My wifes computer was infected with the “windows security essentials” trojan. I ran malwarebytes and removed what I could find. I uninstalled Avast using the unistaller and rebooted several times in regular and safe mode.
When i try to install the new version a message pops up mid installation saying:
Setup has detected another program that requires your computer to reboot. You must reboot the computer before installing avast. Once the system is rebooted, you must restart setup. If you continue avast may not work correctly.
I have tried to reboot and i get the same message. I have continued and installed and Avast does not operate.
Uninstall avast from Control Panel (if possible). If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after that.
Run the avast! Uninstall Utility saved on 1. If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after you’ve run it.
Install avast! using the setup saved on 2. Boot.
Register your free copy or add the license key for Pro.
Check and post the results.
Then I suggest:
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, it is better and safer to send the infected file(s) to quarantine (Chest), rather than simply deleting them.
I wonder if you still have remnants of the Windows Security Essentials Fake. Have you tried Malwarebytes, SuperAntispyware or DrWeb CureIT that were recommended by Tech? Make sure that they are fully updated before scanning. You may still have registry entries of WSE Fake.
Have you tried running MSCONFIG to see what programs are starting up? Are there any programs starting that you do not recognize?
Yes, I have run malwarebytes quite a few times in safe mode with networking. I will download and run spyware dr. and drweb cureIT and will post with my findings.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:11:48 PM, on 11/7/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17091)
Boot mode: Safe mode with network support
If you need to post a log, please use the attachment feature of the forum post so that your posts are not too long and as public. How to make an attachment: While in the post page > Additional Options > Attach > Browse > Post. This is especially true for Dr.WebCureIt and any OTL logs (which I suggest → you can find here: http://forum.avast.com/index.php?topic=53253.0 under the first post from our certified malware expert, Essexboy.
If using CCleaner, there is a Slim version available as well at http://www.piriform.com/ccleaner/builds - 4th option down. If you download the regular version and you do not do a Custom Install, you will accidentally download adware (Ask_Toolbar) if you are not watching what you click as you install. :o The Slim version does the same thing without the toolbar.
Just to confirm, you did run these for the Avira uninstaller:
If you are running the Avira or any other security uninstaller tool, you should try a repair of Avast first, If this fails, then uninstall/clean install of Avast needs to be done.
I ran Malware a couple more times, in different modes, found one more infected file after running in normal mode. I got the same popup when I tried to install Avast! again I got the reboot notification, but I installed Avast! anyways… started it up and it actually started to run! Ran a full scan, and then a boot-time scan with nothing found. Doing some CCleaner now and hopefully I’ll be all set. Thanks for the help guys, it was instrumental at getting this thing back up and running.
When you ran MBAM or Avast scans and you found something (infection/virus), did you quarantine it or put it in the Virus Chest or do anything else with it?
If you still got the pop-up on installation, even though things appear to be working, my concern is that you still have something (malware) hidden inside your machine.
Had you uninstalled the previous AV’s prior to installing Avast?
Did you run Dr.WebCureIt, and what were the results? How about OTL?
Did you update your software? Here is an easy way to update your software with the free Senunia Software Inspector: http://secunia.com/vulnerability_scanning/personal/ - it will give you the vendor’s direct download link making it easy to install patches if needed. Many of us scan our machines weekly since software changes so often.
Does your machine appear to be running/acting normally?