Avast shutdown during scan

[grkline]

I have Avast 4 Home edition.  I did a full system scan today (and yesterday) and I got an audible alert, and at the same time, the Av program shuts down. A pop up screen came up with option to send explanation data to the Avast administrators.
I did this, but I received a undeliverable message from the mail system admin. 

Any Idea of what may be happening.

PS-

I recently had the spylocked Trojan. According to Spybot Search and destroy, this has been removed.  I ran an executable AV program (Dr.Web cure-it) and it says no virus detected.

[Lisandro]

We will need more information to be able to help you:
- Which OS are you using? Is it up to date?
- What avast! version? 4.7.1001?
- What was the filename and path where the virus was found?
- Do you use a firewall? Which one?
- Do you have any other antivirus installed in your system?
- Any other security programs that could interfere?
- Anything into avast logs? Run avast log viewer.

[grkline]

First, I have always had successful scans.(in the past) on this system

OS is win 98SE - as up to date as possible.

no other (resident) av programs

no firewall

no log entry because Avast shut down during scan

NOTE:  I uninstalled and then reinstalled Avast. Ran the scan and same thing happened.  I do have the log entry as follows:
Sign of "Win32:Adware-gen. [Adw]" has been found in "c:\RECYCLED\DC8.EXE" file.

Note: I emptied the recycle bin and re-ran scan with no problem.

However, this still does not explain why the program shut down when it encountered a suspected virus.

Thanks- GK

[DavidR]

There are a lot of hits for dc8.exe in a google search, http://www.google.com/search?q=DC8.EXE, it may have been that there were other elements to this.

It may simply have caused a problem with system resources and the system crashed. This dc8.exe is seen as being associated with a trojan and for trojan hunting a more specialised application is worth a look at.

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode.
1.  a-Squared free if using win98/ME.

You might also consider this:
Please download SmitfraudFix - This one has a combined removal tool with instructions, http://siri.urz.free.fr/Fix/SmitfraudFix_En.php

Download and SmitfraudFix, print and follow the instructions on that web page.

Before doing any of the above it would be advisable to backup any data, programs, etc.

[grkline]

FYI- Up to now have run spybot s&d ; a-squadfree ; cwshredder; all say I am clean, however, I still have a "spylocked" icon in the tray.  I would like to run smitfraudfix as you suggested. I d/l the program to the desktop, then it installs to a folder on the desktop, but when i click on the file, it apears that a dos window opens quickly (in a split second) and dissapears. I can't seem to run this program. Is it possible that it is not for win 98se? please advise.

Thanks - grkline

[DavidR]

I don't know there is a restriction on the OS when running smitfraudfix, I checked on the web page link I gave you and it looks like it is win2k and winXP, so unfortunately it won't run on win98.

I believe there may be an add remove entry for SpyLocked, check and if present try an uninstall, though I'm not that hopeful. Check out this spylocked removal tool which is supposed to work with win98 also, http://www.download.com/Free-SpyLocked-Removal-Tool/3000-8022_4-10694925.html. If no joy next step below.

HIJACKTHIS - Program & Tutorial - Also useful as a diagnostic tool - Download HiJackThis.zip HJT has now been sold to Trend Micro inc. but the 1.99.1 version should still be available here or at one of the download sites. - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2

Post the contents of the hijackthis log file here.

On-line analysis - HiJackThis Log file - On-line Analysis OR HiJackThis Log file - On-line Analysis 2
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.

[grkline]

Thanks for the response.  FYI- acording to Adaware; spybot s&d;A-squared;Dr.web cure-it;and cws shredder, I am clean!! However, I still have the blinking shield icon (spylocked) in my task bar. This is a link to the SL web site. cant get rid of it.

I would like to include a HJT log but I can not get HJT to run. I keep getting the following:

runtime error 50003  - unexpected error

I am using a new up to date version. 

any suggestions?

PS- There was a time abouit a year ago, that HJT would run on this computer. Dont know what has caused this inability to run.

[Lisandro]

I would like to include a HJT log but I can not get HJT to run. I keep getting the following:
runtime error 50003  - unexpected error I am using a new up to date version. 
any suggestions?

Scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

[DavidR]

I would like to include a HJT log but I can not get HJT to run. I keep getting the following:
runtime error 50003  - unexpected error I am using a new up to date version. 
any suggestions?

Did you read one of the tutorials and follow the instructions, like not installing in a temporary location, etc. ?

I see you said you are using a new up to date version, I take it you mean the Trend Micro version 2.0 'beta' version ?
If so I would suggest you download the 1.99.1 version, the link to the zip file I gave earlier.

Also see this on the runtime error 50003 unexpected error for MS, http://support.microsoft.com/support/kb/articles/Q194/4/14.ASP

[grkline]

FYI-

Since my last post, SWI forums has helped me remove the complete "spylocked" infection.  In as much as I am still unable to run the HJT program, I will inform you that I have just completed an AV scan with AVAST that ran to completion without shutting down. 

However, I am not sure, because the shutdown problem was occuring when the AV program indicated it had encountered an infection.  It may just be that there are no infections now, and the program runs to completion. In order for me to know for sure, I will have to wait until the next time AVAST encounters a infection.  I it still runs to completion, then I know everything is OK.   

Thanks for all your help so far. Any suggestions.

PS- still get the "unexpected error" with HJT

[DavidR]

Did you not try the spylocked removal link I gave you in Reply #5 or didn't it work ?

Other than the MS link on the error 50003 KB article, I'm at a lose on other ideas.

[grkline]

Regarding my problem with Avast shutting down, I ran a full system scan yesterday and during the scan the program shut down. The error report screen came up indicating Avast encountered a problem and I can input what was happening at the time aqnd send the report. I did that, but I got a return "undeliverable" message.

PS: The spylocked trojan is gone completely.
I still can not produce a HJT log. ( I am currently getting advise from SWI forum on the HJT problem)


Any suggestions on why the Avast program is shutting down

gkline
Thanks-

[DavidR]

Sorry there really isn't enough information to even guess.

If you can paste the complete contents of any windows event viewer if one was created.

[Lisandro]

The error report screen came up indicating Avast encountered a problem and I can input what was happening at the time aqnd send the report. I did that, but I got a return "undeliverable" message.

You should configure the SMTP settings of avast. Program settings > SMTP.

I still can not produce a HJT log.

Why not?

Any suggestions on why the Avast program is shutting down

Please, check the folder <avast>\data\log
Are there any files called unpXXXX there  (where XXXX is a random number)?
If so, send them to vlk (at) avast.com
They may contain more information about the problem (maybe a link to this thread).

[DavidR]

I still can not produce a HJT log. ( I am currently getting advise from SWI forum on the HJT problem)

Have you checked out these tutorials, as Tech said what is the reason you can't, error messages, etc. ?

HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2