[CompCav]

See if the log completed here:

f the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date and the time of the tool run.


If not please re run it.

[Bob_C]

Lots of error messages upon reboot from Microsoft. Then a blue screen dump screen. OTL did have a folder. Nothing was in it. Ran OTL again but it is now hung up again. It's stalled at a different place apparently but the description has AVG references again. I have a new copy of AVG removal on a thumb drive. I fear force quitting but it appears that's all that's left to do? I have access to another computer down the block. I also have this little telephone to work from. I am confused. Thoughts as to where to go from here? I'm sure you'll need to have dinner soon or whatever based on your time zone. I'm willing to stick with it. Please advise.

[Bob_C]

My computer is rebooted and acts normal for a tiny bit. Firefox crashes quickly though. A very short OTL log did appear on the C drive folder. I've tried to paste it for you but Firefox crashes. I'll copy it by hand on this teeny telephone.
Files\Folders moved on reboot...
File move failed, C\ Program files\ Common files\AVG secure
Search\ Site safety installer\11.0.2\np site safety.dll scheduled to be moved on reboot.
Registry entries deleted on reboot...

That's all it said. By the way, the AVG Icon is gone from the tray.
Let me know if we should continue this today or continue this tomorrow.

[Bob_C]

Should I turn off Avast off when running any of these fixes or scans?

[CompCav]

Please disconnect the computer from the internet temporarily and then turn off avast and rerun the OTL fix and malwarebytes'

Post the logs after turning avast back on and then connecting to the internet.

[Bob_C]

Back to using the telephone. OTL is hung up at the same place as last time. Maybe I have copied your commands incorrectly that I inserted in the custom scan box. Should I try to do just do a scan only without custom fixes? Anyway the OTL won't work and is hung up.

[CompCav]

You should not be pressing the Scan button you should be pressing Run Fix

Here is a sure fire way to do it!

Note: If you have Malwarebytes 1.6 or higher installed please disable it for the duration of this fix as it may interfere with the successfully execution of the script below. If it still hangs then please uninstall MalwareBytes' and run this fix again.

Please download the attached file named fix.txt to your desktop.  fix.txt (2.8K)
Number of downloads: 5


• Please reopen on your desktop.
  
• Click Run Fix
  
• Click OK to load it from a file
  
• A dialogue box will open select for Look in: your Desktop
  
• Click Open and it should now be in the customscans/fixes box
  
• Push again.
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click the OK button.
  
• A report will open. Copy and Paste that report in your next reply.
  
• If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date and the time of the tool run.

[Bob_C]

Back on telephone. Tried to delete malwarebytess prior to OTL fix. Malware bytes appears corrupted too and won't uninstall. Ran the fix as you instructed, and it's hung up at "processing 034-hklm boot execute, etc. avgrsx.exe is mentioned at the location where it hung up again. Grrrrr.

[CompCav]

OK replace the fix.txt you have on your desktop with this one and rerun the OTL fix:
 fix.txt (2.57K)
Number of downloads: 7

[Bob_C]

