Install AVG 9: Computer doesn't boot in safe mode anymore

[pyromaster114]

Okay, so I installed AVG 9 on one of my computers that needed an anti-virus program.

I then attempted to boot it in safe mode to look at another problem.
It gets to the boot option menu, and I select Safe Mode and push enter.

It starts to scroll through the typical lines of text that it usually would while booting into safe mode... then it just shuts off completely and restarts.
I can hit F8 again and try again, but the result is always the same.

If I uninstall AVG I can boot in safe mode just fine.
As soon as I install it again, it refuses to boot in safe mode... although normal booting works just fine.

Any ideas? I've looked all over and some people seem to be having similar problems... but they haven't been able to solve any of them.

The computer in question is an emachine (yes I'm aware of the brand's shitty reputation) that's about a year old or so, running Windows XP Home Edition Service Pack 3.

 

[kimsland]

Uninstall AVG
Then run the AVG Remover: http://www.avg.com/filedir/util/support/avgremover_en.exe

Restart

Install Free Avira http://www.free-av.com/
Update it
Run a full scan

 

[pyromaster114]

So in other words the best solution, as proposed to me before but I am way to stubborn to accept it without trying to outsmart the problem in a more complex way, is to scrap AVG and use Avira?

Not a bad solution though... however still doesn't explain why on earth suddenly AVG prevents XP computers from starting in safe mode... I'd just love to know what those programmers did... actually let's not let anyone know because then some **** will write it into a virus.

 

[kimsland]

actually let's not let anyone know because then some **** will write it into a virus.

Um to late, that's the point

Because (horrible) AVG is so popular (god knows why, they must just advertise a lot) Anyway, because its so popular, malware makers have made Virus and Malwares to get around it
Running the much better (IMO) Avira will find these Malwares and remove them.

That's from my experience. I hope that other support members don't mind me posting from my own knowledge!

 

[pyromaster114]

I see your point.

I've been at this for much too long.... not thinking as clearly as I should be.
Anyways... proceeding with uninstall of AVG, install of Avira, etc.

 

[pyromaster114]

Interesting note:
The computer won't boot in safe mode with Avira installed either.

 

[kimsland]

So how did the full scan go?

Also here's an XP Safe Mode Repair: https://www.techspot.com/vb/post638518-2.html

 

[pyromaster114]

Full scan went fine. Found a few things, and supposedly fixed them.
I'm running the scan again to make sure it comes up clean.

Also going to run malwarebytes again to see if that does anything.

 

[kimsland]

>> Malwarebytes has just updated yesterday to a new version
Selecting "Update" within Malwarebytes program, will download the new version and update database

You really should be following this guide for malware removal though:
>> UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions

 

[pyromaster114]

Yes... taking short cuts seems to not be cutting it... no pun intended.
Running through the 8 steps again... currently on C cleaner.

 

[kimsland]

Hey we don't post this one normally (straight away)
But also run TFC http://oldtimer.geekstogo.com/TFC.exe
To clean out all temp files junk

And you never stated if the Safe Mode Repair reg file fixed Safe Mode or not ?

 

[pyromaster114]

Will run that too, right after C Cleaner finishes the second time.
No, unfortunately the safe mode repair thing didn't fix safe mode.

Another thing I thought of:
If the problem is being caused by malware that has infected a system file, if I were to do a repair install from the XP CD-ROM or something related to that... would it over-write the contaminated file, thus solving the problem?

 

[kimsland]

Yes And No

If the contaminated files are the files that will be removed by doing a Windows Repair, then they will be gone :grinthumb
But if the files are not removed, then they may even corrupt a Windows Repair, leaving you without being able to boot to any mode

Best not to do a Repair at this time (and definitely not a system restore)

 

[pyromaster114]

Alright well C cleaner has just finished it's second round. I'm moving on to the Malwarebytes scan... shortly followed by the SuperAntiSpyware.

Will post logs of those and hijackthis as I have them.

