Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: buffy_92 on January 15, 2012, 10:23:00 AM

Title: i need some help
Post by: buffy_92 on January 15, 2012, 10:23:00 AM
hello. i have a problem, it sounds like this: the used space from C part.(with Windows) it's going to decrese. it's happens with few MG. i've tried a disk defragmentation, but after few minutes the free space it's more with 2/3MG, after a restart it's less and then, much more.. i thing it's about a virus, but my Avast 6., didn't check anything. also, i don't see suspect processes at task manager.
i'm sorry if i didn't match the topic and for my english. pls somebody tell me what it's all about?
Title: Re: i need some help
Post by: true indian on January 15, 2012, 10:41:26 AM
Hi an welcome to the forums! :)

This cant be a virus as such i dont see anything related....Have u enabled file indexing property for your C drive?
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 10:55:41 AM
not really
Title: Re: i need some help
Post by: true indian on January 15, 2012, 11:01:48 AM
Ok...wait until other forum members post as i dont know why that should happen...i never seen such a weird issue yet!
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 11:07:29 AM
i know, my pc it's going crazy after more problems...
Title: Re: i need some help
Post by: SafeSurf on January 15, 2012, 11:25:29 AM
I need to know more information about your machine to answer your question:

1.   What is your OS, 32 or 64-bit?  How much RAM do you have?
2.   What version of Avast did you install?  6.0.1367? 
3.   What product of Avast did you install?  Free, Pro, AIS?
4.   What other security software do you currently have or did you have in the past on this machine including:
- Antivirus (AV)
- Firewall (FW)
- Trial versions of AV, FW and other security programs
- Other security software (example: Malwarebytes [MBAM])

- If they were in the past, how did you remove them (the vendor's uninstaller's tool or  another way)?
5.   Are your MS Updates (if you have Windows) current?
6.   Are your software updates current?
7.   Are the Avast definitions (updates) current?
8.   When was the last time you did any kind of scan in Avast, and if so what kind of scan was it?  Did your scan come out clean (no infection)?
9.    Did this problem start all of a sudden or come on gradually?  If it came on all of a sudden, what were you doing when it started and when did it happen?

I'm sorry for all the questions, but this will help identify issues that are causing problems.  Thank you.


Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 02:10:15 PM
1. 32b, 2BG RAM
2. 6.0.1367
3. free
4. just avast
5. it's turned off
7. yes
8. few hours ago, full scan, and didn't detect anything
9. i saw it few days ago, when the AV was checking sth, and my network started plugging, then it's starts a problem with my browser, from mozilla arrived to yahoo page, and then i saw this problem with the free space.
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 02:12:59 PM
i forget' sth: if i assembly the free space with the used space, they didn't match, no way...it's a major difference.
Title: Re: i need some help
Post by: RZPogi on January 15, 2012, 02:21:22 PM
Is system restore on? If it is, system restore is making an image copy of the whole drive. Well, it only record major changes such as installing windows updates, installing some new programs, etc.
You might want to delete all except the latest restore point. You can do this with ccleaner or go to control panel>system. select advanced system settings on the top left panel. On the system properties panel, select system protection tab. On the System Protection for Drive C window, select delete. Note that it will delete all restore points so if you need to revert to a previous state of windows it will not be possible.

Also your browser saves some data on HD to makes websites load faster when you check them out again. Clear your browser's cache or use ccleaner from www.piriform.com/ccleaner (http://www.piriform.com/ccleaner)
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 02:25:38 PM
it's restore off. :-\
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 02:28:20 PM
any more ideas please?
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 02:31:49 PM
and my temp from Windows file, it's small than temp from Doc.andSettings, that one it's like 10mg, but no problem, it should decrease the free space, not the used one. :-\ :'(
Title: Re: i need some help
Post by: bob3160 on January 15, 2012, 09:27:54 PM
Can you post a screen shot of what you're trying to explain ???
Why is windows updates turned off ??? Is your windows OS up to date ???
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 10:21:24 PM
ya. i'm telling that my USED space from part. with windows it's going to DECREASE with 3-4 more mg, in few minutes...after a restart it's like at the beginnig and then, it's changing again.
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 10:25:11 PM
and about my windows update, it's "off" since i hadn' internet(few months ago), and looks' like i forgett' him off :-\
Title: Re: i need some help
Post by: Asyn on January 15, 2012, 10:27:39 PM
ya. i'm telling that my USED space from part. with windows it's going to DECREASE with 3-4 more mg, in few minutes...after a restart it's like at the beginnig and then, it's changing again.

I've to admit, that I've no idea what you want to know..!?? ;)
Title: Re: i need some help
Post by: buffy_92 on January 15, 2012, 10:35:55 PM
??i have a serious problem here with my computer which is going crazy with his stupid numbers and i want to know what the hell it's happen' with him...i thought it's about a virus, or another problem, and like everyone else, i want to know what it's all about... but nobody knows!!?!! really thanks! :'(
Title: Re: i need some help
Post by: Asyn on January 15, 2012, 10:40:34 PM
i thought it's about a virus...

