Latest version of Avast, just doesn't open. 

essexboy · 2015-08-12T16:27:11.000Z

The main culprit is running from the quarantine at the moment and masquerading as fifa 64

If this fails to kill I will move on to a heavier programme

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

If you have bookmarks, let’s save them by exporting them - Export Bookmarks
Then I need you to go Google Sync and sign into your account
Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
Import your bookmarks back into Chrome
Sign back in to your Chrome browser so that your bookmarks sync with your online account.

THEN

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: IFEO\avastSvc.exe: [Debugger] svchost.exe IFEO\avastUI.exe: [Debugger] svchost.exe IFEO\tapinstall.exe: [Debugger] svchost.exe IFEO\VisthAux.exe: [Debugger] svchost.exe HKLM-x32\...\Run: [] => [X] Startup: C:\Users\Little Wonders\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIFA Soccer 64.lnk [2015-03-13] ShortcutTarget: FIFA Soccer 64.lnk -> C:\FRST\Quarantine\C\ProgramData\{2899c890-57cb-72e8-2899-9c89057c2241}\FIFA Soccer 64.exe () CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION BHO: DeEalExpraess -> {A2FF2181-79EC-4ADD-9193-CC53BA94E9BB} -> C:\Program Files (x86)\DeEalExpraess\6Vz6NArC6LzTZi.x64.dll [2015-08-12] () BHO-x32: DeEalExpraess -> {A2FF2181-79EC-4ADD-9193-CC53BA94E9BB} -> C:\Program Files (x86)\DeEalExpraess\6Vz6NArC6LzTZi.dll [2015-08-12] () FF SearchPlugin: C:\Users\Little Wonders\AppData\Roaming\Mozilla\Firefox\Profiles\fanljv6v.default\searchplugins\startnow.xml [2014-02-28] FF Extension: No Name - C:\Users\Little Wonders\AppData\Roaming\Mozilla\Firefox\Profiles\fanljv6v.default\extensions\_qvxbkbnnuzqukzjj_i@frnhpojlbr_in.com [not found] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found] R2 24efcaa5; c:\Program Files (x86)\SystemLight\SystemLight.dll [2733056 2015-08-12] () [File not signed] 2015-08-12 10:18 - 2015-08-12 10:18 - 00000079 _____ C:\Program Files (x86)\prefs.js 2015-08-12 10:18 - 2015-08-12 10:18 - 00000000 ____D C:\Program Files (x86)\DeEalExpraess 2015-08-12 10:17 - 2015-08-12 10:18 - 00000000 ____D C:\ProgramData\3513037906374832000 2015-08-12 10:17 - 2015-08-12 10:17 - 00000000 ____D C:\Program Files (x86)\DeuaaloExprEEsse 2015-08-12 10:17 - 2015-08-12 10:17 - 00000000 ____D C:\Program Files (x86)\DEaalExpreess 2015-08-12 09:57 - 2015-08-12 09:57 - 00000000 ____D C:\Program Files (x86)\SystemLight 2015-08-10 15:33 - 2015-08-12 09:33 - 00000370 _____ C:\Windows\Tasks\ImageEnhance.job 2015-08-10 15:33 - 2015-08-10 15:33 - 00003300 _____ C:\Windows\System32\Tasks\ImageEnhance Task: {12E94DB0-B70A-4B50-A7A1-26C280A3F598} - System32\Tasks\{00BA7C04-2930-4BA0-85D8-9C64416E6396} => pcalua.exe -a C:\Users\LITTLE~1\AppData\Local\Temp\F295A114\ChildcareManagerSetup.exe -d C:\Windows\SysWOW64 -c /embed"{F4AC2A05-BDC8-48BC-9962-A2766D6B8A18}" /hide_splash /hide_progress /runprerequisites"Help,Reports,ChildcareManager,ProgramFiles,Manual,NetworkServer" /l1033 Task: {2721C2CE-DA44-4A0F-BD21-9928294F2794} - System32\Tasks\{B1ED28FA-8139-42D6-AD80-BE820BFD604E} => pcalua.exe -a "C:\Users\Little Wonders\AppData\Local\Temp\Temp2_vista_prolific_chip_driver_for_serial_adapters.zip\Vista_Installer.exe" Task: {3A29F414-D5EC-41D7-BE1F-F3F40B8A31BC} - System32\Tasks\{B5AB9C9D-5DF1-4D36-BC1A-6DA8FA87347F} => pcalua.exe -a "C:\Program Files (x86)\DiscountBomb\DiscountBomb.exe" -c /s /n /i:"ExecuteCommands;UninstallCommands" "" Task: {6B4697D6-2AB3-4189-B570-1DA4747F7B3D} - System32\Tasks\{EBD12ADD-9B7C-491A-94B3-2CFFC7CC35DE} => pcalua.exe -a "C:\Users\Little Wonders\Documents\Downloads\CCM-Server_Setup(V10.0.2905).exe" -d C:\Windows\SysWOW64 -c /embed"{ADC05057-2056-4B14-B859-E67CCB2EA230}" /hide_splash /hide_progress /runprerequisites"Help,Reports,ChildcareManager,ProgramFiles,Manual,NetworkServer" /l1033 Task: {7441EABB-1BE3-4601-B490-516A306BABF0} - System32\Tasks\{1796F9BB-E4C4-4DA4-8335-24DC731E4708} => pcalua.exe -a "C:\Users\Little Wonders\Desktop\USBSrDvr.exe" -d "C:\Users\Little Wonders\Desktop" Task: {768F60AD-DB89-4776-A45B-279E797A150F} - System32\Tasks\{395F898C-0DAF-4DFA-AA08-E8F8BAB1DF30} => pcalua.exe -a C:\kc5\setup\setup.exe Task: {7CE2A72D-BB2F-44ED-89CA-1F6D1E32A005} - System32\Tasks\{51B1EBD4-DD09-442F-B202-70DFD26090F7} => E:\ACMSETUP.EXE Task: {9F3E6CA9-E64E-4969-8635-7EB5D7CB6D66} - System32\Tasks\{C56306F3-67B6-486D-B81F-0B8E937C7C99} => C:\Users\Little Wonders\Desktop\MDAC_TYP.EXE Task: {CA28FE0A-8394-4928-9950-5D9710D93598} - System32\Tasks\{29639896-F900-4CCA-B787-6BC9FAE525A0} => E:\ACMSETUP.EXE Task: {D37F3308-16E6-4800-9687-DB07E918E18C} - System32\Tasks\{6FE15A16-DF91-49D1-BCCE-E758CB864855} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" -c /uninstall HOMESTUDENTR /dll OSETUP.DLL Task: {D823F284-E68E-43F4-9D0F-249C61B92645} - System32\Tasks\ImageEnhance => c:\programdata\{fd02b9e2-a850-2b00-fd02-2b9e2a85e78a}\108573950245256588b.exe <==== ATTENTION Task: {EF4F2429-35B8-44FE-A8BD-25995276C545} - System32\Tasks\{B1769513-4A93-4EFF-95C5-F720E95A94AC} => C:\Program Files (x86)\Personalized Software\Childcare Manager 10\ChildCareManager.exe [2011-03-11] (Personalized Software, Inc.) Task: C:\Windows\Tasks\ImageEnhance.job => c:\programdata\{fd02b9e2-a850-2b00-fd02-2b9e2a85e78a}\108573950245256588b.exe <==== ATTENTION C\ProgramData\{2899c890-57cb-72e8-2899-9c89057c2241} C:\FRST\Quarantine\C\ProgramData\{2899c890-57cb-72e8-2899-9c89057c2241} C:\Program Files (x86)\DeEalExpraess c:\Program Files (x86)\SystemLight C:\Program Files (x86)\DiscountBomb c:\programdata\{fd02b9e2-a850-2b00-fd02-2b9e2a85e78a} RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-08-12T19:05:39.000Z

