Can't get AVG to work

[thefonz]

 >:(Every time I download AVG and get to the set up it says the file is corrupted.  I reformatted my XP home edition with 387 MB 1.20 cache speed.

Before today I did have AVG working I thought but it would go bad and I would have no protection.  In fact I thought it was automatic that it would update periodically during the day so I would anywheres from 29MB to 50MB downloading of updates.  But I would be doing this all day.  I would gladly try another, I did with AVAST but I would get that blue ball with the red slash so then I would not be protected.  So, any advise would be appreciated.

[soybean]

Before today I did have AVG working I thought but it would go bad and I would have no protection. 

What do you mean by "it woud go bad"?

In fact I thought it was automatic that it would update periodically during the day so I would anywheres from 29MB to 50MB downloading of updates.  But I would be doing this all day. 

  So, you think AVG would normally download 29MB to 50MB of updates daily?  Where did you get that notion?

I normally see AVG updating in my system when I first startup in the morning.  I normally see no signs of subsequent updates throughout the day; and, a typical daily update is not going to be anywhere near 29MB to 50MB.  Of course, a search for updates can be manually initiated any time via the AVG user panel but I normally don't do that.

[thefonz]

Thats just it.  I set it for 8:00 a.m. but it wont start so I have to manually do a scan.

[soybean]

... have to manually do a scan.

Oh, now you're talking about scanning, not downloading updates or installing?  Can you clarify exactly what your question/problem is?   

[thefonz]

Look, I have used avg 7.5 for a few years and it was totally automatic from auto scanning to updating.  With the 8.0 it really I suppose should be the same but at 8:00 am no scan so I go and manually do it.  As far as updating after the scan I would update and fine.  But doing the day I would get the red shield with the x and I would go and click the avg icon and it showed that everything except email and sometimes email was off.  I would click update and woh a huge update and then I would have to rebot.  A few times a day I would do this.

thefonz

[Broni]

1. There is no reason to scan your computer every day. Waste of time, and resources.
2. AVG 8.0 has been having a lot of problems from get go.
3. Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
Click on Download HijackThis Installer
Post HijackTHis log.

[thefonz]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:04 AM, on 10/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

--
End of file - 1619 bytes

[Broni]

This is either partial log only, or it's partial, because your computer is infected.
Rename hijackthis.exe to computerhope.exe, run it again, and post new log.

[thefonz]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:43:10 PM, on 10/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Outlook Express\msimn.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

--
End of file - 1702 bytes



Remember I just recently formatted so it is not very big.

[Broni]

You didn't rename it. It's still listed as HijackThis.exe

[thefonz]

I am so sorry, but I really do not know how to save the new scan to "computer hope.exe"  I have done HiJack scans many times and was never asked to rename the scan.

Do I click: scan and save to log
Do I click: just scan  (which I did and it did now completely save to "computer hope.exe"

It;s 9:16 pm my time I will wait for some take on this perhaps.

[Broni]

Open Windows Explorer.
Navigate to: C:\Program Files\Trend Micro\HijackThis folder.
Right click on HijackThis.exe, click "Rename".
Rename to computerhope.exe.
Double click computerhope.exe to run HJT.

[thefonz]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:33 PM, on 10/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\computerhope.exe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

HOW COME IT STILL LOOKS THE SAME>WHERE IS THE NEW NAME I TYPED?

DID I DO IT RIGHT?

--
End of file - 1664 bytes

[Broni]

I don't know, if it has anything to do with it, but you renamed HJT file to computerhope.exe.exe. One "exe" too many.
It should read computerhope.exe
Try again.

[thefonz]

This is really weird and and crazy this is what I did this is a screen shot.


But I will do it again!!!!!!!!!!

[Saving space - attachment deleted by admin]