It ran. I think my MalwareBytes is totally corrupted. I do have a new copy I could install on my desktop. I found this log in C drive under OTL. I think it is the one I just ran.
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-515967899-583907252-839522115-1004\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}\ not found.
Prefs.js: "AVG Secure Search" removed from browser.search.defaultenginename
Prefs.js: "AVG Secure Search" removed from browser.search.selectedEngine
Prefs.js: false removed from browser.search.update
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin\ not found.
File move failed. C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\\npsitesafety.dll scheduled to be moved on reboot.
File C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\bing-zugo.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ not found.
File C:\Program Files\AVG\AVG2012\avgdtiex.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
File C:\Program Files\AVG\AVG2012\avgssie.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AVG_TRAY not found.
File C:\Program Files\AVG\AVG2012\avgtray.exe not found.
C:\Documents and Settings\Bob\Application Data\AVG\Track Eraser folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\Rescue\PC Tuneup 2011 folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\Rescue folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\PC Tuneup\User Reports folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\PC Tuneup\Logs folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\PC Tuneup folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG\BoostSpeed folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\Bob\Application Data\AVG2012 folder moved successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\AVG folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\skin folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\zh-tw folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\zh-cn folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\tr folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\sr folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\sk folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\ru folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\pt-br folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\pt folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\pl folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\nl folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\ms folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\ko folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\ja folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\it folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\id folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\hu folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\fr folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\es-es folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\es folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\en folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\de folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\da folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale\cs folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules\locale folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\modules folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\locale\en-US folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\locale folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\components folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9\chrome folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.0.0.9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG Secure Search folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ToolBandTlb\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ToolBandTlb folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller\11.0.2 folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search\CommonInstaller folder moved successfully.
C:\Program Files\Common Files\AVG Secure Search folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\update\prepare folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\update\download folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\update\backup folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\update folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Temp folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\SetupBackup folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\scanlogs folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\lsdb\prev folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\lsdb folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\log folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\profile folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\8 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\7 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\6 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\5 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\4 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\3 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\2 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\1 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox\0 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\outbox folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\malwareprofile folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\download folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS\config folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\IDS folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\fet folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\EMC folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Dumps folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Chjw\e218b95718b92c03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Chjw folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Cfg folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\avgam folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\Antispam folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012\admincli folder moved successfully.
C:\Documents and Settings\All Users\Application Data\AVG2012 folder moved successfully.
C:\WINDOWS\System32\drivers\AVG folder moved successfully.
Folder C:\Documents and Settings\All Users\Application Data\AVG Secure Search\ not found.
Folder C:\Documents and Settings\All Users\Application Data\AVG2012\ not found.
C:\Documents and Settings\All Users\Application Data\avg9 folder moved successfully.
Folder C:\Documents and Settings\Bob\Application Data\AVG\ not found.
Folder C:\Documents and Settings\Bob\Application Data\AVG2012\ not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Bob\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Bob\Desktop\cmd.txt deleted successfully.
========== REGISTRY ==========
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Bob
->Temp folder emptied: 8375709 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 16868304 bytes
->Flash cache emptied: 456 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 258713 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1194799 bytes

Total Files Cleaned = 26.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.43.1 log created on 05262012_201718

[CompCav]

Finally success way to hang in there

Try MalwareBytes' and if it does not work please do this:

Step 1.

Click on Start and select Control Panel
Open Add/Remove Programs
Uninstall Malwarebytes' Anti-Malware
Restart your computer very important
Download and run mbam-clean.exe from here
It will ask to restart your computer, please allow it to do so very important


Step 2.

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application. Please do not accept the trial right now. We just want to run it on demand.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish, so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[Bob_C]

I'll post the mbam log, but I'm not sure we should trust it. Two reasons I'm skeptical. When I tried to uninstall it said that the database was missing; did I want a new copy? I said no over and over again. I finally had to go to ctr/alt/delete to make it stop. I ran the mbam clean up anyway. I installed the new version. It also said that the data base was missing when I ran it. This time I said "yes" when it asked if I wanted a new copy. It installed a familiar MalwareByte application, updated and opened as desired. I ran the scan which found no malicious items. OF NOTE: an old application called Log Me In opened suddenly. It was an application that a tech installed in case he needed to work remotely with me. He's since out of business. I closed the Log Me In sudden appearance.
So, because of the balky uninstall/install and because of the weird appearance of Log Me In, I'm skeptical.
Also, the second I opened Firefox, to send this to you, it crashed with it's dreaded "Send A Report" request. Anyway, I reopened Firefox and so far I can write this long reply.
Here's the log
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.27.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Bob :: BOB-3CDE5CE5327 [administrator]

5/26/2012 8:54:45 PM
mbam-log-2012-05-26 (20-54-45).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 183946
Time elapsed: 3 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[Bob_C]

I'm starting to fatigue. I had to force quit out of a bluescreen since I last wrote. Had to experience both MS and Firefox crash-report dialogue boxes. And yet, here I am writing online as if nothing happened. So there's still something going on, huh? I wonder if it's a nasty virus-like deal or simply something wrong with the registry that happened who-knows-why. Anyway, I'll check back in a bit, but may need to find a stopping point and pick this up again tomorrow, if you're around on a Sunday.
If we make some radical progress tonight, I'll see it through, but if a stopping point is reasonable, let me know. Thank you for all of the attention today. This has been a bit of an ordeal, huh??

[Bob_C]

Back on my phone again. Keep getting bumped off when I use my desktop to log onto the forum. I'll check back in the morning and see if there's a reply. Again thank you for all the attention today. But I'm off to bed.

[CompCav]

Try booting into safe mode with networking and see how it behaves.

Also rerun MalwareBytes' there and finally try ti run the AVG remover in safe mode.