Today's update 0804-13-0 blocks internet access - sens.dll

[Lisandro]

...and what about the other issues?

Which ones?

OisteinR, don't forget to answer me...

[OisteinR]

Well, a lot to find out just now My fourth machine is refusing to start normally, but now I also found an infected sens.dll on this one...
...and trz74.tmp with the same virus. Patched-FF.  Also msfont.dll: Agent-TVS [trj]
Moved the files to chest, and now it looks like it's coming to life...

I was running a complete scan on this computer 2 days ago....
Something very strange is going on.....

[Lisandro]

Moved the files to chest, and now it looks like it's coming to life...

I suggest:

1. Disable System Restore and reenable it after step 3.
2. Clean your temporary files.
3. Schedule a boot time scanning with avast with archive scanning turned on.
4. Use SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
7. Immunize your system with SpywareBlaster or Windows Advanced Care.
8. Check if you have insecure applications with Secunia Software Inspector.

[OisteinR]

Ok, Tech
...back in 3 days....

[Lisandro]

Ok, Tech
...back in 3 days....

We'll be here

[calcu007]

But why you think that this is FP? DLL is really patched (Dll entry point routine contains call to some extra code which is written instead zeros in the original DLL)
; ---------------------------------------------------------------------------
; START   OF FUNCTION CHUNK FOR DllEntryPoint

loc_722B822D:            ; CODE XREF: DllEntryPoint+24j
      call   $+5
      pop   eax
      push   eax
      pusha
      mov   ecx, 54B679FEh
      push   54B6098Ah
      xor   [esp+2Ch+var_2C], ecx
      push   32D50A93h
      xor   [esp+30h+var_30], ecx
      push   esp
      add   eax, 0FFFF8ED6h
      mov   ebx, [eax]
      call   ebx
      pop   eax
      pop   ebx
      popa
      pop   eax
      add   eax, 0FFFF8E7Eh
      mov   ebx, [eax]
      call   ebx
      jmp   loc_722B12CD
; END OF FUNCTION CHUNK   FOR DllEntryPoint
; ---------------------------------------------------------------------------

. W
It can be a false positive because Avast detected as trojan with name Patched-FF. Well, if it is infected then is not a false positive. I scanned mine and it is fine

[sonoud]

I just registered an account and let you know I got the same problem.

I saw many errors in Windows XP system logs in the booting process. All my VPN connections were gone.
Remote Access Control Manager service can not be started with access denied error message. I can not create any new Internet connections.  This is mainly because of sens.dll file.

It's not only me. My other friends said they met the same problem as well.
Thus this is a common problem. Just let everyone know this is a common problem in Windows XP that avast should pay attention to. Nothing else.
 
Please pay attention on this problem. It nearly killed my Windows System and it took me one day to fix the problem.

Thanks a lot.

[alanrf]

I am not trying to downplay the problems you are experiencing  ... but we have one thread in this forum with a small number of participants (just 2) complaining of this problem. 

It may be that many users in one geographical area are failing to complain ... but what else is the avast team to work on?

My sens.dll does not register as infected with avast.

Have you sent a sample of the virus to avast?

[sonoud]

How to collect a sample of virus? how to collect any useful debug information? and where to send?

Right now, i am still using avast. it seems the problem is gone. I am not sure if avast team did anything special to fix this problem.

I am using the latest updates and everything works fine. but I am pretty sure some updates in the past (yesterday or some days before yesterday) made my system network connections broken. It's surprised to see my all VPN connections disappeared in network connections under control panel and unable to create them. and many error messages in the log files. Thanks a lot.

[OisteinR]

I am not trying to downplay the problems you are experiencing  ... but we have one thread in this forum with a small number of participants (just 2) complaining of this problem. 

It may be that many users in one geographical area are failing to complain ... but what else is the avast team to work on?

My sens.dll does not register as infected with avast.

Have you sent a sample of the virus to avast?

One little comment....
How many users do you think report back???
Most users don't even know about this forum, and most people are afraid of complaining on a forum.

None of my friends and family have ever been to this forum.
The last days I have fixed 14 computers with problems after 4.8.  They call me - not avast!  I was the one who recommended avast!
A couple of them were just about to install a virus protection from a competitor...

