[SOLVED] Error sfc /scannow

[Dexter23]

Hi everyone
I have a customer that has avast free antivirus installed was successfully removed from windows, but if i open cmd as administrator and run "sfc /scannow i get errors.
From my first analysis i see that the problem is caused by this component "Avast.VC140.CRT"
I attach the "scfdetails.txt"

 

[Maxstar]

Hi and welcome to Sysnative,

Upload your COMPONENTS hive.

• Navigate to C:\Windows\System32\Config and locate the COMPONENTS file.
• Please copy this file to your desktop.
• Note: If you receive an error that this file is in-use, simply reboot your computer and try again.
• Right-click on this file on your desktop and select Send To > Compressed (zipped) folder. This will create a file named COMPONENTS.ZIP on your desktop.
• If the file is too large to upload here, upload the file to www.wetransfer.com and post the link in your next reply.

 

[Dexter23]

Hi @Maxstar
I attach the file

 

[Maxstar]

Hi,

Step 1. Download the

Farbar Recovery Scan Tool and save it to your Desktop:

Download the 64 bit version: - Farbar Recovery Scan Tool Link

Warning: This script was written specifically for this system. Do not run this script on another system.

• Download the attachment fixlist.txt and save it to your desktop.
• Right-click on FRST.exe and select "Run as administrator".
• Press the Fix button.
• If for some reason the tool needs a restart, please make sure you let the system restart normally.
• When finished, a log called Fixlog.txt will appear in the same directory the tool is run from.
• Post the logfile Fixlog.txt as attachment in your next reply.

Step 2. Run the System File Checker and post the result. If it fails attach a new copy of the CBS log.

SFC /Scannow

 

[Dexter23]

Hi here

 

[Maxstar]

Great, let me know the result of SFC. If it fails attach a new copy of the CBS logs.

 

[Dexter23]

Hi @Maxstar
Now sfc /scannow complete without any errors.
How did you generate the fixlist file from the components file that I sent you?

 

[Maxstar]

Hi,

That's quite difficult to explain, but in short I've exported all the keys which are associated with Avast and created the REG-fix for FRST to remove all these remnants.

Are there any remaining issues?

 

[Dexter23]

No for the moment, but the components file is bynary file, what software do you used for extract data from the file?
Thx

 

[Maxstar]

You're welcome. And I've loaded the COMPONENTS file manualy into the registry with a random name like "TestCH" to inspect the hive file.

I will mark this thread as solved..

 

[Dexter23]

Ok thanks

 

[Maxstar]

This is a common problem with Avast/AVG for years, however there is no default fix to resolve this due to the different version numbers of the afftected keys. And that said even the official removal tool AvastClear is not able to fix this. Some additional information about this issue can be found in this public tutorial.

 

[Dexter23]

Ok @Maxstar
Thank you for sharing your knowledge