Avast...Problem with updating

[bearclaw37]

Where to start............

I believe that I saw a post similar to my problrm but there was no response so hopefully someone can help me!!!!

I have used Avast 4.7 home edition for a few years.  I have been experencing problems with my computer, slowness etc but some of that could be the age of my comp which is almost 5 years old and may need more ram. Anyway, Lately I had Avast detect some type of win 32 worm I believe.  Sorry, I didn't write it down or copy it, just going from memory.  I ran a whole system scan and it came up with one or two infected files which I promptly deleted.  However, I still have Avast detecting infected files.  I have only moved them to the chest and didn't delete them yet.  Should I be using your worm removal tool?  The reason I ask that is that these past two days, I have had Avast have a red pop up screen saying something about my program not updating or a problem downloading.  The next screen that comes up is the Avast antivirus setup which listes the summary as:

Information about current update:
Last encountered error: The package is broken.

Total time: 5:25

- Vps: Updated
  (previous version: 000724-0, updated version: 000724-1)

Server: download37.avast.com (67.19.85.138)
Downloaded files: 5 (7.47 KB)
Download time: 48 s

Is there something wrong with my Avast or does it have to do with the infected files or worm?

[Lisandro]

Two infected files which I promptly deleted.

The better and safer is always send the infected files to Chest for further analysis... then you can post the name and path of the files, the name of the viruses... etc.

However, I still have Avast detecting infected files.  I have only moved them to the chest and didn't delete them yet.

Can you post name, path and virus name?

[bearclaw37]

Thanks for your quick response and sorry about posting twice.

Here is the information as listed in the chest.  Hopefully this is what you are looking for, there is 5 different files:
Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp267316844.tmp
FileID: 0000000055  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\vsamguii.dll  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp267316844.tmp\55.dll

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp267316844.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp267316844.tmp\55.dll  Win32:VBStat-C [Trj]
------------------------------------------------------------------------------------------
Action was completed successfully!


Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp105043608.tmp
FileID: 0000000054  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\tbnddpgi.exe  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp105043608.tmp\54.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp105043608.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp105043608.tmp\54.exe  Win32:Trojan-gen. {Other}
------------------------------------------------------------------------------------------
Action was completed successfully!


Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp143358889.tmp
FileID: 0000000056  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\srkfkkck.exe  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp143358889.tmp\56.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp143358889.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp143358889.tmp\56.exe  Win32:Trojan-gen. {Other}
------------------------------------------------------------------------------------------
Action was completed successfully!



Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp214315074.tmp
FileID: 0000000058  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\ndilwpni.dll  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp214315074.tmp\58.dll

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp214315074.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp214315074.tmp\58.dll  Win32:VBStat-C [Trj]
------------------------------------------------------------------------------------------
Action was completed successfully!


Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp78076947.tmp
FileID: 0000000057  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\brsplvkd.exe  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp78076947.tmp\57.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp78076947.tmp
C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp78076947.tmp\57.exe  Win32:Trojan-gen. {Other}
------------------------------------------------------------------------------------------
Action was completed successfully!


Sorry that the info is so long as scanning and then copying and pasting the detailed info was the only way that I could figure out
Thanks again.

[Lisandro]

Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\vsamguii.dll
Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\tbnddpgi.exe
Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\srkfkkck.exe
Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\ndilwpni.dll
Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\brsplvkd.exe

Look, all files are temporary.
Clean your temporary files. You can use the Windows Advanced Care features for that or CCleaner.

After that, can you run a full scanning and post any info about infected files here?

[bearclaw37]

I know that they are in the temp folder but why am I still getting them or where are they coming from?  Avast places them in a temp folder when they are found, doesn't it? 

In the begining, I had cleaned out my temp folders and ran avast. Then I got more warnings (the ones listed below).  I downloaded the windows advanced care as you suggested.  I had also previously used AVG antispyware and smitfraudfix. I ran avast but to my understanding, because I didn't request for a saved copy of the scan results before I ran avast, there was no data saved from it.  also after I last ran avast and thought that my computer was good, I ended up with another warning (the most recent) and once again it is located in the temp folder:


Scanning of selected files
------------------------------------------------------------------------------------------
Program will try to scan 1 selected file(s) in the Chest

Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp85038675.tmp
FileID: 0000000059  Original file name: C:\DOCUME~1\marcie\LOCALS~1\Temp\muxmjotm.exe  New folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp85038675.tmp\59.exe

Scan files in the temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp85038675.tmp
------------------------------------------------------------------------------------------
Action was completed with errors!


