Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on November 28, 2015, 10:35:00 PM
-
I've recently been seeing a Windows dialog window appear with the message "An application is requesting access to a protected item". The dialog window also contains an entry box to fill in a password, and a "Details" button. Clicking on the Details button displays:
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
This typically occurs once a day in the afternoon. Surprisingly this does *not* occur during the nightly scheduled full system scans.
Any ideas about how to address this or to find out what is the protected item that avastsvc is attempting to access would be most appreciated. This is really driving me nuts!
FYI I'm running Avast! Free 11.1.2241 with virus def 151127-0
-jeff
-
Please attach a screenshot of it to your next post.
-
This occurred again today at 3:33:00 PM EST. Applications that were running at the time were Chrome, Outlook Express and Windows Explorer. There is nothing in any of the event logs at or around 3:33pm. I was not at my computer at that time. Scheduled Tasks show nothing was scheduled to run during that timeframe.
The attached screenshots show:
av1: initial windows dialog
av2: after clicking on the "Details" button
av3: right-dragging the filepath to see the full filename
av4: after entering a bogus password in the initial window and clicking ok
Thanks for the help. Let me know if I can provide anything else.
-jeff
-
A bit more info: I noticed that at exactly 3:33:00pm Outlook Express was checking for new messages. I know this because today I set up Debut to do a screen capture video taking snapshots at 1 fps. I could see OE start the "authorizing" process when the dialog popped up at 3:33:00pm.
-
It seems to me that something on your system is accessing a file/application that avast wants to scan, but safeguard is blocking avast from doing its job.
I was not at my computer at that time
It could be a screensaver wanted to run, the system wanted to go into sleep-mode or something like that.
-
It seems to me that something on your system is accessing a file/application that avast wants to scan, but safeguard is blocking avast from doing its job.
Agreed
It could be a screensaver wanted to run, the system wanted to go into sleep-mode or something like that.
I have no screensavers running and sleep-mode disabled. The computer is always on.
Obviously I need to find out what "protected item" avast is trying to access. Is there an avast log I can enable that records all it's real-time Active Protection file accesses? That might help. I could match up the time the popup occurs with the timestamp in the log.
-
Look at the file shield log file.
Looks to me that if there is anything, it could be found there.
-
Hi Eddy - There were no errors reported in the FileSystemShield log. The daily entries are all similar to this:
* Avast Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 30, 2015 10:33:38 AM
Infected items, Hard Errors, Soft Errors and Skipped Items are all enabled in the File System Shield reports settings. But it's strange that avast is not reporting this. :-\
I appreciate your help.
-
I rather doubt that anything will show in the log - given what the OP said - as essentially the file shield didn't scan anything as it was blocked ???
Now confirmed
It would also depend on what the log settings are for the file shield as it only reports/records Infected items, Hard errors by default. I just wonder is this would be considered a hard error.
The only way I would suggest would be to include Soft errors, Skipped items and possibly OK items (but this last item would swamp the log). The log file could get quite large considering you may have to wait some time for a replication to occur.
-
It's strange. I do have Infected items, Hard Errors, Soft Errors and Skipped Items enabled but the log entries only contain a start time (as below):
* Avast Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Monday, November 30, 2015 10:33:38 AM
So this particular issue is not logged for some reason. Tomorrow I will add OK Items and see what happens. I also have Debug enabled. I'm not sure but am assuming those logs are located under the /log folder. But there are a lot of logs to go through and the info is really meant for developers, so end users like me are pretty lost trying to parse what's going on in there.
Thanks for the suggestions.
-
A simple way is to tell safeguard to allow avast to scan and then see what it is scanning/has scanned.
-
Hi Eddy
What is the "safeguard" you refer to? I'm not familiar with that.
thanks
-
Hi Eddy
What is the "safeguard" you refer to? I'm not familiar with that.
thanks
Its in your images, your system has a program or function (presumably called Protected Storage - safeguard) to protect certain areas that is stopping avast scanning those areas. You need to find its settings and add avastSvc.exe to its exclusions.
-
Hi David, Eddy
Thanks for the suggestion and clarifications. Try as I might, I cannot find any configuration UI for the Protected Storage service on my WindowsXp machine. I did find this description of the Protected Storage Service here: https://msdn.microsoft.com/en-us/library/aa939852(v=winembedded.5).aspx (https://msdn.microsoft.com/en-us/library/aa939852(v=winembedded.5).aspx) which says that "There are no configurable settings for this component". So I'm at a loss on this angle.
However I found some other interesting info: today the "Protected Item" error dialog popped up at 11:29:02 am EST. I was looking through the Avast debug logs searching for any entries timestamped 11:29:02 or 16:29:02 GMT and found 4 files. I included excerpts from 2 of the files below (if you want to see more of a particular file, let me know):
Hns.log:
2015.12.01 16:29:02 | SystemScore IQueryRecentWinSATAssessment creating failed: 0x80040154
2015.12.01 16:29:02 | Start Scan: mode=record, type=2, depth=2, 0x00000230
2015.12.01 16:29:02 | LoadEngine: using engine build
2015.12.01 16:29:02 | LoadEngine: module=C:\Program Files\AVAST Software\Avast\defs\15113000\aswHds.dll version=10.0.0.42
2015.12.01 16:29:02 | LoadEngine: successfully loaded engine of version 15113000
2015.12.01 16:29:02 | RealConnectivityScanner: local connect
2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to 'http://www.msftncsi.com/ncsi.txt' status:200 result:2
2015.12.01 16:29:02 | Start scanRouter()
2015.12.01 16:29:02 | RealConnectivityScanner: local connect
2015.12.01 16:29:02 | RealConnectivityScanner: internet connect to 'http://www.msftncsi.com/ncsi.txt' status:200 result:2
2015.12.01 16:29:02 | Network adapter: 'Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport', 1, 00247e6dc431
HnsFromUi_asw.hns.devices_1448996304.json:
"device_status" : "vuln_scan_completed",
"time" : "01/12/2015 11:29:02"
"gateway_base_url" : "http://192.168.1.1:8080/",
"ADAPTER_NAME" : "Intel(R) 82567LF Gigabit Network Connection - Packet Scheduler Miniport",
"HTML_LOGIN_FORM_ACTION_0" : "http://192.168.1.1/cache/697866478/index.cgi",
"HTML_LOGIN_FORM_INPUT_PASSWORD_NAME_0" : "passwd1",
"HTML_LOGIN_FORM_INPUT_TEXT_NAME_0" : "user_name",
http://192.168.1.1 is my router's URL address. At the exact time the dialog popped up, these entries get logged. Do you guys think this is anything?
