Avast Detected unauthorized modification of ashserv.exe

[tomogden]

I am trying to install Avast Home 4.7 on a system running XP SP2.  Upon restart of the system, I get an error message.

Avast! Warning

Avast detected unauthorized modification of this program file (c:\program files\alwil software\avast4\ashserv.exe)

Continuing could be dangerous.


Can anyone help me get this software installed and working correctly?

Thanks

[DavidR]

Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?

You might well have an infection responsible for this, were you experiencing problems with malware ?

Is that why you were installing avast ?

What other security based software do you have ?

[igor]

Please send the executable file to virus@avast.com, possibly with a link to this thread.
Additionally, you may submit the file to www.virustotal.com and check what other antiviruses say about this file - it's possible that it's infected by an undetected file infector.

[Lisandro]

tomogden, can you follow Igor's advices?

[reodds]

Hi!  I too received the same notice, rendering the program useless.  I am fairly certain I downloaded a virus or malware.  I have tried most of the online virus scan programs without success.   

When I attempt to reinstall Avast, the installation is allowed, but as soon as it tries to load, the executable file is deleted.

So far, no malware has been detected by any of the other anti virus programs I have tried, but I still cannot install Avast.

I am running a PC clone with an AMD processor, XP Pro sp2, and have been using Avast Home for at least 5 years without any problem.

Help please!

Thanks.

Roger

[DavidR]

Whilst this seems slightly different to other instances it still might be a Bagle Rootkit variant:
See http://forum.avast.com/index.php?topic=26554.0
http://forum.avast.com/index.php?topic=25941.0
This seemed to have the best results with this type of attack and is reasonably user friendly.
http://research.pandasoftware.com/blogs/research/archive/2006/12/14/Rootkit-cleaner.aspx
Also F-Secure Blacklight may not always be available, http://www.f-secure.com/blacklight - Direct line, ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe

[reodds]

Thank you David!  Apparently, I had several RootKits which messed up my machine.  I removed them with AntiRootKit, and it worked beautifully.

I reinstalled Avast without any problem, and now all is back to normal.

Thanks again.

Roger

[DavidR]

No problem, glad I could help.

Welcome to the forums.

Whilst it is a bit late now did you note the files names and locations of these rootkits ?