If you think it's a virus - Please attach your logs.
http://forum.avast.com/index.php?topic=53253.0
Title: Re: i need some help
Post by: ady4um on January 15, 2012, 10:43:33 PM
I may be wrong, but I think the reason "nobody knows" is because it is a bit difficult to understand what you are posting.

If you say that it takes just a few minutes to see the free / used size problem, you could:

1_ Open Windows Explorer;
2_ Take a screenshot and SAVE it;
3_ Wait "some time" so to be able to see the difference in size;
4_ Open Windows Explorer ANEW (or refresh the view with F5 );
5_ Take a new screenshot and SAVE it;

6_ Attach here both screen shots. Please try to make the attachments "relevant", (ie. avoid posting your whole desktop if it is unnecessary, and try to make the numbers / values clear enough).
Title: Re: i need some help
Post by: Asyn on January 15, 2012, 10:47:26 PM
I may be wrong, but I think the reason "nobody knows" is because it is a bit difficult to understand what you are posting.

You're right and I may correct this to: "very difficult" ;) (at least for me...)
Title: Re: i need some help
Post by: true indian on January 16, 2012, 05:49:03 AM
i think he is trying to say that his free space on his c: drive increases or decreases randomly on reboot..
Title: Re: i need some help
Post by: buffy_92 on January 16, 2012, 08:14:03 AM
problem resolved after 2 defragmentation and a C:format... i'm still thinking at what it was ???
Title: Re: i need some help
Post by: SafeSurf on January 16, 2012, 09:35:17 AM
@ buffy_92,

If you are saying that everything is working fine now, great.  If not, this sounds like an infection (malware), and I would follow the link given to you in post #17.  Start with the Malwarebytes (MBAM) log and post it here...make sure you UPDATE MBAM prior to scanning, then quarantine any infection it finds.  It actually can't hurt for you to do this now anyway because you mentioned something earlier about opening up FF and being redirected to Yahoo (if I understood correctly).

After posting your MBAM log, if there are problems, then I would proceed with the OTL log as directed on the link in post #17.

Make sure your Avast definitions and MS/Windows Updates are kept up to date.

You can also download something like CCleaner to remove unused files (cache, temporary Internet files, etc.) from your system, allowing Windows to run faster and freeing up valuable hard disk space.  It also cleans traces of your online activities such as your Internet history.  There is a CCleaner Slim Version http://www.piriform.com/ccleaner/builds (http://www.piriform.com/ccleaner/builds) - scroll down with no toolbars and requires less memory.  Use this every time you are online and before you close your machine down to free up space as well.

Once you have everything working correctly, make a restore point in case you need to go back to a good configuration.  You can set the restore point limit to a minimum amount if you like.
Title: Re: i need some help
Post by: buffy_92 on January 16, 2012, 11:50:52 AM
this is from scan boot

01/16/2012 11:47
Scan of all local drives

File C:\Program Files\DAEMON Tools Pro\dtprohlp.dll|>[UPX]|>[Embedded_R#2222c]|>DaemonTools_WhenUSave_Installer.exe is infected by Win32:PUP-gen [PUP], Moved to chest
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch03\03fig15.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch07\07fig01.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch01\aafig01.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch01\aafig04.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch01\aafig05.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch03\bbfig02.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch06\befig09.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch06\befig11.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch05\bffig02.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch05\bffig03.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch05\bffig04.gif Error 42126 {RAR archive is corrupted.}
File D:\diverse\Despre C++ si alte programe\Documentatii\Visual C# - Video Tutorials\CSharp_09 - Program Flow - Solution.zip|>CSharp_09 - Program Flow - Solution.wmv Error 42125 {ZIP archive is corrupted.}
File D:\Kit-uri\De pus pe DVD-uri\Diverse programe\Daemon Tools Pro 4.10.0215..+crack\DTPro4100215Free.exe|>$INSTDIR\dtprohlp.dll|>[UPX]|>[Embedded_R#2222c]|>DaemonTools_WhenUSave_Installer.exe is infected by Win32:PUP-gen [PUP], Moved to chest
File D:\lexu\Genetica_-_Drosophila-transfer_RO-08dec-dc13d8.rar|>DSC02638.JPG Error 42126 {RAR archive is corrupted.}
Number of searched folders: 13959
Number of tested files: 640962
Number of infected files: 2

Title: Re: i need some help
Post by: buffy_92 on January 16, 2012, 11:55:14 AM
i moved them to chest and delete
but after the windows start up a error appeared: from DTProAgent.exe-unable to locate component
this application has failed to start because DTProHlp.dll was not found. Re-installing the application may fix the problem.
this means that the program(DaemonTools) will not work or sth like that?
Title: Re: i need some help
Post by: Pondus on January 16, 2012, 12:18:13 PM
Quote
File D:\diverse\Despre C++ si alte programe\Documentatii\carti-arhive\Special Edition Using the Internet.rar|>Special Edition Using the Internet\ch03\03fig15.gif Error 42126 {RAR archive is corrupted.}
this is just a scan error, it does not mean that the file is infected


