Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: yasrt on November 13, 2005, 11:56:00 PM
-
I had few day ago virus on file C:\WINDOWS\SysWOW64\svcnet and I delete it .
from this time when I right click on the AVAST and "start avast antivirus" I receive for few seconds only the gray windows but the application don't open.
I have xp 64 and avast home edition
Can you help me ? (sorry for my English..)
-
Try a repair of avast. Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and scroll down to Repair, click next and follow. You need to be on-line to do this.
If that doesn't work try, uninstall, reboot, install, reboot.
Not sure how this would effect xp64 bit OS, by all accounts the svcnet (.exe) is from the w32.ticbik worm (it may well have been detected under a different name by avast), but it may be worth checking if any of the other registry entries, etc. have been created.
W32.Tibick is worm info (http://securityresponse.symantec.com/avcenter/venc/data/w32.tibick.html)
-
I tried all of this (repair, uninstall,install, ) and I am still in the same point I also look for the registry change according to Semantic report but I don't have this values in my registry (maybe because it 64 version) do you have any idea ?
-
The values mentioned in the linked article wouldn't cause the problems you describe...
What exactly do you mean by "gray windows"?
If you manually start e.g. ashSimp2.exe from the avast! installation folder - does anything happen?
Can you open the On-Access control panel (leftclick on the avast! tray icon)?
-
1. The "gray window" is the windows with the LOGO and with the message about stating to check memory , appear for short time on the middle of the screen
2. I will try it few hours latter when I will be near this PC
3. Yes, I can open the On-Access control panel, and all of this part of the AVAST is looked working
-
The "gray window" is the windows with the LOGO and with the message about stating to check memory , appear for short time on the middle of the screen
This is the splash screen. You'll see if you run ashavast.exe in the avast folder. It's ok.
The problem is that after loading it, the main window should appear (ashSimple.exe for Home version and ashEnhcd.exe for the Pro version).
Did you try manually starting ashSimp2.exe ?
-
Yes I tried it now and it is work in this way
-
So, you can start ashSimp2.exe and ashSimpl.exe and the scanner window appears correctly; just if you run ashAvast.exe, nothing happens after the memory check is done?
If you disable the memory scan in program settings - does it help?
-
You are correct, I tried to disable the memory scan and than I succeed to open the simple user interface
-
If the memory scan is enabled - do you think it makes it till the end? I.e. does the window say something like "Memory scan finished - starting the main program" and then disappear, or does it disappear before that, in the middle of the memory scan?
Or, does it actually show any progress at all - maybe it doesn't even start the scan?
I'm trying to find out if it possibly crashes in the middle of the memory scan, possibly when scanning a specific item...
Is there anything in avast! log? (rightclick on the avast! tray icon, select Log Viewer and check the error categories)
One more thing - please try the following:
- on the first page of the program settings, check the option "Show results of Explorer Extension"
- now perform the following command in avast installation folder:
ashQuick.exe *STRT-MEM-SHORT
The quick scanner should appear and perform a scan equivalent to the one from the splash screen. Does the final statistics show correctly, or does it disappear as well?
Thanks!
-
I see the message "wait, please. testing operating memory and start up item..." and it disapeare after few seconds.
The error log is empty but the following lines appeared in the info log when I try to start the AVAST:
aswSplash - program run information: CaswAvastDlg::OnTimer() - Test memory started..
aswSplash - program run information: CaswAvastDlg::OnInitDialog() - timer is active.
About the command line - I did it and I saw the quick scanner screen, number of tested files: 0 , Tested files: initializing engine, please wait.. and after few seconds I receive Error message "scan was completed with error, The system cannot find path specified"
-
That's a mystery... I'll check the code tomorrow, but it's really strange.
Do you have the final build of WinXP x64, or is it possibly a beta?
-
Better testing:
<path>\ashQuick.exe "*STRT-MEM-SHORT"
Notice: the quotes...
-
Igor
I have the professional XP 64 bit edition, service pack1 with the last update - it is not BETA !
Tech,
I tried the new test and I saw the windows for few seconds till it disappeared. but I don't see the error windows
-
OK, my fault - the *STRT-MEM-SHORT argument should really be enclosed in quotes.
You say that in that case, the windows disappeared in a few seconds as well - is the option "Show results of Explorer Extension" really checked in program settings?
-
yes
-
OK... let's try some heavier weapons ;)
I have prepared a special version of one avast! module that logs some "debugging" information into a file. So, if it's not a problem, please do the following:
1. Make sure you are using the latest build of avast! (4.6.731). If not, invoke a program update first and make sure that the problem is still present.
2. Download this file (http://www2.asw.cz/~glucksmann/aswEngin.dll)
3. Go to avast! installation folder and rename the file aswEngin.dll to something else, e.g. aswEngin_.dll. It should be possible to do even when avast! is running. You can use the command
ren aswEngin.dll aswEngin_.dll
4. Copy the file you downloaded in point 2 to avast! installation folder (i.e. you have just replaced the aswEngin.dll file with a new version)
5. Now, invoke again the command ashQuick.exe "*STRT-MEM-SHORT"
6. Wait for the window to disappear.
During the scanning, the file C:\avast.log is created. When the scan is done, attach the file here, please - I'll take a look at it (you may have to rename it to .txt, I'm not sure if the board permits .log extension for attachments).
Then, you may rename the aswEngin.dll file back (i.e. delete the aswEngin.dll file and do ren aswEngin.dll aswEngin_.dll) - or simply invoke a VPS or program update and avast! setup will revert the file back itself (but it will ask for reboot).
Thanks!
-
The log is attached
-
Hmm, that's what I was afraid of :-\
The problem seems to be in the startup enumeration... which is quote a lot of code. It might be hard to find it - but it really seems like a bug.
I'll prepare another modified version of the module in a while (that will log the progress of this particular part of the enumeration).
Thanks for your help!
-
OK, I updated the file on web. Could you please download it again and do exactly the same as before? Hopefully it will get us closer to the problem location.
Thanks.
-
Any news on the last log, yasrt? I hope I could pinpoint the exact location of the problem from the log...
Thanks for your help!
-
I send it already yesterday to the mail address that you gave me
-
Try this file (http://www2.asw.cz/~glucksmann/aswEngin.zip), please.
Go to avast! installation folder, rename aswEngin.dll to something else (e.g. aswEngin.dl_) and extract the content of the archive to the folder.
I hope it should fix the problems.
-
OK , I test it and it work well , also with the problematic shortcut (startup adsl)
Thanks