Runtime Error! (R6034)

[Quelb]

The following Error message was displayed before the Avast! Virus warning was displayed after I visited youareanidiot.org with Firefox 2.0.0.1 on WinXP SP2.

Displaying the Virus warning is OK, but the error should not be displayed.

I use avast! Version 4.7 Home Edition
Build 4.7.892
Xtreme Toolkit Version 1.9.4.0
ActiveSkin Version 4.2.7.3
VPS version is 0701-1

[Lisandro]

youareanidiot.org

Dr. Web could not scan this page:

Can`t fetch file pointed by your url. This may be caused by several reasons:
    * Remote file is not available (not found, requires authentication, permission denied)
    * Remote site is down, or very slow, or busy
    * No network connectivity between Dr.Web online server and remote web-site

Not even with www before...

[DavidR]

McAfee Siteadvisor review of www . youareanidiot.org One reviewer comment reports a virus infection at that site.

However, I was able to check it with DrWeb and shows clean.

With firefox and noscript extension, no avast detection. Other than the infuriating flash presentation, nothing.

[Quelb]

My avast gives the following warning

...
Dateiname: h t t p : / / y o u a r e a n i d i o t . o r g / s c r i p t / y o u . j s
Malware-Name: VBS:Malware [Gen]
Malware-Typ: Virus/Wurm
VPS Version: 0701-1, 05.01.2007
...

so it is clear that there is no alert with noscript extension, because the Problem comes with the JS

[DavidR]

DrWeb link checker also finds a virus in http :// youareanidiot.org /script/you.js a different name but a trojan.no.close. So the detection would appear valid for the you.js file.

VirusTotal also detects it under many names, mainly spawn, windowbomb, noclose, etc.

[Quelb]

Displaying the Virus warning is OK, but the error should not be displayed.

So, as I said, for me it is clear that the virus warning is displayed. But the Runtime Error should not be there.
My questions are:
1 What is wrong that it is displayed?
2 What can I do that it will not be displayed in future?

I already uninstalled avast! and reinstalled it but the error is still there!

(The JS produces 5 Windows that change Position every second, checks if there are 5 Windows open and open new ones if there aren't. Pretty nasty )

[Lisandro]

We need help from the programmers...
The warning is ok as you've said. avast shouldn't crash...

[Vlk]

Quelb, is the problem reproducible? I don't seem able to simulate it here...

[Quelb]

Yes, it is reproducible. Every time I visit the website the error occurs.

[Quelb]

Now I uninstalled avast and used aswclear.exe to clear everything but the Problem is still there after reinstalling (setupger.exe).

German WinXP home SP2

[igor]

So, the error appears after you close the virus dialog with the "Abort connection" button, or even before, when the virus dialog is still visible?

[Quelb]

The first thing I see is the Runtime Error, the dialog with the "Abort connection" button appears after I clicked OK on the Runtime Error dialog.

[Vlk]

Could you please try upgrading to build 4.7.932 and see if it has any effect on the problem?
http://forum.avast.com/index.php?topic=25697.0

Thanks
Vlk

[Quelb]

I have now updated to 4.7.932 and did a reboot. (VPS now 702-0)
There is still the same Error message before the avast! virus alert window opens.

The sound is already played during the error message is displayed.

[Vlk]

I have a couple of more questions:

1. Is Microsoft Visual Studio 2005 installed on your machine?

2. Does the problem happen if, instead of waiting for the virus dialog, you simply double-click the avast tray icon (and the avast on-access scanner dialog appears)?

3. Please try doing the following: download Process Explorer from http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx, simulate the problem (i.e. have the R6034 dialog on the screen), then run Process Explorer, scroll the process tree to ashDisp.exe, press Ctrl+L to display the lower pane, press Ctrl+D to have DLLs in the lower pane, and then click Ctrl+A to save the contents of the window to a text file. Then post the contents of that file (or attach it to your post).


Thanks
Vlk