PC no longer boots up -- Avast related?

Avast Free Antivirus / Premium Security
1

My PC was recently updated (by a family member) to Windows 10 and has been working fine for a few weeks. Over the weekend, an Avast (free version) message indicating that it had found and deleted a virus came up (I don’t have the exact message, but it looked legit FWIW). Regardless, the next time I powered up the machine it wouldn’t boot up and gave various options for repair (system restore, PC reset, etc.). I tried the system restore using all of the date/time stamps listed, but to no avail. The PC Reset also didn’t work.

The one clue that came up while attempting the second system restore was the following message:

System Restore failed to replace the file (D:\Program files\AlwilSoftware\Avast5\Setup\prod-vps.vpx) with its original copy from the restore point. An unspecified error occurred during system restore. (0x80070002)

Any thoughts on how to move forward here? Perhaps the version of Avast being run isn’t compatible with Windows 10. It’s hard to know what to do when the computer won’t even boot up.

Thanks in advance for any help.

2

We need to get to get to the command prompt, is that one of the options available to you ?

If so then :

Download Farbar Recovery Scan Tool x64 and save to a USB drive

Insert the USB and access the command prompt

At the command prompt type the following :

https://dl.dropbox.com/u/73555776/notepad.JPG

The notepad opens. Under File menu select Open.
Select “Computer” and find your flash drive letter and close the notepad.
In the command window type e:\frst64.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please attach it to your reply.

3

Thanks, I’ll try this out and see what happens.

4

I ran the frst64.exe program as requested and have attached the frst.txt.

Thanks again for your help.

5
S5 t; <===== ATTENTION: Locked Service S5 ; <===== ATTENTION: Locked Service
This appears to be the problem, Have you tried to run refresh http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html
6

Thanks, Essexboy. I had tried option one in this http://www.tenforums.com/tutorials/4090-refresh-windows-10-a.html to reset the PC previously, and tried again, receiving the same message (after only a few minutes):

“There was a problem resetting your PC. No changes were made.”

FYI… I never get prompted to ‘Insert Media’.

I unfortunately can’t try option 2 in those instructions because I can’t get past the boot screen.

Any other thoughts on what I can do?

7

Unfortunately my tools are not strong enough to remove those entries

You could try this

Create an emergency repair USB drive:
Download Dr Web Live USB to your desktop

[]Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
[]Launch drwebliveusb.exe.
[*]The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).

https://dl.dropbox.com/u/73555776/liveusb_ru.jpg

[]To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
[]Files will be copied automatically.
[]Once the copying process is completed, press the Exit button to close the application.
[]Reboot the infected computer with the USB in the drive
[]Ensure that the first boot device is USB - If you are not sure about that then see this page for instructions
[]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

https://dl.dropboxusercontent.com/u/73555776/Live%20boot%20screen.png

[*]Use arrow keys to select DrWeb-LiveCD (Default)

https://dl.dropboxusercontent.com/u/73555776/drwebselect.JPG

[*]Press select objects for scanning

https://dl.dropboxusercontent.com/u/73555776/drwebfolders.JPG

[*]When the system is loaded, check the disks or folders you want to scan, and click on Start.

[*]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so

https://dl.dropboxusercontent.com/u/73555776/drwebscan.JPG

[*]When it has completed

https://dl.dropboxusercontent.com/u/73555776/drwebscancomplete.JPG

[]Select Open Report and copy to the USB
[]Once completed reboot to normal windows, and attach the report here

8

I will have to find another computer to do this on as my work PC won’t allow me to run this drwebliveusb.exe file, unless I can run it from the USB on the problem computer?

9

Yes, create the USB on a serviceable system and then run on the affected one

10

Hi, I followed the instructions – had to borrow a friends computer to run the .exe, and was able to run the Dr Web Live USB on the impacted PC (it ran for 23 hours). However, after running it there was no prompt to save the log and I couldn’t find the log even after using the help to tell me where it was located. I was able to at take a pic at the end of the scan but the file was too large to attach, So I’ve typed out what it showed I’ll try further to find the log.

