Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: xode on January 12, 2010, 03:29:19 PM
-
- Avast installs fine under Win95.
- Win98 1st Edition always crashes, even if Avast is installed with no other software added before Avast. Changing Bus Logic SCSI to LSI Logic has no effect.
- The crash always happens on the first reboot of Win98 just after Avast has finished installing and takes the form of blue screens (fatal error 0D and 0E) and/or kernel stack fault as reported by VMWare.
-
What specs is your computer CPU Speed & RAM ETC. Win 98 is very old and can be unstable. Win 95 is much worse. Get windows 2000 at least or XP!
-
...Get windows 2000 at least or XP!
No thanks, the reason being that with 2000 or XP, it is so easy to get infected and not know about it, even with fully up to date antivirus and firewall, and just by visiting a website that has been hacked without you knowing about it. With windows 9x, there is much more of a chance that the virus, if it is too new to be recognized by Avast, will cause the windows 9x to behave funny, crash, or otherwise alert you to the infection when it happens. Also, windows 9x doesn't have the system calls that 2000 or XP does, which increases the chances that an infection targeted for XP will simply crash and not cause an infection at all. It might also cause the windows 9x to crash as well, but that is fine.
You might have noticed that I said that I am running Win98 under VMWare. The Win98 is an expendable virtual machine that can be killed and restarted, or deleted and replaced as needed to remove the effects of any infection it runs across.
-
This same problem also happens with Windows 98 2nd Edition. On the Avast download site changelog, I read something about Avast being compatible with WIN95/98 again. Could this be related to that changelog reference? I downloaded the latest file available as of 2 days ago but is that the install file where Avast is WIN95/98 compatible again?
-
avast! 4.8.1368, the current version, is 9X-ME compatible and successfully running here on 2 x 95OSR2 and 2 x 98SE machines as we "speak".
The previous version (4.8.1367) would spit-the-dummy during install so I doubt the 2 problems are related.
-
avast! 4.8.1368, the current version, is 9X-ME compatible and successfully running here on 2 x 95OSR2 and 2 x 98SE machines as we "speak".
The previous version (4.8.1367) would spit-the-dummy during install so I doubt the 2 problems are related.
Are you running those 9x machines under any kind of virtual machine software?
-
Are you running those 9x machines under any kind of virtual machine software?
No. I strongly suspect that VM is a factor.
-
Are you running those 9x machines under any kind of virtual machine software?
No. I strongly suspect that VM is a factor.
Yet Avast installs fine in Win95 running under VMWare. Further, it is much more secure to run windows 9x in a virtual machine when going on the internet and for the reasons I stated above, I do not use winxp to do anything much on the internet. So, it would be very good to get this problem fixed.
-
xode, take in account that version 4.8 will be dropped in ~6 months and avast 5 won't be Windows 9x/Me compatible.
I'm not sure the problem will get priority ::)
-
Are you running those 9x machines under any kind of virtual machine software?
No. I strongly suspect that VM is a factor.
Actually, it looks like winsock2 is the culprit.
xode, take in account that version 4.8 will be dropped in ~6 months and avast 5 won't be Windows 9x/Me compatible.
I'm not sure the problem will get priority ::)
It would be really good to get this problem fixed and keep the support for win9x. Here is an example of how easy it is to hack Windows 7: http://www.techtree.com/India/News/iPhone_SMS_Database_Hackable_in_20_Seconds/551-110161-580.html
-
The solution is not to patch Windows 98.
Life moves on and keep moving... Windows won't stop due to hacks... Windows 98 is not safer...
-
The solution is not to patch Windows 98.
Life moves on and keep moving... Windows won't stop due to hacks... Windows 98 is not safer...
There is a fundamental difference in structure between win9x, and winxp and later. That fundamental difference is that, in win9x, everything runs in the high privilege mode, whereas, in winxp and later, only the operating system runs in high privilege mode and all user programs, including antivirus, run in the lower user privilege mode.
By high privilege mode and lower user privilege mode, I mean the two bits in the microprocessor flags register, which, once set to the lower privilege mode, can't be set back to the high privilege mode without creating an exception condition.
Without going through all the details, this difference between win9x, and winxp and later, means that a virus that infects winxp and later gets a higher privilege on the computer that it has infected than all of the other programs, including antivirus, that are on that computer, with the result that it can hide itself from those other programs. I recognize that win9x can get infected, maybe even more easily, but it is much harder for the infection to hide itself with antivirus present since all programs on a win9x computer have the high privilege level.
So what if my win9x virtual machine gets infected, provided that I am made aware of it right at the time of infection, either through the antivirus complaining or some other strange behavior such as the virus trying to kill the antivirus since it can't hide from it? It is only a virtual machine that I can simply delete and the virus is gone. Unfortunately, the same is not true for winxp and later. I have personally seen many times, antivirus software, including avast, running just fine under the suspect winxp say that no viruses were found, but when the same antivirus, again including avast, is run under a clean winxp, it then finds the viruses that were hiding in the suspect winxp system.
Therefore, I maintain that win9x is safer, not because it can't get infected since it can, but because, if it gets infected, the chances of me being made aware of the infection right at the time of the infection are much greater. Again, it would be really good to get this problem fixed and keep the support for win9x.
-
But it is much harder for the infection to hide itself with antivirus present since all programs on a win9x computer have the high privilege level.
Hmmm... This is not true as far I know. The problem of hiding is related to NTFS x FAT32 and rootkits if I'm right...
-
But it is much harder for the infection to hide itself with antivirus present since all programs on a win9x computer have the high privilege level.
Hmmm... This is not true as far I know. The problem of hiding is related to NTFS x FAT32 and rootkits if I'm right...
The problem of a virus hiding is definitely related to rootkits, of which NTFS vs FAT/FAT32 have no bearing on, as far as I know. Regarding your assertion that...
But it is much harder for the infection to hide itself with antivirus present since all programs on a win9x computer have the high privilege level.
...not being true, try the following on any win9x machine:
- open up MSDOS prompt and run debug.
- zero out all bytes between address 200 and 2FF (so as to easily see what is happening).
- insert the following bytes at address 200: FA EB FE
- run the program starting at address 200.
"FA" is the machine code for disable interrupts and "EB FE" is the machine code for a jump back to itself (i.e. an infinite loop).
I tried this many years ago on a native windows 95 machine and it locked that computer up to the point where I had to hit the reset button to recover (i.e. not even Ctrl-Alt-Delete would function). I again tried it tonight on my windows 95 virtual machine and it locked that virtual machine up to the point where I had to kill the virtual machine from the linux host.
The same can also be done from within winxp except that MSDOS prompt is called Command Prompt in winxp. I also tried this in my winxp virtual machine tonight with the result that only the Command Prompt program itself entered an infinite loop and the rest of the virtual machine continued to function as normal. In other words, it is as if the "FA" disable interrupts instruction was not present, meaning that winxp (and later) will intercept that instruction (it is a privileged instruction) and void it out but win9x will not. This proves my assertion that all programs on a win9x computer have the high privilege level.