Latest version of Avast, just doesn't open. 

essexboy · 2015-08-13T13:31:55.000Z

OK it looks as though the malware has locked those keys

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-08-13T18:22:52.000Z

Okay, I ran the program. Here is what came up.

Also, the computer runs much better than it was before thanks to your help. The only thing is, it does not open avast still. Also the chrome installer seems to still be left over. It gives me the error I quoted in a previous post.

essexboy · 2015-08-13T18:42:52.000Z

OK lets now try a different way of removing the reg keys

Copy the following to a notepad file
Select save and set the file type to all files
Save it as IFEO.reg
Save it to the desktop, then right click the file and select run as administrator
Accept the warnings and reboot

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options]

[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

THEN

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: C:\Program Files\Google C:\Users\Little Wonders\AppData\Local\Google RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

Could I then have a fresh FRST scan please

system · 2015-08-14T14:57:35.000Z

Attached is the fixlog for the second part. In the first step I wasn’t able to right click and run as administrator, instead I just clicked on it and then it gave a window saying it added keys to the registry.

system · 2015-08-14T15:03:51.000Z

Scan logs.

essexboy · 2015-08-14T15:10:41.000Z

Nope that did not work either

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-08-14T15:49:17.000Z

I had the combofix already downloaded as per the previous posts. But here is the scan log.

essexboy · 2015-08-14T16:49:17.000Z

OK lets see if CF can kill it

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it:

File:: c:\users\Little Wonders\AppData\Local\TempTaskUpdateDetectionEDE0E6CD-9309-4A7E-83AD-298C9D7C681C
Folder::
c:\users\Little Wonders\AppData\Local\TempTaskUpdateDetectionEDE0E6CD-9309-4A7E-83AD-298C9D7C681C

Registry::
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\avastSvc.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\avastUI.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\tapinstall.exe]
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options\VisthAux.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastSvc.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avastUI.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tapinstall.exe]
[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe]

Save this as CFScript.txt, in the same location as ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

system · 2015-08-17T13:52:19.000Z

Here is the latest.

essexboy · 2015-08-17T14:05:25.000Z

Could you fully uninstall Avast using the removal tool please

Avast Uninstall Utility

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

Reboot once done

Then

Copy the following to a notepad file
Select save and set the file type to all files
Save it as IFEO.reg
Save it to the desktop, then right click the file and select run as administrator
Accept the warnings and reboot

Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\image file execution options]

[-HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

Finally

Could I have a fresh FRST scan
Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

system · 2015-08-17T15:56:37.000Z

Updated attachments.

essexboy · 2015-08-17T16:07:45.000Z

That worked

Avast should install now

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-443951736-1583617210-2315430799-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION FF Extension: No Name - C:\Users\Little Wonders\AppData\Roaming\Mozilla\Firefox\Profiles\fanljv6v.default\extensions\_qvxbkbnnuzqukzjj_i@frnhpojlbr_in.com [not found] FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [not found] S3 catchme; \??\C:\ComboFix\catchme.sys [X] 2015-08-14 10:45 - 2015-08-17 11:48 - 00000246 _____ C:\Users\Little Wonders\Desktop\IFEO.reg 2015-08-13 13:58 - 2015-08-17 11:34 - 00000000 ____D C:\Qoobox RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-08-17T18:30:14.000Z

Here is the log. Ill try avast soon.

system · 2015-08-17T18:49:06.000Z

That surely did it. Thank you very much essexboy. I imagine you are a blessing to these forums.

essexboy · 2015-08-17T19:08:23.000Z

That were a bugger to kill, it seems as though the fix needed to be done in the right sequence…

Any further problems before I tidy up ?

system · 2015-08-18T13:23:38.000Z

Nope that’s quite fine. Thanks for your help.

essexboy · 2015-08-18T13:45:21.000Z

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe

system · 2015-08-18T15:16:38.000Z

Much thanks. Ill just uninstall java. Can you tell me a little about what you were doing? You were editing scripts to run and remove things? Just curious, I’d like to learn about the process myself…or if you could recommend how to learn to do so.

essexboy · 2015-08-18T16:20:58.000Z

What it was is that we hit a loop where I was trying to remove the malware and it still had something to latch on to
So I had to break the circle, that entailed removing the main bad file from quarantine and deleting it totally. That then allowed me to remove the keys and get Avast up and running

http://www.geekstogo.com/geeku/

system · 2015-08-18T19:01:29.000Z

Excellent. Thanks for the link as well.

Announcements