Hi, I have been using avast for severalmonths but suddenly I noticed that the background service isn’t running. I tried to start it but nothing happened. I tried to run a scan and the message “There are no more endpoints available from the endpoint mapper” appeared. I can logon to my account and everything looks fine. I don’t notice any other symptoms of any kind of malware.
I followed the advice on the forum and downloaded/ran Malwarebytes, Farbar and aswMBR; here are the logs. There is another one called protection-log from malwarebytes but I can’t attach it as I’m only allowed 4.
It looks as though Avast has thrown a bit of a wobbly as you have several pending emupdates running. A repair will probably not cure this so I would suggest a full re-install
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
HKLM-x32\...\RunOnce: [aswAhAScr.dll] => "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
HKLM-x32\...\RunOnce: [aswasOutExt.dll] => "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
HKLM-x32\...\RunOnce: [aswasOutExt64.dll] => "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
HKLM-x32\...\RunOnce: [20131224] => C:\Program Files\AVAST Software\Avast\setup\emupdate\d9dc9cae-50e3-4f25-b388-d75c04915c9f.exe [181136 2014-05-02] (AVAST Software)
HKLM-x32\...\RunOnce: [20140526] => C:\Program Files\AVAST Software\Avast\setup\emupdate\945a37de-e172-411e-a903-58fabb682b26.exe [182720 2014-05-28] (AVAST Software)
HKLM-x32\...\RunOnce: [20140529] => C:\Program Files\AVAST Software\Avast\setup\emupdate\71562a07-f590-419e-8597-975b8a618395.exe [183208 2014-05-31] (AVAST Software)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
URLSearchHook: [S-1-5-21-1377747507-4165520261-2543380438-1001] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: [S-1-5-21-1377747507-4165520261-2543380438-1002] ATTENTION ==> Default URLSearchHook is missing.
SearchScopes: HKU\S-1-5-21-1377747507-4165520261-2543380438-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1377747507-4165520261-2543380438-1006 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> No File
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
AlternateDataStreams: C:\Users\Pat\Desktop\Lurujarri Song part 1.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Pat\Desktop\Lurujarri Song part 1.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Pat\Desktop\Lurujarri song part 2.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Pat\Desktop\Lurujarri song part 2.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Pat\Desktop\NPWS Application.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Pat\Desktop\NPWS Application.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Pat\Desktop\Pensioner Concession Card.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Pat\Desktop\Pensioner Concession Card.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
AlternateDataStreams: C:\Users\Pat\Documents\petepassport.jpeg:3or4kl4x13tuuug3Byamue2s4b
AlternateDataStreams: C:\Users\Pat\Documents\petepassport.jpeg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
C:\ProgramData\SetStretch.exe
C:\ProgramData\SetStretch.VBS
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
I actually kept on trying to fix the problem after I posted my query, and managed to get Avast working again by simply re-installing and rebooting although I had to do it twice before it was fixed.
Should I adopt the maxim that if it works, don’t fix it? Or should I go ahead and run FRST with the fixlist you posted in case there are still some hidden problems? I have since done some cleanup of stuff I don’t need any more and note that at least one of the files in the fixlist no longer exists.
Next time I will be more patient, as your fix is clearly more robust than mine!
