[SOLVED] Remnant of an old Avast install blocking major Windows updates (current version: Windows 10, version 1803)

D

Draxynnic

Member
Joined
Oct 26, 2019
Posts
19
Thread transferred from bleepingcomputer at softwaremaniac's suggestion.

I was using Avast Antivirus up to last year, but when it reached a point where it was refusing to update (and Avast's support refused to give any assistance because I was using the free version), I removed it using the Windows uninstaller and replaced it with Bitdefender. (A couple of days after that I received a follow-up message that I should uninstall the program I had using the removal tool and replace it with the new version, but at that point I'd already switched, and was ticked off enough by the first response that I wasn't going to go back.)

It's since come to my attention that major Windows 10 updates have been failing. Enough of the smaller ones have been going through that I didn't notice the lack of updates, but the major updates from 1803 to 1809 and then to 1903 haven't gone through. I used the Windows 10 Update Assistant in order to try to get the update to happen manually, and I keep getting the message shown in the image below:

What needs your attention.jpg

Nothing in the links provided have proven to be useful. I've tried talking to Microsoft support, and they've reached the point of taking the nuclear option: a reinstall that involves removing all non-Microsoft programs. I've also tried cleaning the registry (both through CCleaner and through hunting for Avast-related registry entries using a registry finder and deleting them manually, although I've found some I'm not able to delete) and installing every version of Avast Antivirus I can find on their site and then removing it again using the removal tool.

I'm currently in the process of backing up as much as I can onto external storage so I don't need to redownload everything in the case of taking the aforementioned nuclear option, but in the meantime: does anyone have any recommendations of anything else that might be able to remove it so I can get Windows 10 updating properly again?

Addendum:

Running through the Windows Update Forum Posting Instructions:

Running the SFC scan (step 2) generated an error. Log file is attached.

Running SFCFix (step 4) caused SFCFix to crash. I've attached the output txt file, but it's probably not all that helpful on its own. A .dmp file was created and sent to the sysnative server, but I don't know if there's a copy on my system that I can attach for easier reference.
 

Attachments

Hello and welcome!

Thank you for creating the thread.

Please start with the following:

Step#1 - FRST Scan

1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Right-click FRST64.exe and click Run as Administrator to run it as administrator. When the tool opens, click Yes to disclaimer.
3. Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running (if not already checked).
4. Press Scan button.
5. It will produce a log called FRST.txt in the same directory the tool is run from (which should now be the desktop)
6. Please attach the log back here.
7. Another log (Addition.txt - also located in the same directory as FRST64.exe) will be generated Please also attach that along with the FRST.txt in your reply.
 
Step#1 - FRST Fix
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
1. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
2. Download the attached fixlist.txt and save it to the Desktop.
Note. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work (in this case...the desktop).
3. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
4. Press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
5. When finished FRST64 will generate a log on the Desktop (Fixlog.txt). Please post the contents of it in your reply.
 

Attachments

Fixlog attached. When I came back to my computer after setting it going, though, I had a message from my current antivirus that it had concluded that it was ransomware and blocked it - I unblocked it, but it's possible that the process hasn't run correctly.

(Yes, I do have anything that isn't easily replaced backed up.)
 

Attachments

I'll give it a try, but out of curiosity, I ran the SFC Scan, and it's still finding corrupt files.

Will report back once the update has succeeded or failed - if the latter, I'll run SFCFix again and if that doesn't work, I'll attach the new logs.
 
Yes, the SFC stuff is a known bug and bears no impact on the upgrade process.

If the process fails, please search your machine for the setuperr.log and attach that instead. No need to run anything.
 
Update failed with the same message.

Found two copies of setuperr.log which actually had contents: one in C:\Windows\Panther\NewOs\Panther, one in C:\Windows\System32\Logfiles\setupcln. I've renamed both so you can tell them apart and attached them.

There are also files with the name setuperr.log in C:\Windows and C:\Windows\Panther\UnattendGC, but both appear to be empty.

Searching is still underway, but the last half-centimeter of the progress bar on my system often takes a while and probably won't find anything new. If it does, I'll post whatever else it comes up with.
 

Attachments

Managed to disable the virus protection and do the scan that way - resulting logfiles are attached. If you think that it's likely to still be a problem even with it disabled, though, let me know and I'll kill it entirely and repeat.
 

Attachments

Got the same message again (which didn't surprise me - pretty sure I'd deleted that folder before and it was only there because of past attempts to solve it by installing and uninstalling, but it was worth a try in case what we'd already done had managed to help and that was the last thing Windows Update was objecting to).
 
Since the Installer is continually detecting Avast, I'm looking for any entries and deleting them from the machine as we go along.

FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste SearchAll: Avast into the Search box and click the Search Files button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named Search.txt.
 
Huh. That's weird...

Everything claims to have run successfully, but the SearchReg.txt (attached) doesn't seem to have found anything.

However, I've also got Registry Finder, since I suspected that the problem was a registry issue almost from the beginning, and doing a search on the 'Avast' keyword in the Registry Finder comes up with a LOT of results. Having trouble getting it to export the results in a useful form, but I've taken screenshots and included them in the attached .zip folder.
 

Attachments

I've edited the steps after you've executed them.

Let's try the following:

FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:

reg load HKLM\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste Avast into the Search box and click the Search Registry button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top