Quote
File C:\Program Files\DAEMON Tools Pro\dtprohlp.dll|>[UPX]|>[Embedded_R#2222c]|>DaemonTools_WhenUSave_Installer.exe is infected by Win32:PUP-gen [PUP], Moved to chest
PUP is not a virus. avast is just warning you that you have a program that can be used for good or bad

PUP (potentially unwanted program)
http://searchsecurity.techtarget.com/definition/PUP


Daemon Tools
http://en.wikipedia.org/wiki/Daemon_Tools




Title: Re: i need some help
Post by: SafeSurf on January 16, 2012, 12:23:05 PM
i moved them to chest and delete <snip> this means that the program(DaemonTools) will not work or sth like that?
It's always better to move things to the Chest and NOT delete...just leave it in the Chest where it is safe.  You can always restore things from the chest, especially if you find it is a vital file that is needed for the system to work, as you may have just discovered.

Next follow the directions in this link since you obviously had malware and may still have some: http://forum.avast.com/index.php?topic=53253.0 (http://forum.avast.com/index.php?topic=53253.0) for attaching your MBAM and OTL logs.

Make sure you update MBAM first and the OTS logs (save them as ANSI).  Post the MBAM log and the OTS log as an attachment (Additional Options > Attach > Post).  Thank you.
Title: Re: i need some help
Post by: CraigB on January 16, 2012, 12:23:42 PM
Why did you delet them from the chest ? you should have left them in the chest until you had the detections evaluated.
With PUP detecting turned on you need to have a better understanding of the programs and processes that are going on in your system so to be better abled at making a decision when a PUP happens to be flagged.
Since you've deleted the detections you'll have to re install Daemon Tools and may i suggest for you to turn off PUP's.
Title: Re: i need some help
Post by: buffy_92 on January 16, 2012, 01:13:50 PM
i'm sorry i didn't know... :-[ i'll try with the MBAM and come back here..and thks for the instruct. with mbam ;)
Title: Re: i need some help
Post by: SafeSurf on January 17, 2012, 11:52:28 AM
No problem.  We all have to learn somewhere.  We will await your response.
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 06:37:51 PM
this is from mbam. it's nothing bad i think..am i right? :-\
anyway the problem disappeared... :D
Title: Re: i need some help
Post by: Pondus on January 17, 2012, 06:39:47 PM
log must be saved as ANSI or it just look like chinese
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 06:44:50 PM
sorry ::)
Title: Re: i need some help
Post by: Pondus on January 17, 2012, 06:51:04 PM
Quote
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
aaaaaa.....   ;D   your security senter should work again
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 06:59:18 PM
 :D and i want to know more about it(mbam)..on the internet i found things like "donwload" and "that is a anti_mallware" >:( ..can someone tell me more?(ps: usually girls are more heavy on the had") ::)
Title: Re: i need some help
Post by: Pondus on January 17, 2012, 07:00:59 PM
:D and i want to know more about it(mbam)..on the internet i found things like "donwload" and "that is a anti_mallware" >:( ..can someone tell me more?(ps: usually girls are more heavy on the had") ::)
http://www.malwarebytes.org/
http://forums.malwarebytes.org/



if you go to any malware removal forum, you will see that the first tool they try is....MBAM   ;)
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 07:02:44 PM
thks :D
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 07:16:44 PM
hey..it apperars that icon from windows security alerts
ashly are 2..and process wscntfy.exe cannot be ended..what i do?
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 07:19:03 PM
because i dont want the firewall back..i just use the avast
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 07:22:23 PM
i unninstalled the mbam because i don't need it..i use avast.
 hey how can get rid of this problem with th wscntfy.exe?
Title: Re: i need some help
Post by: bob3160 on January 17, 2012, 07:25:59 PM
i unninstalled the mbam because i don't need it..i use avast.
 hey how can get rid of this problem with th wscntfy.exe?
MBAM and avast complement each other.  :)
Title: Re: i need some help
Post by: buffy_92 on January 17, 2012, 07:28:41 PM
but i don't want mbam..i don't know how to turn off that ...with the wscntfy.exe..
Title: Re: i need some help
Post by: Pondus on January 17, 2012, 07:48:34 PM
if you turn that off...then you turn off your security center

Quote
wscntfy.exe is a part of the Microsoft Windows Security system and outputs the current security status of your computer.
http://www.processlibrary.com/directory/files/wscntfy/21010/
Title: Re: i need some help
Post by: SafeSurf on January 18, 2012, 11:27:31 AM
Even though you use Avast, you can still use the Windows Firewall because they do NOT conflict with each other.  Are you using Avast Internet Security (Avast + their firewall)?

Also, most of us here who use Avast also use MBAM because they work well together.  They work differently.  So you are better off keeping MBAM on your machine and they do NOT conflict with each other.

I hope this helps you understand this better.
Title: Re: i need some help
Post by: REDACTED on January 19, 2012, 04:50:17 PM
established a commercial version of the program, yesterday stopped running after the rollback system program writes - "the program is stopped or is in an inconsistent state."  why there is no support in Russian?
Title: Re: i need some help
Post by: Asyn on January 19, 2012, 04:57:55 PM
why there is no support in Russian?

There is. ;)
http://forum.avast.com/index.php?board=28.0