Need fixlist for FRST - Avast Uninstall caused bluescreen

Viruses and worms
1

Hi,

I am an Avast Reseller and I recently uninstalled Avast Business Antivirus from my own Windows 7 Pro machine due to a license problem. After that the PC bluescreens after booting. The only way I can get in is through Repair Mode Command Prompt. I checked these forums and ran across the FRST from repair mode method of troubleshooting, but I am not familiar enough with it to write my own fixlist. I was hoping that there is a generic one that someone could send me or else that there is someone more familiar with FRST who could help me with it - or is there is a better way to go about this. I appreciate any help. The machine has a LOT of software and settings (no data) that I really dread recreating… FRST.txt attached.

2

FRST should produce two logs … see instructions, scroll dow to step 2 >> https://forum.avast.com/index.php?topic=194892.0

Have notified @Sass Drake, it may take hours before he is online

3

There isn’t an option when I run FRST to check the Additions.txt. No Additions.txt file is created on the flash drive from which I ran FRST. This is in Windows System Recovery Options Command Line, which is the only way I can get into the system, if that matters. Thanks.

4

Please wait until I analyze log.

5
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-08-28] (AVAST Software)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3820440 2016-04-21] (AVG Technologies CZ, s.r.o.)
S2 aswBcc; C:\Program Files\AVAST Software\Avast\bcc.exe [1087224 2018-08-28] (AVAST Software)
S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7780400 2018-08-28] (AVAST Software)
S2 Avast Business Console Client Antivirus Service; C:\Program Files\AVAST Software\Avast\bccavsvc.exe [2941656 2018-08-28] (AVAST Software)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [322464 2018-08-28] (AVAST Software)
S2 AvastAvWrapper; C:\Program Files (x86)\AVAST Software\Business Agent\AvastAvWrapper.exe [234544 2018-06-28] (AVAST Software)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3647384 2016-04-21] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [336152 2016-04-21] (AVG Technologies CZ, s.r.o.)
S1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [197160 2018-08-28] (AVAST Software)
S1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [229392 2018-08-28] (AVAST Software)
S0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [201328 2018-08-28] (AVAST Software)
S0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [346664 2018-08-28] (AVAST Software)
S0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [59592 2018-08-28] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46976 2018-08-28] (AVAST Software)
S2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [159640 2018-08-28] (AVAST Software)
S1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [111872 2018-08-28] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [85968 2018-08-28] (AVAST Software)
S1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1027728 2018-08-28] (AVAST Software)
S1 aswSP; C:\Windows\System32\drivers\aswSP.sys [463080 2018-08-28] (AVAST Software)
S2 aswStm; C:\Windows\System32\drivers\aswStm.sys [211160 2018-08-28] (AVAST Software)
S0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [381584 2018-08-28] (AVAST Software)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [315312 2015-12-16] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [299440 2016-01-13] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [296368 2015-12-16] (AVG Technologies CZ, s.r.o.)
S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [255920 2016-01-22] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [300464 2015-08-04] (AVG Technologies CZ, s.r.o.)
C:\Program Files\AVAST Software\Avast
C:\Program Files (x86)\AVAST Software\Business Agent
C:\Program Files (x86)\AVG\AVG2015
C:\Windows\System32\drivers\aswArPot.sys
C:\Windows\System32\drivers\aswbidsdrivera.sys
C:\Windows\System32\drivers\aswbidsha.sys
C:\Windows\System32\drivers\aswbloga.sys
C:\Windows\System32\drivers\aswbuniva.sys
C:\Windows\System32\drivers\aswHwid.sys
C:\Windows\System32\drivers\aswMonFlt.sys
C:\Windows\System32\drivers\aswRdr2.sys
C:\Windows\System32\drivers\aswRvrt.sys
C:\Windows\System32\drivers\aswSnx.sys
C:\Windows\System32\drivers\aswSP.sys
C:\Windows\System32\drivers\aswStm.sys
C:\Windows\System32\drivers\aswVmm.sys
C:\Windows\System32\DRIVERS\avgidsdrivera.sys
C:\Windows\System32\DRIVERS\avgidsha.sys
C:\Windows\System32\DRIVERS\avgldx64.sys
C:\Windows\System32\DRIVERS\avgloga.sys
C:\Windows\System32\DRIVERS\avgmfx64.sys
C:\Windows\System32\DRIVERS\avgrkx64.sys
C:\Windows\System32\DRIVERS\avgtdia.sys
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on USB flash drive
  • Run PC again in Recovery Mode
  • Run FRST and click on Fix
  • On your USB flash drive should be fixlog.txt. Attach it to your post.
6

Thanks for your help. Fixlog is attached. However, the machine is still bluescreening when trying to boot normally or into safe mode. Let me know if there is anything else we can do.

7

You probably need to create a fresh FRST log for @Sass Drake to look at

8

Here is the fresh FRST log.

9

Can you take a photo of bluescreen?

10

The board won’t let me post pic (too large) so here is a link.

https://www.dropbox.com/s/2uez1zcddh1rzy9/IMG_20180907_130215298[1].jpg?dl=0

11
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
HKLM-x32\...\Run: [Avast Business CloudCare] => "C:\Program Files (x86)\AVAST Software\Business Agent\AvastTrayApp.exe"
S2 AvgApiWrapper; "C:\Program Files (x86)\AVG\CloudCare\AvgApiWrapper.exe" [X]
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on USB flash drive
  • Run PC again in Recovery Mode
  • Run FRST and click on Fix
  • On your USB flash drive should be fixlog.txt. Attach it to your post.

This should remove last startup entries of Avast/AVG.

12

Attached is fixlog. Still bluescreening. I will post a fresh FRST in a minute. If there is anything else you can see, let me know. Otherwise, I am going to suck it up and do a fresh install next week.

I do appreciate your help.

13

Fresh FRST.

14

I’m afraid not. It seems that now only course of action is Windows reinstall. :-\

15

Ok. Thanks again for the help.