Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on November 28, 2015, 10:35:00 PM

Title: An application is requesting access to a protected item
Post by: REDACTED on November 28, 2015, 10:35:00 PM
I've recently been seeing a Windows dialog window appear with the message "An application is requesting access to a protected item". The dialog window also contains an entry box to fill in a password, and a "Details" button. Clicking on the Details button displays:
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
This typically occurs once a day in the afternoon. Surprisingly this does *not* occur during the nightly scheduled full system scans.

Any ideas about how to address this or to find out what is the protected item that avastsvc is attempting to access would be most appreciated. This is really driving me nuts!

FYI I'm running Avast! Free 11.1.2241 with virus def 151127-0


               -jeff
Title: Re: An application is requesting access to a protected item
Post by: Eddy on November 28, 2015, 10:59:33 PM
Please attach a screenshot of it to your next post.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on November 30, 2015, 03:18:58 AM
This occurred again today at 3:33:00 PM EST. Applications that were running at the time were Chrome, Outlook Express and Windows Explorer. There is nothing in any of the event logs at or around 3:33pm. I was not at my computer at that time. Scheduled Tasks show nothing was scheduled to run during that timeframe.

The attached screenshots show:
av1: initial windows dialog
av2: after clicking on the "Details" button
av3: right-dragging the filepath to see the full filename
av4: after entering a bogus password in the initial window and clicking ok

Thanks for the help. Let me know if I can provide anything else.

                  -jeff
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on November 30, 2015, 03:39:37 AM
A bit more info: I noticed that at exactly 3:33:00pm Outlook Express was checking for new messages. I know this because today I set up Debut to do a screen capture video taking snapshots at 1 fps. I could see OE start the "authorizing" process when the dialog popped up at 3:33:00pm.
Title: Re: An application is requesting access to a protected item
Post by: Eddy on November 30, 2015, 09:38:01 AM
It seems to me that something on your system is accessing a file/application that avast wants to scan, but safeguard is blocking avast from doing its job.
Quote
I was not at my computer at that time
It could be a screensaver wanted to run, the system wanted to go into sleep-mode or something like that.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on November 30, 2015, 05:29:27 PM
Quote
It seems to me that something on your system is accessing a file/application that avast wants to scan, but safeguard is blocking avast from doing its job.
Agreed

Quote
It could be a screensaver wanted to run, the system wanted to go into sleep-mode or something like that.
I have no screensavers running and sleep-mode disabled. The computer is always on.

Obviously I need to find out what "protected item" avast is trying to access. Is there an avast log I can enable that records all it's real-time Active Protection file accesses? That might help. I could match up the time the popup occurs with the timestamp in the log. 
Title: Re: An application is requesting access to a protected item
Post by: Eddy on November 30, 2015, 05:42:07 PM
Look at the file shield log file.
Looks to me that if there is anything, it could be found there.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on November 30, 2015, 06:50:35 PM
Hi Eddy - There were no errors reported in the FileSystemShield log. The daily entries are all similar to this:

* Avast Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 30, 2015 10:33:38 AM

Infected items, Hard Errors, Soft Errors and Skipped Items are all enabled in the File System Shield reports settings. But it's strange that avast is not reporting this.  :-\

I appreciate your help.
Title: Re: An application is requesting access to a protected item
Post by: DavidR on November 30, 2015, 06:52:49 PM
I rather doubt that anything will show in the log - given what the OP said - as essentially the file shield didn't scan anything as it was blocked ???
Now confirmed

It would also depend on what the log settings are for the file shield as it only reports/records Infected items, Hard errors by default. I just wonder is this would be considered a hard error.

The only way I would suggest would be to include Soft errors, Skipped items and possibly OK items (but this last item would swamp the log). The log file could get quite large considering you may have to wait some time for a replication to occur.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 01, 2015, 01:59:51 AM
It's strange. I do have  Infected items, Hard Errors, Soft Errors and Skipped Items enabled but the log entries only contain a start time (as below):

* Avast Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 30, 2015 10:33:38 AM

So this particular issue is not logged for some reason. Tomorrow I will add OK Items and see what happens. I also have Debug enabled. I'm not sure but am assuming those logs are located under the /log folder. But there are a lot of logs to go through and the info is really meant for developers, so end users like me are pretty lost trying to parse what's going on in there.