ps, there was nothing logged in the /report/FileSystemShield.txt log.
Thanks again for the help.
-
http://www.blackviper.com/windows-services/protected-storage/
I would disable the service and see what happens.
It is using a really old protection method anyway and MS is advising to use something else.
-
Strangely enough, I still have the Protected Storage service enabled on my XP system, image 1, but I don't have any issues like yours.
The Log On settings don't make it any easier to understand what it is that controls, image 2.
-
Same here.
I wonder if it is perhaps SafeGuard from Sophos...
Jeff,
I want to check a few things.
Please run Farbar and attach frst.txt and addition.txt to your next post here.
-
OK I'll give that a try and let it run for a few days. Will let you know the results then. Thanks.
-
Well I found out source of the problem. It is Avast's Home Network Security scanning. I can duplicate this issue by simply opening the "Scan for Network Threats" and poof! The dialog appears each time I do so. So now I'm trying to find out how to disable HNS. I think adding my router URL to the Exclusions list should do it. I will let you know how that's working after a few days.
Thanks for everyone's help on this.
-
Well I found out source of the problem. It is Avast's Home Network Security scanning. I can duplicate this issue by simply opening the "Scan for Network Threats" and poof! The dialog appears each time I do so. So now I'm trying to find out how to disable HNS. I think adding my router URL to the Exclusions list should do it. I will let you know how that's working after a few days.
Thanks for everyone's help on this.
Interesting and a good bit of detective work.
I wonder if this might have something to do with others having problems with the scan itself. That said they aren't mentioning about this Protected Storage dialogue window.
-
Install the latest version and see if it still happens :
https://forum.avast.com/index.php?topic=179656.0
-
The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS).
Installing the latest Beta (2245) did not fix this issue.
Adding http://192.168.1.1 to the exclusion URL does not fix this issue either (I would guess that HNS does not look at the exclusions lists).
I'm ok with disabling HNS - I have already hardened my network so I dont really need it to run every day.
Thanks for all your help here.
-
I am having the same problem when I switch onto the internet both with Firefox and Google Chrome browser.
The same 'protected item image as described above and unable to click it off
I have paid for AVAST Antivirus
the only way to stop receivig this image is to uninstall AVAST but when I reinstall it and go onto the internet the image comes onto my screen again
Would appreciate any help to get rid of this 'protected item' image off my desktop short of getting rid of AVAST permanently
-
Same Problem. Avastsvc.exe is attempting to access a protected area. Happens when I launch Mozilla.
-
Jeff above
has found a solution
'The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS). '
But I am unable to find (under Settings> Tools> HNS). ...it does not show on my Avast Page ???
-
Jeff above has found a solution
'The only way I've found to disable the "Protected Item" popup error message is to turn off Home Network Security (under Settings> Tools> HNS). '
But I am unable to find (under Settings> Tools> HNS). ...it does not show on my Avast Page ???
Things have changed since 2015. ;)
-> https://www.avast.com/faq.php?article=AVKB96#artTitle (Add/Remove components)
-
Thanks Asyn :)
Click on Avast Pro AntiVirus >Settings>Components .... there are many subsections ??? I am unable to find Home Network Security :-\ ....what do I remove to get rid of this irritating 'protected item image' ... which once appears on my desktop I am unable to switch OFF ????
-
Post a screenshot.
-
screenshot attached
-
No, I meant a screenshot of...
this irritating 'protected item image'
-
Sorry ..here is the screen shot of the protected item image which comes on when I open the browser and sits on the desktop until I turn the computer off.... it will not turn off.
-
Click on Details, what does it say..?
-
After clicking on Detail
-
Follow instructions: https://www.avast.com/faq.php?article=AVKB33#artTitle
-
The problem happens with AVAST and with AVG and it is connected to the last security patch that Microsoft added to WIN XP !! after the ransomware attack
Microsoft is to be blamed !!!
-
I uninstalled the KB 4012598 on the XP and the problem is gone
Microsoft is to be blamed for lousy job
-
I have just been using my old PC with MS Windows XP Pro installed - last update 4/8/2014. I have been unable to carry out a scan or a cleanup because half way through I got the above error messages which stopped the cleanup or scan and unable to remove it or find a password that works.
I checked the updates and did not have KB 4012598 anyway. All my updates starting with KB then figure 2........ or 9..........
Any other ideas? Would it be a microsoft password and how do you find/change that password? :-\ :-\
-
Anyone having this pop-up problem in Windows XP with Avast, try this:
Avast > Settings > Components > SafePrice Browser Extension: Uninstall (you can always reinstall it here too)
These seems to have worked for me.
Otherwise, try:
Avast > Settings > Components > Wi-Fi Inspector: Uninstall (you can always reinstall it here too)
Report back on your results :)