Help after the latest update!

Eddy · 2017-10-04T16:54:46.000Z

Antivir is a av that needs to be removed before installing another av.

system · 2017-10-05T05:25:31.000Z

I downloaded and used the Avira registry cleaner. Avast still says that “Antivir Desktop” is installed.

system · 2017-10-05T05:35:34.000Z

Eddy post:3:

Antivirus is a av that needs to be removed before installing another av.

I uninstalled avira years ago and have been using avast ever since. It wasn’t until the update yesterday morning that this happened.

system · 2017-10-05T05:58:09.000Z

Pondus post:2:

and the repair tool comes back with the "antivir desktop" thing too.
What is antivir desktop thing? .... you may post a screenshot

Screenshots of the rootkit and passive mode messages, and the message I get when trying to turn off passive mode. If I tell it to turn off passive mode anyway, it brings up the “we’re preparing to actively protect your computer.” message box, then asks me to reboot. When I do, passive mode is still on. If I try to click on the Enable button for rootkit protection, nothing happens at all. I can mash the button as much as I’d like, but Avast does nothing.

https://imgur.com/a/ljmK9

Pondus · 2017-10-05T06:03:31.000Z

we can run diagnostic and let a expert check the log?

If you want to, go here >> https://forum.avast.com/index.php?topic=194892.0

scroll down to step 2 > Farbar Recovery Scan Tool
Run it as instructed and attach the two diagnostic logs in next reply here

How to attach, see below the box you write in here > Attachments and other options

system · 2017-10-05T07:16:29.000Z

Scanned and attached here

Pondus · 2017-10-05T07:57:27.000Z

Log expert is notified, it may take some hours before he is online

SassDrake · 2017-10-05T10:05:24.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

GroupPolicyScripts-x32: Restriction <==== ATTENTION
ProxyServer: [S-1-5-21-2473432863-2304891344-3724721309-1000] => http=127.0.0.1:50404

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-10-05T13:39:23.000Z

Code copied, encoded and saved… Run through FRST… And log below

After the reboot from FRST, Avast had a notification that it wanted my computer to reboot, but after the second reboot, nothing has changed. Still getting the same two messages about the rootkit and passive mode.

SassDrake · 2017-10-05T20:23:01.000Z

Previous fix was for possible adware modifications. Only Avira trace shown in logs is one folder which I really doubt is cause of issue.

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

C:\Users\Mr_Havoc\AppData\Local\Avira_Operations_Gmbh_&_C

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-10-05T20:45:33.000Z

Copied, saved, encoded… And log.

SassDrake · 2017-10-05T21:42:36.000Z

What is Avast status now?

system · 2017-10-06T09:09:10.000Z

Tried to enable Rootkit protection: Still nothing
Tried to turn off passive mode: Still says antivir desktop is installed. Told it to turn off passive mode anyway, rebooted my computer… Still in passive mode.
No changes

SassDrake · 2017-10-06T09:54:25.000Z

Try to reinstall Avast.

system · 2017-10-06T13:13:23.000Z

Full uninstall and reinstall… Same as before. Still no change. This is getting incredibly frustrating

I can go to Protection ~> Antivirus and toggle on both the File, Web, and Mail Shields without Avast asking to come out of passive mode. Are these actually going to work in this state? Or are they just switches that won’t do anything at all without being able to turn off Passive mode?

bob3160 · 2017-10-06T23:10:08.000Z

Reported to developers.

system · 2017-10-06T23:15:47.000Z

bob3160 post:18:

Reported to developers.

Thank you. Seriously though, is just activating the shields available under the Protection ~> Antivirus menu actually going to do anything? Or am I basically stuck in a reactive position if something ends up on my computer? (Not that I’m reckless about where I go/what I do online or anything, I’m just anxious to have answers and get all this resolved.)

bob3160 · 2017-10-06T23:28:29.000Z

Passive mode was designed to prevent problems for someone who installs Avast as the second resident AV.
It was designed to prevent causing you a problem.
Once the residuals of the other AV are removed or, the incorrect detection by Avast is corrected,
your problem will be solved.
You now need to exercise a little patience till Avast gets back to you.

system · 2017-10-06T23:48:45.000Z

OK. Thank you.

SassDrake · 2017-10-07T09:29:42.000Z

In meantime, let’s try with repairing WMI database and removing Avira extensions for Chrome.

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

CHR HKLM\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx
cmd: winmgmt /salvagerepository

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

Announcements