I am gonna run another scan and try to make sure I get a copy unless you are expecting something fromm the avast log viewer?? 
Thanks

[Lisandro]

Why am I still getting them or where are they coming from?

If a virus is replicant (coming and coming again), you should:

1) Enable/Disable System restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k.

2) Clean your temporary files. You can use the Windows Advanced Care features for that.

3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

4) It will be good if you download, install, update and run other trojan remover tools: a-squared and/or Free AVG Antispyware (trojan removers). Some users recommend SUPERantispyware or Spyware Terminator.

5) Use the immunization of Windows Advanced Care features of spyware/adware cleaning and removal.

Avast places them in a temp folder when they are found, doesn't it?

When they're scanned, not when they're found. I mean, you can move to <avast>\data\<moved> folder or move to Chest.
 
Move files to temporary folder: C:\DOCUME~1\marcie\LOCALS~1\Temp\_avast4_\unp85038675.tmp
Is the one used while scanning.

[roadkill_aus]

I'm also having problems in updating but it appears to be something different. I have two PC's at home using Avast home both running 4.7. One of the PCs updates perfectly and the other began to fail a couple of days ago. The report in the setup log is telling me that the license key is invalid!

The PC is an IBM ThinkCentre 2.8 Ghz P4 I picked up through a friend as part of a clearance of surplus machines from business just before Christmas . I loaded a fresh install of XP Pro. I then downloaded a new copy of install files from Avast and applied for a separate license key for this PC when it was set up.

Last night I applied for a new license number but this hasn't fixed the problem, the new key number is still reporting as invalid.

Here is the last part of the log. I have modified the key number. The log is showing 18 characters as is the key number in the registration area of the program. The last piece of the key after the hyphen appears to disappear in both the program and the update log. However when using the copy past technique in registering the program accepts the key number. 


20.03.2007 19:42:15 package: GetPackages - set proxy for inet
20.03.2007 19:42:15 internet: SYNCER: Type: use IE settings
20.03.2007 19:42:15 internet: SYNCER: Auth: another authentication, use WinInet
20.03.2007 19:42:15 general: Used server: http://download40.avast.com/iavs4x
20.03.2007 19:42:16 general: Used server: http://download40.avast.com/iavs4x
20.03.2007 19:42:16 general: Part of license key: xxxxxxxxxxxxxxxx
20.03.2007 19:42:16 general: progress end - 1
20.03.2007 19:42:16 general: Err:The license key for this product is invalid

Is this a common problem? Could reinstalling the program fix this problem?

I have been using Avast for several years without any major problems. I have also set it up for several friends and helped them update license keys as they expired. So I am used to the way keys are entered.

Thanks in advance.

[Forejt]

In About dialog and setup.log, you can see only first part of license key, that's correct (for security reasons).

Can you compress the whole avast4 folder (including subfolders) and send it to me? Either to my email or upload it to ftp://ftp.avast.com/incoming (this ftp is write-only, you won't see any files there, but upload should be successful).
If it's too big for uploading, send me at least files prod-av_pro.vpu, jollyroger.vpu and setup.log from avast4\setup

After that, you can reinstall program (uninstall, restart, install), this should fix it. You don't have to register again, just put the latest license key into avast.

[roadkill_aus]

Thanks for the prompt help. I have started the upload as a zip file. I have included the winxip log as I hadnt closed avast (it mightnt update but it is still working.) as the PC is permenantly conected to the web. I dont seem to have captured setup.log.

FTP has calculated to be nearly an hour off finishing. I might have a reasonable download speed but upload is as slow as.

Roadkill

[Forejt]

Thanks, it will be helpful. Please send also exported registry key "HKEY_LOCAL_MACHINE\Software\Alwil Software" to my email (you'll see it in my profile).

[Forejt]

I don't need the registry now.
The problem is in incorrectly downloaded file jollyroger.vpu that contains blacklisted licenses, making your license invalid.
You don't have to reinstall, just try update to update if the file will be downloaded correctly.
Or download the file here:
http://files.avast.com/iavs4x/jollyroger.vpu
And copy to avast4\setup folder. Then try update again.

