Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: wursti on April 10, 2008, 08:22:22 PM

Title: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: wursti on April 10, 2008, 08:22:22 PM
Hello!
After startup I usually check Comodo Proactive Defense review list. Today I have noticed that these three files are under status "modified" although I have checked and removed them on previous time?
Does these files really change on every boot or why does they appear again and again in review section?
Comodo says that they are "safe" files...
They all exists in Avast DATA folder and I assume that they are legit files?


ps. Iadhide5.dll... does it have something to do with Avast!...?

Quote
iadhide5.dll is a F-Secure Backweb Component from BackWeb belonging to BackWeb Autoupdater. This is used for the automatic updates of many applications
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: DavidR on April 10, 2008, 08:55:34 PM
aswar?.dll belongs to the avast anti-rootkit module Alwil SoftWare, the 'asw' part and 'ar' the anti-rootkit. I placed a ? to indicate that this number could other than 0.

clnr0.dll (Virus/Worm Cleaner Application for avast!) is a component from the software avast! Virus Cleaner Tool

exts0.dll
Quote
These files may have the following Vendor, Product, Version Information in the file header ALWIL Software; Avast! Antivirus Scanner Extension Library; 1, 0, 0, 0

    * The following Vendor, Product, Version Information has also been reported:

ALWIL Software; ����t! Antivirus Scanner Extension Library; 1, 0, 0, 0

All of the above may have been recently updated either by program or vps update so the 'modified' may be correct.
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: wursti on April 10, 2008, 09:28:04 PM
Ok, thanks for the info.
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: Lisandro on April 10, 2008, 10:21:10 PM
Quote from: wursti on April 10, 2008, 08:22:22 PM
Does these files really change on every boot or why does they appear again and again in review section?
They're temporary files (aswar0.dll and clnr0.dll) that could change frequently.
I don't know about exts0.dll. Where is it located?

Quote from: wursti on April 10, 2008, 08:22:22 PM
ps. Iadhide5.dll... does it have something to do with Avast!...?
I don't think so...
http://www.programchecker.com/file/21099.aspx says Kodak.
http://www.neuber.com/taskmanager/process/iadhide5.dll.html says F-Secure Backweb component
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: wursti on April 10, 2008, 10:45:07 PM
Quote from: wursti on April 10, 2008, 08:22:22 PM

They all exists in Avast DATA folder and I assume that they are legit files?


Exact address: C:\Program Files\Alwil Software\Avast4\DATA

internal file description is: Avast! Antivirus Scanner Extension Library
file type: Application Extension

There's also digital signature from ALWIL Software from 2007...

Seems legit.
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: Vlk on April 10, 2008, 10:48:10 PM
Yes, all three files are extracted from 400.vps (the avast virus database) at the time of loading.
They basically change (=get overwritten) during every VPS update.

Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: wursti on April 10, 2008, 10:56:43 PM
Quote from: Vlk on April 10, 2008, 10:48:10 PM
Yes, all three files are extracted from 400.vps (the avast virus database) at the time of loading.
They basically change (=get overwritten) during every VPS update.



Thank you Vlk, that's what I thought also.
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: Lisandro on April 10, 2008, 10:58:49 PM
Sorry wursti, I've missed that info...
I don't have any of them there... ???
Title: Re: aswar0.dll, clnr0.dll, exts0.dll...?
Post by: DavidR on April 10, 2008, 11:15:06 PM
Quote from: wursti on April 10, 2008, 09:28:04 PM
Ok, thanks for the info.

Your welcome.