Thanks for the suggestions.
Title: Re: An application is requesting access to a protected item
Post by: Eddy on December 01, 2015, 09:43:04 AM
A simple way is to tell safeguard to allow avast to scan and then see what it is scanning/has scanned.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 01, 2015, 03:27:26 PM
Hi Eddy
What is the "safeguard" you refer to? I'm not familiar with that.
thanks
Title: Re: An application is requesting access to a protected item
Post by: DavidR on December 01, 2015, 04:49:45 PM
Hi Eddy
What is the "safeguard" you refer to? I'm not familiar with that.
thanks

Its in your images, your system has a program or function (presumably called Protected Storage - safeguard) to protect certain areas that is stopping avast scanning those areas. You need to find its settings and add avastSvc.exe to its exclusions.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 02, 2015, 03:25:41 AM
Hi David, Eddy

Thanks for the suggestion and clarifications. Try as I might, I cannot find any configuration UI for the Protected Storage service on my WindowsXp machine. I did find this description of the Protected Storage Service here: https://msdn.microsoft.com/en-us/library/aa939852(v=winembedded.5).aspx (https://msdn.microsoft.com/en-us/library/aa939852(v=winembedded.5).aspx)  which says that "There are no configurable settings for this component". So I'm at a loss on this angle.

However I found some other interesting info: today the "Protected Item" error dialog popped up at 11:29:02 am EST. I was looking through the Avast debug logs searching for any entries timestamped 11:29:02 or 16:29:02 GMT and found 4 files. I included excerpts from 2 of the files below (if you want to see more of a particular file, let me know):

Hns.log:
   2015.12.01 16:29:02 | SystemScore IQueryRecentWinSATAssessment creating failed: 0x80040154
   2015.12.01 16:29:02 | Start Scan: mode=record, type=2, depth=2, 0x00000230
   2015.12.01 16:29:02 | LoadEngine: using engine build
   2015.12.01 16:29:02 | LoadEngine: module=C:\Program Files\AVAST Software\Avast\defs\15113000\aswHds.dll version=10.0.0.42
   2015.12.01 16:29:02 | LoadEngine: successfully loaded engine of version 15113000
   2015.12.01 16:29:02 | RealConnectivityScanner: local connect
   2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to 'http://www.msftncsi.com/ncsi.txt' status:200 result:2
   2015.12.01 16:29:02 | Start scanRouter()
   2015.12.01 16:29:02 | RealConnectivityScanner: local connect
   2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to 'http://www.msftncsi.com/ncsi.txt' status:200 result:2
   2015.12.01 16:29:02 | Network adapter: 'Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport', 1, 00247e6dc431

HnsFromUi_asw.hns.devices_1448996304.json:
   "device_status" : "vuln_scan_completed",
   "time" : "01/12/2015 11:29:02"
   "gateway_base_url" : "http://192.168.1.1:8080/",
   "ADAPTER_NAME" : "Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport",
   "HTML_LOGIN_FORM_ACTION_0" : "http://192.168.1.1/cache/697866478/index.cgi",
   "HTML_LOGIN_FORM_INPUT_PASSWORD_NAME_0" : "passwd1",
   "HTML_LOGIN_FORM_INPUT_TEXT_NAME_0" : "user_name",
   
http://192.168.1.1 is my router's URL address. At the exact time the dialog popped up, these entries get logged.  Do you guys think this is anything?

ps, there was nothing logged in the /report/FileSystemShield.txt log.

Thanks again for the help.
      
Title: Re: An application is requesting access to a protected item
Post by: Eddy on December 02, 2015, 10:53:06 AM
http://www.blackviper.com/windows-services/protected-storage/

I would disable the service and see what happens.
It is using a really old protection method anyway and MS is advising to use something else.
Title: Re: An application is requesting access to a protected item
Post by: DavidR on December 02, 2015, 03:03:36 PM
Strangely enough, I still have the Protected Storage service enabled on my XP system, image 1, but I don't have any issues like yours.

The Log On settings don't make it any easier to understand what it is that controls, image 2.
Title: Re: An application is requesting access to a protected item
Post by: Eddy on December 02, 2015, 03:10:13 PM
Same here.
I wonder if it is perhaps SafeGuard from Sophos...

Jeff,
I want to check a few things.
Please run Farbar and attach frst.txt and addition.txt to your next post here.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 02, 2015, 03:27:12 PM
OK I'll give that a try and let it run for a few days. Will let you know the results then. Thanks.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 02, 2015, 07:18:09 PM
Well I found out source of the problem. It is Avast's Home Network Security scanning. I can duplicate this issue by simply opening the "Scan for Network Threats" and poof! The dialog appears each time I do so. So now I'm trying to find out how to disable HNS. I think adding my router URL to the Exclusions list should do it. I will let you know how that's working after a few days.

Thanks for everyone's help on this.
Title: Re: An application is requesting access to a protected item
Post by: DavidR on December 02, 2015, 07:29:19 PM
Well I found out source of the problem. It is Avast's Home Network Security scanning. I can duplicate this issue by simply opening the "Scan for Network Threats" and poof! The dialog appears each time I do so. So now I'm trying to find out how to disable HNS. I think adding my router URL to the Exclusions list should do it. I will let you know how that's working after a few days.