 

[kimsland]

No probs :grinthumb

But I'm logging off now

Most users/members provide the logs from Post#1 Oh well, you're getting there

 

[pyromaster114]

Well here are the results so far:

Installed Avira, did a full scan.
Found some viruses, infected files, etc. Cleaned them up nicely, and now the scan shows up clean.

Installed Ccleaner, did a full sweep.
It deleted some stuff. Did a full sweep again, it found very little to delete the second time around.

Exited Spybot S&D resident to ensure no interference.

Installed Malwarebytes, did a full sweep.
It found some stuff, and cleaned it up.
Did a quick scan, it found nothing.
Log files for both are attached.

Installed SuperAntiSpyware, did a full sweep.
Found nothing.
Log file is attached.

Checked Java... updated it and it checks out.

Installed Hijackthis, ran.
Log file is attached.

I don't get it.
Everything is checking out clean. (Well I haven't looked at the Hijackthis log very much)
Nothing seems to be infected anywhere. Everything seems to be good. I even cleaned off all the junky programs that were on there (like all the emachines crap and stuff that was on there when the thing was bought... all the things like weatherbug that people put on there... etc. It boots normally quick as anything too.)

 

[kimsland]

You can uninstall SUPERAntispyware (and ideally Spybot S&D too) now.

Please download Combofix from: https://www.techspot.com/downloads/5587-combofix.html (ideally to your Desktop) Don't run yet.

Please startup HJT Scan only, and check/tick the following entries
Before selecting FIX, make sure to close your Internet browsers (and spybots too)

R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\DOUG LAS CARLYON\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\DOUG LAS CARLYON\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O9 - Extra button: (no name) - {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - (no file)
O9 - Extra button: (no name) - {925DAB62-F9AC-4221-806A-057BFB1014AA} - (no file)

Close HJT



Double-click on the Combofix icon found on your desktop.

Please note, that once you start Combofix you should not click anywhere on the Combofix window as it can cause the program to stall.
When Combofix is running, do not touch your computer keyboard at all, it may take a few minutes (~10mins) for it to complete.

When finished, it will produce a logfile also located at C:\combofix.txt.
Attach

that log to your next reply

Restart (if Combofix has not already done this for you)
And also attach

a fresh HJT Scan log

 

[pyromaster114]

I Uninstalled Spybot and SuperAntiSpyware like you suggested.

Used Hijackthis to fix the entries you listed.

I clicked on Combofix, it instructed me to disable the Avira guard, I did so, and it continued.

Combofix is now running.

Will attach Combofix log file and a fresh Hijackthis log file momentarily when it completes.

Edit: files uploaded.

 

[kritius]

Safeboot repair key

http://download.bleepingcomputer.com/sUBs/SafeBootKeyRepair.exe

Run by double clicking on it or Right-click on it and click Open
Copy and paste the resultant log here in your next reply.

 

[pyromaster114]

kritius, here you go, file attached.

hmm...hope that didn't mess up kimsland was trying to have me do... (I wouldn't think so...)

 

[pyromaster114]

I have good news!
The computer is once again booting in safe mode! With the anti-virus software installed!

Now... what did it? (The great question :haha: )

 

[kritius]

What fixed it? The safeboot repair key fixed it.

Post the ComboFix log.

 

[pyromaster114]

Run again or post previous combofix log?

One before I ran safemode fix is in the post right before yours. (Check first page.)

Will run again if you think that would somehow benefit it.

 

[kritius]

Didn't see it as you had edited the post.

No need to run it again.

Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA tecnology to perform the scan. If you do not have the latest JAVA version, follow the instrutions below under Upgrading Java, to download and install the latest vesion.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure the following is checked.
   • Spyware, Adware, Dialers, and other potentially dangerous programs
     Archives
     Mail databases
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply.

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 16.
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u16-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Make sure the C:\Program Files\JAVA folder is removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u16-windows-i586.exe and select "Run as an Administrator.")

 

[pyromaster114]

Currently running Kaspersky Online Scanner.
It's updating it's database... -_-... looks like this is going to take a while lol.