6 of these computers had an infection [FF-patch] in sens.dll, and there wasn't even a copy of it in dllcache....
Om my computer the System Event Notification Service (sens) even disappeared totally.  Not that I need it anyway...
2 had a dll called msfont.dll with the same infection.
The recommended lists of what to do with re-installation didn't work in most cases.
I always had to start avast in safe mode after install and deselect rootkit and self-defense.
Then, after some reboots the icons on the desktop appeared....
I could then enable rootkit and self-defense. On most of them I had to use the "Delay loading of avast" to make the boot stable.

All are now up running again. 

But please - don't think this forum reflects everything going on in the whole wide world!
Most users are suffering without avast knowing it......and the problem with this is that the worlds best anti virus program could lose a lot of customers....

[alanrf]

I have said everything you just said in this forum long ago.  I support others too.

However, I have also been in this forum when there really is a widespread problem and this place is lit up like a Christmas tree ... so I guess you have not. 

[Lisandro]

How to collect a sample of virus?

It's the file sens.dll itself.

how to collect any useful debug information?

Start with avast log viewer.

and where to send?

virus (at) avast (dot) com
Maybe informing a link to this thread in the email body.

Om my computer the System Event Notification Service (sens) even disappeared totally.  Not that I need it anyway...

Probably avast corrected a false positive detection.

On most of them I had to use the "Delay loading of avast" to make the boot stable.

Well... what's the problem? I had it checked also. If it is a configurable option, if avast can manage the situation... what's the problem?

[OisteinR]

Quote from: OisteinR on Today at 12:21:09 PM
Om my computer the System Event Notification Service (sens) even disappeared totally.  Not that I need it anyway...
Probably avast corrected a false positive detection.
No, the file was infected. I had to download it. I did a file compare, and they were not equal.


Quote from: OisteinR on Today at 12:21:09 PM
On most of them I had to use the "Delay loading of avast" to make the boot stable.
Well... what's the problem? I had it checked also. If it is a configurable option, if avast can manage the situation... what's the problem?
It's no problem, now

[PiCo]

One little comment....
How many users do you think report back???
Most users don't even know about this forum, and most people are afraid of complaining on a forum.

None of my friends and family have ever been to this forum.
The last days I have fixed 14 computers with problems after 4.8.  They call me - not avast!  I was the one who recommended avast!
A couple of them were just about to install a virus protection from a competitor...

6 of these computers had an infection [FF-patch] in sens.dll, and there wasn't even a copy of it in dllcache....
Om my computer the System Event Notification Service (sens) even disappeared totally.  Not that I need it anyway...
2 had a dll called msfont.dll with the same infection.
The recommended lists of what to do with re-installation didn't work in most cases.
I always had to start avast in safe mode after install and deselect rootkit and self-defense.
Then, after some reboots the icons on the desktop appeared....
I could then enable rootkit and self-defense. On most of them I had to use the "Delay loading of avast" to make the boot stable.

All are now up running again. 

But please - don't think this forum reflects everything going on in the whole wide world!
Most users are suffering without avast knowing it......and the problem with this is that the worlds best anti virus program could lose a lot of customers....

I have to agree with OisteinR. Since 4.8v has came out there have been at least 10-15 or more threads about freeze problems, BSoDs, system crawls, slow web speeds etc.

1/3 of my friends at universirty had those problems, but of course since it is a free program they didn't bother much and turned to AVG, Avast! 4.7v or sth else.
I mean since there are many other alternatives for AVs out there (not to mention free like Avira or AVG), only a few people would start a thread here writting about a problem.

There's just sth wrong. Back to studying now  

[Lisandro]

Since 4.8v has came out there have been at least 10-15 or more threads about freeze problems, BSoDs, system crawls, slow web speeds etc.
I mean since there are many other alternatives for AVs out there (not to mention free like Avira or AVG), only a few people would start a thread here writting about a problem.

Yeah... is the price of the improvement. If you keep your antivirus without improvements (new providers, new features...) then people will stay unprotected (bad protected) but happy... it's the price of the ignorance