I CANT UPDATE AVAST HOME EDITION! CONFICKER??? PLEASE HELP

Viruses and worms
1

Hi i cant update avast…some programs crush all the time…(skype, msn messenger ,and mozilla )
can enyone help me and say whats the problem?

this is what i get when i try to update avast

30.03.2009 02:38:55 general: Started: 30.03.2009, 02:38:55
30.03.2009 02:38:55 general: Running setup_av_pro-537 (1335)
30.03.2009 02:38:55 system: Operating system: WindowsXP ver 5.1, build 2600, sp 3.0 [Service Pack 3]
30.03.2009 02:38:55 system: Memory: 55% load. Phys:466276/1047856K free, Page:1830140/2520316K free, Virt:2069096/2097024K free
30.03.2009 02:38:55 system: Computer WinName: COMPUTER
30.03.2009 02:38:55 system: Windows Net User: COMPUTER\Sasa
30.03.2009 02:38:55 general: Cmdline: /downloadpkgs /noreboot /updatevps /silent /progress
30.03.2009 02:38:55 general: DldSrc set to inet
30.03.2009 02:38:55 general: Operation set to INST_OP_UPDATE_GET_PACKAGES
30.03.2009 02:38:55 general: Old version: 537 (1335)
30.03.2009 02:38:55 registry: Deleted registry: Software\Alwil Software\Avast\4.0\UpdateReady
30.03.2009 02:38:55 system: Using temp: C:\DOCUME~1\Sasa\LOCALS~1\Temp_av_proI.tm~a00220 (62644M free)
30.03.2009 02:38:55 general: SGW32P::CheckIfInstalled set m_bAlreadyInstalled to 1
30.03.2009 02:38:55 internet: SYNCER: Agent=Syncer/4.80 (av_pro-1335;p)
30.03.2009 02:38:55 system: Computer DnsName: Computer
30.03.2009 02:38:55 system: Computer Ip Addr: 192.168.1.64
30.03.2009 02:38:55 system: Installed in: C:\Program Files\Alwil Software\Avast4 (62644M free)
30.03.2009 02:38:55 internet: SYNCER: Type: use IE settings
30.03.2009 02:38:55 internet: SYNCER: Auth: another authentication, use WinInet
30.03.2009 02:38:55 package: Part prg_av_pro-537 is installed
30.03.2009 02:38:55 package: Part vps-9032800 is installed
30.03.2009 02:38:56 package: Part news-4f is installed
30.03.2009 02:38:56 package: Part setup_av_pro-537 is installed
30.03.2009 02:38:56 package: Part jrog-c4 is installed
30.03.2009 02:38:56 general: Old version: 537 (1335)
30.03.2009 02:38:56 general: GUID: 0b348da6-4e16-4927-8490-923c4c9445ea
30.03.2009 02:38:56 general: Server definition(s) loaded for ‘main’: 235 (maintenance:0)
30.03.2009 02:38:56 general: SelectCurrent: selected server ‘Download703 AVAST Server’ from ‘main’
30.03.2009 02:38:56 internet: SYNCER: Type: use IE settings
30.03.2009 02:38:56 internet: SYNCER: Auth: another authentication, use WinInet
30.03.2009 02:38:56 general: Entered SetupProcessPro::Do( INST_OP_UPDATE_GET_PACKAGES )
30.03.2009 02:38:56 general: Entered SetupProcessWin32Avast::Do( INST_OP_UPDATE_GET_PACKAGES )
30.03.2009 02:38:56 general: Entered SetupProcessWin32::Do( INST_OP_UPDATE_GET_PACKAGES )
30.03.2009 02:38:56 general: Entered SetupProcess::Do( INST_OP_UPDATE_GET_PACKAGES )
30.03.2009 02:38:56 general: progress thread start
30.03.2009 02:38:56 internet: SYNCER: Agent=Syncer/4.80 (av_pro-1335;f)
30.03.2009 02:39:17 internet: Used server: http://174.133.30.186/iavs4x
30.03.2009 02:39:32 internet: Used server: http://174.133.30.186/iavs4x
30.03.2009 02:39:32 file: GetFileWithRetry: servers.def.vpu downloaded .
30.03.2009 02:39:32 file: GetNewerStampedFile:DSA_FileVerify(C:\DOCUME~1\Sasa\LOCALS~1\Temp_av_proI.tm~a00220\onefile), error: 0x2000000B
30.03.2009 02:39:32 package: Download servers.def, servers.def.vpu failed with error 0x20000011.
30.03.2009 02:39:48 internet: Used server: http://174.133.30.186/iavs4x
30.03.2009 02:40:04 internet: Used server: http://174.133.30.186/iavs4x
30.03.2009 02:40:04 file: GetFileWithRetry: servers.def downloaded .
30.03.2009 02:40:04 file: GetNewerStampedFile:DSA_FileVerify(C:\DOCUME~1\Sasa\LOCALS~1\Temp_av_proI.tm~a00220\onefile), error: 0x2000000B
30.03.2009 02:40:04 package: Tried to download servers.def but failed with error 0x20000011.
30.03.2009 02:40:04 package: LoadAllDefs failed 0x20000011
30.03.2009 02:40:04 general: Err:The package is broken

2

The package is broken… something is messing the avast update, maybe other browsers or programs running in background… can you post the last lines of the log?