Thanks for everyone's help on this.

Interesting and a good bit of detective work.

I wonder if this might have something to do with others having problems with the scan itself. That said they aren't mentioning about this Protected Storage dialogue window.
Title: Re: An application is requesting access to a protected item
Post by: Eddy on December 02, 2015, 11:02:01 PM
Install the latest version and see if it still happens :
https://forum.avast.com/index.php?topic=179656.0
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on December 05, 2015, 04:21:54 PM
The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS).

Installing the latest Beta (2245) did not fix this issue.

Adding http://192.168.1.1 to the exclusion URL does not fix this issue either (I would guess that HNS does not look at the exclusions lists).

I'm ok with disabling HNS - I have already hardened my network so I dont really need it to run every day.

Thanks for all your help here.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 01, 2017, 03:31:42 PM
I am having the same problem when I switch onto the internet both with Firefox and Google Chrome browser.
The same 'protected item image as described above and unable to click it off
I have paid for AVAST Antivirus
the only way to stop receivig this image is to uninstall AVAST but when I reinstall it and go onto the internet the image comes onto my screen again
Would appreciate any help to get rid of this 'protected item' image off my desktop short of getting rid of AVAST permanently
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 01, 2017, 09:46:27 PM
Same Problem. Avastsvc.exe is attempting to access a protected area. Happens when I launch Mozilla.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 04, 2017, 11:16:11 AM
Jeff above
has found a solution
'The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS). '
But I am unable to find (under Settings> Tools> HNS). ...it does not show on my Avast Page ???
Title: Re: An application is requesting access to a protected item
Post by: Asyn on April 04, 2017, 11:46:32 AM
Jeff above has found a solution
'The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS). '
But I am unable to find (under Settings> Tools> HNS). ...it does not show on my Avast Page ???
Things have changed since 2015. ;)
-> https://www.avast.com/faq.php?article=AVKB96#artTitle (Add/Remove components)
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 06, 2017, 01:06:33 AM
Thanks Asyn  :)
Click on Avast Pro AntiVirus >Settings>Components .... there are many subsections ???               I am unable to find Home Network Security  :-\  ....what do I remove to get rid of this irritating 'protected item image' ... which once appears on my desktop I am unable to switch OFF ????
Title: Re: An application is requesting access to a protected item
Post by: Asyn on April 06, 2017, 05:06:04 AM
Post a screenshot.
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 06, 2017, 01:01:27 PM
screenshot attached
Title: Re: An application is requesting access to a protected item
Post by: Asyn on April 06, 2017, 01:04:01 PM
No, I meant a screenshot of...
this irritating 'protected item image'
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 08, 2017, 02:50:27 AM
Sorry ..here is the screen shot of the protected item image which comes on when I open the browser and sits on the desktop until I turn the computer off.... it will not turn off.
Title: Re: An application is requesting access to a protected item
Post by: Asyn on April 08, 2017, 05:34:14 AM
Click on Details, what does it say..?
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on April 08, 2017, 09:28:43 AM
After clicking on Detail
Title: Re: An application is requesting access to a protected item
Post by: Asyn on April 08, 2017, 09:42:55 AM
Follow instructions: https://www.avast.com/faq.php?article=AVKB33#artTitle
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on May 25, 2017, 12:58:24 PM
The problem happens with AVAST and with AVG and it is connected to the last security patch that Microsoft added to WIN XP !! after the ransomware attack
Microsoft is to be blamed !!!
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on May 25, 2017, 01:35:48 PM
I uninstalled the KB 4012598 on the XP and the problem is gone
Microsoft is to be blamed for lousy job
Title: Re: An application is requesting access to a protected item
Post by: peterharris.harris1874 on July 10, 2017, 04:01:06 PM
I have just been using my old PC with MS Windows XP Pro installed - last update 4/8/2014.  I have been unable to carry out a scan or a cleanup because half way through I got the above error messages which stopped the cleanup  or scan and unable to remove it or find a password that works.

I checked the updates and did not have KB 4012598 anyway.  All my updates starting with KB then figure 2........ or 9..........

Any other ideas? Would it be a microsoft password and how do you find/change that password? :-\ :-\
Title: Re: An application is requesting access to a protected item
Post by: REDACTED on January 15, 2018, 11:50:21 PM
Anyone having this pop-up problem in Windows XP with Avast, try this:

Avast > Settings > Components > SafePrice Browser Extension:  Uninstall (you can always reinstall it here too)

These seems to have worked for me.

Otherwise, try:
Avast > Settings > Components > Wi-Fi Inspector:  Uninstall (you can always reinstall it here too)

Report back on your results  :)