Unfortunately, not all detected threats were neutralized.
Dr. Web CureIt! was unable to neutralize all detected threats

Threats detected: 13
Threats neutralized: 7

Object Threat Action Path
Hosts Probably DFH:HOS… Cured g:\windows\system32\drivers\etc\hosts

SafeBoot Probably DRH:SafeB… Cured HKLM\SYSTEM\ControlSet001\Control\SafeBoot
Bitguard.exe, De… Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows NT\Curre…\bitguard.exe, Debugger
Bprotect.exe, De… Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows NT\Curre…\bprotect.exe, Debugger
Browserdefender Probably DRH:IFEO… Cured HKLM\Software\Microsoft\Windows…\browserderender.exe, Debugger
Browserprotect Probably DRH:IFEO Cured HKLM\Software\Microsoft\Windows N…\browserprotect.exe,Debugger
Winlogon, Userinit Probably DRH:User1 Cured HKLM\SOFTWARE\Wow6432Node\Microsoft\Wind…\Winlogon, Userinit
JuniperSetupXP… Infected container Move error G:\Documents and Settings\Thom\AppData\Roa…\JuniperSetupXP.exe
DatamngrUI.exe Adware.Bandoo.244 Move error G:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe
DatamngrCoordin Adware.Bandoo.244 Move error G:\Program Files (x86)\Movies Toolbar\Data…\DatamngrCoordinator.exe
JuniperSetupXP… Infected container Move error G:\Users\Thom\AppData\Roaming\Juniper Netwo…\JuniperSetupXP.exe
JuniperSetupXP… Infected container Move error G:\Users\Thom\Application Data\Juniper Network…\JumiperSetupXP.exe
CouponPrinter.ocx Adware.Coupons.44 Move error G:\Windows\CouponPrinter.ocx

11

The only other option is to try a regback

Download the attached fix list to the same location as FRST
Start FRST and press fix
On completion try a normal boot

12

I copied that .txt file to the flash drive, and went through the steps again.

This was the fixlog:

Fix result of Farbar Recovery Scan Tool (x64) Version:09-05-2016
Ran by SYSTEM (2016-05-16 09:07:09) Run:1
Running from j:
Boot Mode: Recovery

fixlist content:

LastRegBack: 2016-05-01 12:04

DEFAULT => copied successfully to System32\config\HiveBackup
DEFAULT => restored successfully from registry back up
SAM => copied successfully to System32\config\HiveBackup
SAM => restored successfully from registry back up
SECURITY => copied successfully to System32\config\HiveBackup
SECURITY => restored successfully from registry back up
SOFTWARE => copied successfully to System32\config\HiveBackup
SOFTWARE => restored successfully from registry back up
SYSTEM => copied successfully to System32\config\HiveBackup
SYSTEM => restored successfully from registry back up

==== End of Fixlog 09:07:30 ====

Now it appears that the machine has booted normally. Thank you very much. What other actions (if any) should I take with regard to avast (was this problem really avast related?) to avoid this happening in the future?

13

I do not believe it was Avast related except that it may not have cleanly removed the malware

If you wish I can take a look to see what is present

14

Sure, if you are able to check, that would be great. What information do you need from me in order to do so?

15

Lets start easy :slight_smile:

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

16

Thanks, essexboy. The logs are attached.

17

Let me know of any problems after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: IFEO\bitguard.exe: [Debugger] tasklist.exe IFEO\bprotect.exe: [Debugger] tasklist.exe IFEO\browserdefender.exe: [Debugger] tasklist.exe IFEO\browserprotect.exe: [Debugger] tasklist.exe BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKU\S-1-5-21-3047490936-217768153-4051942873-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-3047490936-217768153-4051942873-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File 2010-11-09 22:13 - 2010-11-09 22:13 - 0000006 _____ () C:\Users\Thom\AppData\Roaming\completescan 2010-11-09 22:09 - 2010-11-09 22:09 - 0000010 _____ () C:\Users\Thom\AppData\Roaming\install 2010-11-09 22:03 - 2010-11-09 22:03 - 0000175 _____ () C:\Users\Thom\AppData\Roaming\ssdfsfs.bat 2010-11-09 22:03 - 2010-11-09 22:03 - 0000000 _____ () C:\Users\Thom\AppData\Local\Llesoqa.bin 2010-11-09 22:03 - 2010-11-09 22:03 - 0000120 _____ () C:\Users\Thom\AppData\Local\Ysexa.dat 2012-01-19 22:50 - 2012-01-19 22:50 - 0000000 _____ () C:\Users\Thom\AppData\Local\{53B116C0-6E6D-48D6-A470-31320CA96E00} 2011-10-23 08:48 - 2011-10-23 08:48 - 0000000 _____ () C:\Users\Thom\AppData\Local\{B92AE9D4-797D-4B28-BD89-D6C6D4759BF2} CustomCLSID: HKU\S-1-5-21-3047490936-217768153-4051942873-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Thom\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File CustomCLSID: HKU\S-1-5-21-3047490936-217768153-4051942873-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Thom\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

18

fixlog is attached; thank you.

19

Are you experiencing any problems ?

20

Sorry, had separate long issue with internet connection. As far as I can tell, there are no additional problems. Thanks again for your help, essexboy.