Before I do your next steps, I really don’t care to keep chrome at all, and I don’t believe I have a google sync account. I would remove it, but uninstalling whatever is left of it, I get this error: “There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor.” I’m not trying to install it, but uninstall it.

essexboy · 2015-08-12T19:49:57.000Z

No problem I will manually remove it if you wish after

system · 2015-08-12T19:56:43.000Z

Okay then, I can skip the entire chrome step?

essexboy · 2015-08-12T19:57:21.000Z

Yes but do not start Chrome at all otherwise it may try to download something

system · 2015-08-13T13:07:48.000Z

Here is the new log.

essexboy · 2015-08-13T13:31:55.000Z

OK it looks as though the malware has locked those keys

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-08-13T18:22:52.000Z

Okay, I ran the program. Here is what came up.

Also, the computer runs much better than it was before thanks to your help. The only thing is, it does not open avast still. Also the chrome installer seems to still be left over. It gives me the error I quoted in a previous post.

essexboy · 2015-08-13T18:42:52.000Z

OK lets now try a different way of removing the reg keys

Copy the following to a notepad file
Select save and set the file type to all files
Save it as IFEO.reg
Save it to the desktop, then right click the file and select run as administrator
Accept the warnings and reboot

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options]

[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

THEN

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: C:\Program Files\Google C:\Users\Little Wonders\AppData\Local\Google RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

Could I then have a fresh FRST scan please

system · 2015-08-14T14:57:35.000Z

Attached is the fixlog for the second part. In the first step I wasn’t able to right click and run as administrator, instead I just clicked on it and then it gave a window saying it added keys to the registry.

system · 2015-08-14T15:03:51.000Z

Scan logs.

essexboy · 2015-08-14T15:10:41.000Z

Nope that did not work either

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-08-14T15:49:17.000Z

I had the combofix already downloaded as per the previous posts. But here is the scan log.

essexboy · 2015-08-14T16:49:17.000Z

OK lets see if CF can kill it

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:

File:: c:\users\Little Wonders\AppData\Local\TempTaskUpdateDetectionEDE0E6CD-9309-4A7E-83AD-298C9D7C681C
Folder::
c:\users\Little Wonders\AppData\Local\TempTaskUpdateDetectionEDE0E6CD-9309-4A7E-83AD-298C9D7C681C

Registry::
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\avastSvc.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\avastUI.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\tapinstall.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\VisthAux.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastSvc.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe]

Save this as CFScript.txt, in the same location as ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

system · 2015-08-17T13:52:19.000Z

Here is the latest.

essexboy · 2015-08-17T14:05:25.000Z

Could you fully uninstall Avast using the removal tool please

Avast Uninstall Utility

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

Reboot once done

Then

Copy the following to a notepad file
Select save and set the file type to all files
Save it as IFEO.reg
Save it to the desktop, then right click the file and select run as administrator
Accept the warnings and reboot

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options]

[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

Finally

Could I have a fresh FRST scan
Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

system · 2015-08-17T15:56:37.000Z

Updated attachments.

essexboy · 2015-08-17T16:07:45.000Z

That worked

Avast should install now

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-443951736-1583617210-2315430799-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION FF Extension: No Name - C:\Users\Little Wonders\AppData\Roaming\Mozilla\Firefox\Profiles\fanljv6v.default\extensions\_qvxbkbnnuzqukzjj_i@frnhpojlbr_in.com [not found] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found] S3 catchme; \??\C:\ComboFix\catchme.sys [X] 2015-08-14 10:45 - 2015-08-17 11:48 - 00000246 _____ C:\Users\Little Wonders\Desktop\IFEO.reg 2015-08-13 13:58 - 2015-08-17 11:34 - 00000000 ____D C:\Qoobox RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-08-17T18:30:14.000Z

Here is the log. Ill try avast soon.

system · 2015-08-17T18:49:06.000Z

That surely did it. Thank you very much essexboy. I imagine you are a blessing to these forums.

Announcements