Unable to update my avira please help [Closed]

Report
-
Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
-
Hello,
i have a serious problem in updating my avira free anti virus, the last time i was able to update was in 5 February 2010 after that day and when i started update i have a message that says : " the updates are being downloaded", but after about a minute the updater disappears from the screen without installing any update. i tried to update many times but i still face the same problem. please i want your help to solve this problem. thanks in advance.

6 replies

Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
10,400
Hello Kareen,

Your machine may be infected by a virus which blocks antivirus.

You may try to uninstall and reinstall Avira but that would leave you without protection during the process.

Could you please download Hyjackthis and post a log here? We could then see what we can do.

You can download Hyjackthis from this site:

http://free.antivirus.com/hijackthis/

Run the application and from the main page request a scan and save a log. At end of the scan the log will open, copy the log and post it here.

Regards
Posts
2
Registration date
Sunday February 21, 2010
Status
Member
Last seen
February 23, 2010

hi thanks for your reply, the report: "Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 6:07:20 PM, on 2/21/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Avira\AntiVir Desktop\sched.exe
D:\Program Files\Avira\AntiVir Desktop\avguard.exe
D:\Program Files\Freedom Scientific\JAWS\9.0\jfw.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Freedom Scientific\JAWS\9.0\JHOOKLDR.EXE
D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
D:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe
D:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
D:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
D:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\msiexec.exe
D:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - D:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Real Alternative\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 D:\PROGRA~1\MYWEBS~1\bar\3.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DriverUpdaterPro] D:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "D:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZQfox000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9601C069-9724-4fca-94E9-3DC75B402FAA} - "D:\Program Files\Sakhr\Arabic Reading Machine\Net Reader\SakhrIEReader.exe" (file missing)
O9 - Extra 'Tools' menuitem: ?E??? ?E?C? - {9601C069-9724-4fca-94E9-3DC75B402FAA} - "D:\Program Files\Sakhr\Arabic Reading Machine\Net Reader\SakhrIEReader.exe" (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - D:\Documents and Settings\Sahar\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate1ca5af665a4162c) (gupdate1ca5af665a4162c) - Google Inc. - D:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: JFWService - Freedom Scientific BLV Group, LLC - D:\Program Files\Freedom Scientific\JAWS\9.0\jfw.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - D:\PROGRA~1\MYWEBS~1\bar\3.bin\mwssvc.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
10,400
Hello,

Here is the problem related to punkbusters:

D:\WINDOWS\system32\PnkBstrA.exe This a process that must be stopped.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) This a registry to be deleted.

Close any currently running games that use PunkBuster. Open the Windows Task Manager by pressing "Ctrl, "Alt" and "Delete" together. Click the "Processes" tab. Scroll down and click "Pnkbstra.exe." Click "End Process" to stop this program from running.

Click "My Computer" on the desktop and double click the "D:" drive. Double click "Users" and double click "Appdata."

Click Local > Punkbuster > WAW > Pb. Right click "Pnkbstra.exe" and click "Compatibility." Place a check on "Run this program as an administrator" and click "OK" to save the changes. This action will bring the program to the Services window.

Click the Windows Start > Run. Type "services" (without quotes) and press "Enter" to open the Services window. Scroll down the Services window and double click "PnkBstra" or "PunkBuster." Click "Disabled" on the "Startup-type" window and click "OK" to save changes. Punkbuster will be removed from start up and will no longer run.

Run a scan with Hyjackthis, once the scan is over, check this key

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Click on Fix checked, Hyjackthis will warn you that it is about to remove a BHO, tell it that you know what you are doing :)))

Finally, please download and install Malwarebyte and do an update

Do a FULL system scan

You may download it from this site:

https://ccm.net/download/download-105-malwarebytes

Then try updating Avira. If Avira updates and you believe that your computer is cleaned and working normally,

•Turn off system restore and wait 30 seconds,
•Turn it back on and create a new restore point.

This way it gets rid of anything bad that might have gotten saved in a restore point and you have a clean restore point to use in the near future if needed.
Do not turn it off until your computer is clean and working normally because you might need to use it if something goes wrong during the clean-up process.
It is better to go back to an infected restore point if something goes wrong then to not be able to undo changes that were damaging.

Let me know if this did the trick for you.

Best regards
Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
10,400
Hello Kareen,

How did you do?
Posts
2
Registration date
Sunday February 21, 2010
Status
Member
Last seen
February 23, 2010

hi, unfortunatly all the attempts to solve the problem have failed, i'm going to replace avira with another antivirus, which one you think is the better? thanks very much.
Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
10,400
Hello Kareen,

I am afraid that replacing Avira may not solve the problem.

1.Have succeeded in removing the Punkbuster process?

2. Where you able to delete the BHO?

3. Did Malwarebyte find anything?

If the above tasks were accomplished and that Malwarebyte did the job, before looking for replacing Avira, I would suggest that you uninstall and reinstall Avira.

If the Punkbuster process is still present you may have similar problems with another antivirus. So before installing another antivirus...

I suggest you run another scan with Hyjackthis and see if these two entries are still present as shown in your previous Hyjackthis log:

D:\WINDOWS\system32\PnkBstrA.exe
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

The following entry is considered to be adware and may cause pop-ups to appear while browsing. I hope that Malwarebyte picked it up.

If the above entries are still present, I suggest that we consider alternative solutions to remove them.

As I mentioned above, if your computer is cleaned of any malware, you just might need to uninstall and reinstall Avira. Should you wish to replace it, Kioskea has plenty of suggestions for you on this link:
https://ccm.net/download/security-4

Let me know your results and I will be happy to help you further.
Posts
47858
Registration date
Monday February 1, 2010
Status
Moderator
Last seen
October 22, 2020
10,400
Hello Kareen,

As I took another look at your Hyjackthis log, I thought of one more thing you can try for there may be a bug with your Microsoft System Installer. (MSIexec)

Please Kareen, try the following.

1. Click on start and then on run.
2. Type cmd and click ok

A window with a black background will open

3. Type
msiexec.exe /unregister
Press enter

4. Type
msiexec /regserver
Press enter

Try updating Avira

If Avira fails to update, please refer to this Microsoft tool to repair your MSI

https://support.microsoft.com/en-us/help/290301

Please let me know it this worked for you.

P.S. The above is withstanding my previous recommendation about the BHO entry and the possible risk with Punkbuster