimx.sys [X] S1 Avgldx86; system32\DRIVERS\avgldx86.sys [X] S0 Avglogx; system32\DRIVERS\avglogx.sys [X] S0 Avgmfx86; system32\DRIVERS\avgmfx86.sys [X] S0 Avgrkx86; system32\DRIVERS\avgrkx86.sys [X] S1 Avgtdix; system32\DRIVERS\avgtdix.sys [X] Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f EmptyTemp:

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that