[roadkill_aus]

Woo hoo  I'll let the log summary speak for its self.

Information about current update:
Total time: 56 s

- Program: Already up to date
  (current version 4.7.942)
- Vps: Updated
  (previous version: 000724-1, updated version: 000726-0)

Server: download65.avast.com (207.44.172.117)
Downloaded files: 9 (423.50 KB)
Download time: 12 s

Thanks
Roadkill

[bearclaw37]

Hi tech,
I had disabled my system restore and ran the windows advanced as well as attempted to run a boot scan but once it started, it said that there was an error with my keyboard and to push the ESC to by pass the scan.  The scan then proceeded to list what files it would of scanned with the number zero next to it.  I try this twice with the same results.  I also tried to run the scan in safe mode but I could not get the computer into safemode.

Once avast had completed it's normal (not in any mode)scan of the comp It listed it's results  as this:

 avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Wednesday, March 21, 2007 11:39:08 PM
* VPS: 000726-1, 03/21/2007
*

C:\WINDOWS\system32\ggejwpdu.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest...
C:\WINDOWS\system32\gvohhigh.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest...
C:\WINDOWS\system32\odvxlljy.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest...
C:\WINDOWS\system32\rsbpdbma.exe [L] Win32:Trojan-gen. {Other} (0)
File was successfully moved to chest...
C:\WINDOWS\system32\vaejriba.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest...
C:\WINDOWS\system32\xbwtlwbk.dll [L] Win32:VBStat-C [Trj] (0)
File was successfully moved to chest...
Infected files: 6
Total files: 319677
Total folders: 5410
Total size: 25.2 GB

*
* Task stopped: Thursday, March 22, 2007 7:30:40 AM
* Run-time was 7 hour(s), 51 minute(s), 32 second(s)
*

What do you suggest?

[DavidR]

1. You probably have a USB keyboard (?) and your BIOS doesn't support it at boot, you can change the BIOS to enable support for USB devices at boot, unfortunately the chicken and egg scenario kicks in, you can't adjust the BIOS as the USB keyboard isn't enabled. If you have an old PS2 keyboard or can borrow one that may work and allow you to do a boot-time scan and or change the BIOS settings.

I'm a little surprised that the ESC key worked if the keyboard input previously didn't work.

2. You have done the right thing, 'first do no harm' don't delete, send virus to the chest and investigate.  I did a google search on all those file names detected and none of them return any hits, which in itself is suspicious, they look like randomly generated file names, see 4. below.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

3. If you are able to resolve the problem with the keyboard at boot time as I mentioned schedule a boot-time scan and if it is clear you can enable system restore again.

4. What we have to consider is what generated these infected files with random file names. If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode. The fact you can't get into safe mode may also be an indication of malware blocking that option. http://www.pchell.com/support/safemode.shtml

Ewido, a.k.a. avg anti-spyware If using winXP. or a-Squared free if using win98/ME.

[bearclaw37]

Thanks david for your response and all of your helpful responses!

Yes, I do have a wireless keyboard and mouse, unforunately, our old one was chucked as the keys were sticking horribly(thanks to my kids and bringing beverages to the comp) anyway, we opted for a wireless in an attempt for less wire cluttered in the back of the computer. I'm sorry but I'm not sure what you mean by changing the BIOS, how could I see if it can be done?  Yes using the ESC key didn't make sense to me either as my key board is working fine otherwise; unless as you suggested, the maleware could be preventing me from starting in safe mode....I tried atleast 10 failed attempts last night .

The other funny thing I noticed is since I have a win xp, I also have my daughter as another user.  She is only 8 and usually goes on my user account for her games, but upon opening hers and going on the net, I had pops coming on like crazy, not to mention the false security warnings with some company begining with 'win' in the title (sorry, I don't remember the rest as I just kept canceling it) even though my pop up blocker is set at the highest level on hers.

A few weeks back, my older and very inexperienced niece was downloading some "files" in a p2p program.  She also mentioned ( in another incident)  something about a window poping up and telling her to downloaded what ever it was (if I got her story correct).  I think she did but I haven't noticed any new programs listed.

I do have AVG but my memory is so high (need more ram) that I don't really run it as my comp is really slow with too many programs running.

Any other ideas or should I just wait a few weeks and then delete the files?

Thanks again!