3

ok ill tell you what i have when trying to update avast…:

first after some waiting i got a message the package is broken!

i go to view log … and in a window werbosity i can select minimal normal verbose and debug…
i posted you a debug log…and there 's no more log than this

this problems ocured today when my skype suddenly crush and mozilla and msn messenger…i can start skype again but it repeats the crush again

is that some virus…
pleas help me …
sorry for bad english.

4

can someone from the tech admins explain to me if this problem maybe looks like CONFICKER virus ?

unable to download updates for avast
mozilla crush from time to time
skype crush allso
msn crush allso

f secure scaner did not find any thing
kaspersky scaner on critical area did not find any thing
trend micro scaner didnt find any thing
instaled malwarebytes sofrweare and found 30 viruses and malvare!!but cant update it allso >:( !

i suspect on CONFICKER…can someone help.or give his opinion please.

5

any admin help today?

6

You still haven’t posted the last lines of your log.

As long as you update your computer with windows updates, then no, I don’t think you have the conficker worm.

Please post the rest of the log so that we may help you.

7

can you tell me where to find the rest of the log?

do i need to post from the log menu minimal normal verbose or debug log…?
thats the options i have.

and i’ did not updated my windows latelly

8

Well, if you’re worried about conficker, go here and follow microsoft’s instructions.
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx

It’s possible that you may have a firewall that is blocking Avast’s update feature (obtained this:

from this post from someone with the same problem: http://forum.avast.com/index.php?;topic=35969.0

It’s also possible that your installation is corrupt. You can try to run a repair of avast from Add/Remove Programs applet in control panel.

9

Download updates from this link http://www.gt500.org/malwarebytes/database.jsp These are for version 1.35 Post the scan results.Strange that MBAM finds 30 viruses and Kaspersky nothing

Double click on update file to update MBAM. I believe these updates will only work with 1.35

10

ok ill try to update malwarebytes …somehow…

i had personal firewall but yesterday i removed it from pc …because i was suspecting that maybe its infected somehow…so now i only have windows firewall.

ill post log of that scan .

11

this is the first log which malware bytes has found…but its on my language!!! sorry i edited a litlle and put infected where infection is found…
so you can see what is found yesterday.

im doing now new scan…i hoppe its virus database is updated corectly.
ill post it here

Malwarebytes’ Anti-Malware 1.35
Verzija baze podataka: 1904
Windows 5.1.2600 Service Pack 3

30.3.2009 6:08:24
mbam-log-2009-03-30 (06-08-20).txt

Tip provjere: Brza Provjera
Provjerenih objekata: 70289
Vrijeme trajanja: 3 minute(s), 16 second(s)

Zaraženi procesi u memoriji: 0
Zaraženi moduli u memoriji: 0
Zaraženi ključevi u registru: 21
Zaražene vrijednosti u registru: 8
Zaraženi podaci u registru: 1
Zaraženi spremnici: 0
Zaražene datoteke: 0

Zaraženi procesi u memoriji:
(Zloćudne stavke nisu otkrivene)

Zaraženi moduli u memoriji:
(Zloćudne stavke nisu otkrivene)

infected keys in registar ********:
HKEY_CLASSES_ROOT\Interface{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) → No action taken.
HKEY_CLASSES_ROOT\CLSID{81705d67-3f73-4983-859b-97d0922e5abe} (Trojan.FakeAlert) → No action taken.
HKEY_CLASSES_ROOT\Typelib{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{81705d67-3f73-4983-859b-97d0922e5abe} (Trojan.FakeAlert) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) → No action taken.

infected vrijednosti u registru********:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar{81705d67-3f73-4983-859b-97d0922e5abe} (Trojan.FakeAlert) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser{81705d67-3f73-4983-859b-97d0922e5abe} (Trojan.FakeAlert) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow*.securewebinfo.com (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow*.safetyincludes.com (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow*.securemanaging.com (Trojan.Zlob) → No action taken.

infected** informations in registar:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) → Bad: (1) Good: (0) → No action taken.

Zaraženi spremnici:
(Zloćudne stavke nisu otkrivene)

Zaražene datoteke:
(Zloćudne stavke nisu otkrivene)

12

It looks pretty well updated.It says no action taken did you check the boxes and choose remove selected

13

yes afer mbam found that i deleted all that.

this is the new log nothing found :frowning:

Malwarebytes’ Anti-Malware 1.35
Database version: 1893
Windows 5.1.2600 Service Pack 3

30.3.2009 18:56:28
mbam-log-2009-03-30 (18-56-28).txt

Scan type: Full Scan (C:|)
Objects scanned: 105382
Time elapsed: 18 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

14

so how should i approach to this problem.

in your opinion

15
It looks pretty well updated.It says no action taken did you check the boxes and choose remove selected
16

yes i deleted all

17

Ok, is the problem fixed after removing the bad entries, or are you still having a problem?

18

Can you update windows now ? So Avast runs but will not update ? You could try a couple more scans, and post a Hijack This log

http://www.superantispyware.com/

http://www.freedrweb.com/cureit/

http://filehippo.com/download_hijackthis/ open HJT choose 'scan and save a log file ’ copy/ paste the results that appear in notepad

You could also try updating manually and run a boot time scan
http://www.avast.com/eng/updates.html

Post the HJT log first

19

Sorry about that scythe944, I didn,t mean to butt in.

20

Looks like he did as he has run MBAM again and no detections found in the latest MBAM log.