AshDips.exe bad image, Avast nonfunctional & trojan per malwarebytes

[AnnieMS]

Avast 4.8 pro on winxp tab ed

On windows start up yesterday I started getting an "ashDisp.exe bad image" error message which states that "the application or dll of c:\Progra~1...\aswCmnOS.dll is not a valid Windows image file." Yesterday Avast updated itself per usual but today the Avast icon has disappeared from the task tray and I get the same bad image message if I try to run Avast from Start > Programs.

I installed a trial version of presto page manager downloaded from newsoft's web site this week. Afterward I noticed a new folder named Softwrap in Shared Documents. It has a folder named "NEWSOFTAMERIPM90123B" which has one file named Prestopm.sw2. It appears to be part of page manager's installation but I emailed new soft to confirm this.

I ran a malwarebytes scan which found a trojan.agent.gen in program files\google\...\GoogleDesktopSetup.exe. I never installed any google anythings and I always unclick any freebies w/ adobe plug-ins or other installations but I might have missed one freebie. It could be a false positive.I forgot to test the file w/ jotti before malwarebytes removed it. Add Remove Programs does show a Google Toolbar for IE - I never use IE except for Windows Update and I don't know where the Google Toolbar came from. Even legitimate software vendors/download sites sneak things onto one's computer, tho.

Malwarebytes reported that it successfully removed the infection and other than that one file the full scan was clean.  Assuming the infection was not a false positive, I am wondering if the infection caused the "bad image" or if the "bad image" problem interfered w/ Avast's protection.

I am going to try uninstalling and then reinstalling avast from the downloaded setup.exe. Is there anything else I should do at this point?

[Gargamel360]

Yep.

Upgrade to Avast! 5. 

[AnnieMS]

Thanks Gargamel360

I downloaded the upgrade setup file, but 4.8 won't uninstall via Add/Remove Programs. I get a message that there was an error during product uninstallation and all the files are still in program files. I tried the repair option first and I also got an error notice w/ that. The repair log says that vps-10092200.vpu doesn't exist and that vps-10092001.vpu exists but is invalid.

Should I try installing the upgrade w/out uninstalling 4.8 or is there an avast utility to uninstall avast when Add/Remove fails?

[Gargamel360]

is there an avast utility to uninstall avast when Add/Remove fails?

Yes indeed, through this link>>http://www.avast.com/uninstall-utility

Take note of and follow instructions.  Let us know how it goes.

[DavidR]

- Download the latest version of avast Pro, 5.0.677 http://files.avast.com/iavs5x/setup_av_pro.exe and save it to your HDD, somewhere you can find it again (if you didn't save your last download). Use that when you reinstall.

- Download the avast! Uninstall Utility, aswClear5.exe find it here and save it to your HDD (it has uninstall tools for both 4.8 and 5.0).

• 1. Now uninstall avast! (using add remove programs, if you can't do that start from the next step), reboot.
• 2. run the avast! Uninstall Utility from safe mode (select avast 4.8 from the drop down list), once complete reboot into normal mode.
• 3. install the latest version, reboot.

Having now installed avast5 you will need to enter your license key, but the 4.8 one won't work:
- avast! 5 Pro license convert from 4.8 Pro license. Try http://www.avast.com/resend-license.php now, fill in the form giving your email and 4.8 Pro License key and they will send the new license file to you (presumably it will check you have a legit 4.8 Pro license first).

- Avast! Pro antivirus Quick Start Guide http://files.avast.com/files/documentation/quick-start-guide-pro-en-ww.pdf. How to register avast 5 pro is on page 7 - 8.

[AnnieMS]

I followed the instructions: used the uninstall utility in safe mode making sure it was aimed at the c:\program files\alwil software\avast4 folder, rebooted, installed avast 5 and rebooted. I now have the avast 5 icon spinning in my task tray and the status page shows resident protection and definitions auto updates are on. For some reason Virus Definitions Version has an orange exclamation point, but when I manually updated it said my definitions were current and the orange exclamation point remains. This is a new GUI I have to learn my way around, but so far it look much simpler than 4.8.

I didn't have any problems w/ the installation. I had some trouble downloading the license file. The first email listed an attachment but nothing showed up to download when I opened the email. A request to support by replying to the first email got me a second w/ a downloadable attachment. I found the instructions on when to doubleclick the license file a bit unclear, but on installation there was a page w/ several options - one being license file w/ a browse button so I could go to the downloaded license.avast file and select it. Easy. The subscription license status page shows I'm good.

I really should have remembered to upload the file IDed as a trojan to jobber to try and verify that it was malicious and not a false positive. I don't know why my avast 4.8 suddenly ceased working - the file reported as a bad image was aswCmnOS.dll and it seemed necessary for both the GUI and the command interface avast - as well as repair and uninstall via Add/Remove. It may just have been a Windows XP thing - critical files going bad w/ no warning and no known reason. A simple reinstallation replacing aswCmnOS.dll may have solved the problem - but no point w/ avast 5 available.

I know viruses target AVs so maybe it was a trojan and it targeted aswCmnOS.dll? A quick scan w/ avast 5 shows no current infection.

Thanks for the quick help.

[polonus]

Hi malware fighters,

There is a repair option here: http://www.techsupportforum.com/microsoft-support/windows-vista-windows-7-support/480093-dwm-exe-bad-image.html

pol

[DavidR]

You're welcome.

Yes, a short period of adjustment will be required for the new UI, but you will soon find it easier and better than the 4.8 GUI.

There could have been a few reasons for the problem with 4.8, corrupt file being just one, malware attack a possibility (but the self-defence module should give some protection against that). But my way of thinking why chase it down in an old version when you can start on the new avast version.