Author Topic: Application Popup  (Read 9779 times)

0 Members and 1 Guest are viewing this topic.

east yorkie

  • Guest
Application Popup
« on: October 11, 2009, 12:46:15 AM »
Got the following popup when I booted up today:

Event Type:   Information
Event Source:   Application Popup
Event Category:   None
Event ID:   26
Date:      10/10/2009
Time:      11:41:41
   
Description:
Application popup: Avast! Warning : avast! detected unauthorized modification of this program file
(C:\Program Files\Alwil Software\Avast4\ashWebSv.exe)

Continuing can be dangerous. Run the program anyway?

                              -------------------------------------------------------------------

There were no entries in the Avast log file so I did a repair via Add/Remove programms and re booted, so far the pop-up has not appeared again.  I do not know what caused this problem as all malware scans have come back clean and Avast seems to be working fine.  Is there any other course of action that I should take?  Thanks  
« Last Edit: October 11, 2009, 12:49:23 AM by east yorkie »

bobo1

  • Guest
Re: Application Popup
« Reply #1 on: October 11, 2009, 09:19:56 PM »
Have you run a boot time scan to ensure that the computer is clean. Have you got any antispyware software installed eg Spybot Search and Destroy etc. Run this to ensure that you are clean?

east yorkie

  • Guest
Re: Application Popup
« Reply #2 on: October 12, 2009, 08:50:48 PM »
As I stated all malware/spyware scans have shown the system as clean.

What I want to know is if any unauthorised modification of program file ashWebSv.exe has been made how can I ensure that the web shield is still fully operational and has not been compromised in anyway.  
« Last Edit: October 12, 2009, 08:52:21 PM by east yorkie »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Application Popup
« Reply #3 on: October 12, 2009, 09:00:42 PM »
What I want to know is if any unauthorised modification of program file ashWebSv.exe has been made how can I ensure that the web shield is still fully operational and has not been compromised in anyway. 
Can you try to repair your installation?
Go to Control Panel > Add/Remove programs > avast! antivirus > Remove. Then choose Repair function in the popup window (Repair).
If this does not help, can you uninstall / boot / install / boot again?
The best things in life are free.

east yorkie

  • Guest
Re: Application Popup
« Reply #4 on: October 13, 2009, 08:55:35 PM »
Thanks for your reply Tech.  I carried out an installation repair and all appears to be fine I was considering removing/reinstalling Avast but I think I will leave it be and just keep an eye on things for now as all providers appear to be working fine.

One thing I did noticed was that my Avast file in C:\Program Files is 506MB which seems a lot, is that about right?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Application Popup
« Reply #5 on: October 13, 2009, 09:18:42 PM »
It depends on which logs, temporary files, dumps, reports are stored and, mostly, the skin folder and the VRDB (\data\int folder).
The best things in life are free.

east yorkie

  • Guest
Re: Application Popup
« Reply #6 on: October 13, 2009, 11:24:22 PM »
The biggest file I have is aswAr1.log which is 390587kb and then the next largest is 400.vps which is 29053kb.  Would a reinstall be a good idea or is it best to leave well alone?  Thanks for your help.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Application Popup
« Reply #7 on: October 14, 2009, 12:21:43 AM »
My aswAr.log (no aswAr1.log) is only 28KB, so I'm somewhat surprised to find your a massive 390MB are you sure that is right.

I don't know why you have an aswAr1.log, my aswAr.log only contains information on the last anti-rootkit scan and is overwritten next time it is run.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

east yorkie

  • Guest
Re: Application Popup
« Reply #8 on: October 14, 2009, 12:47:49 AM »
My aswAr.log is 59KB but the entry for aswAr1.log is 390587KB (381MB) also it will not open in Notepad.  Any suggestions?   Thanks

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Application Popup
« Reply #9 on: October 14, 2009, 01:09:56 AM »
Never heard about aswAr1.log...
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Application Popup
« Reply #10 on: October 14, 2009, 01:10:43 AM »
It is too big to open in notepad, wordpad might work but I doubt you would glean any useful info from that.

Check the file properties of both files and see when they were last modified, I suspect one of them may not be in use regularly. I don't believe if they were removed it would cause an issue as avast should recreate it/them.

I don't like deleting anything right off, so first disable the avast self defence module (Program Settings, Troubleshooting, disable self-defence) and rename them aswArOld.log and aswAr1Old.log.

Now reboot, after 8 minutes avast should run the anti-rootkit scan and create any log file required. Give it a reasonable time 10 minutes or so to check for the presence of the newly created aswAr log/s. If at least aswAR.log is there I would say it is safe to delete the renamed aswArOld.log and aswAr1Old.log files.

Now you should enable the self-defence module by reversing the previous steps.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

east yorkie

  • Guest
Re: Application Popup
« Reply #11 on: October 14, 2009, 01:21:55 AM »
Checked the properties of both files which showed they were last updated on the 13th October 2009.  I will now follow your suggestions and will let you know later today how I get on.  Thanks for your help.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Application Popup
« Reply #12 on: October 14, 2009, 01:25:51 AM »
You're welcome.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

east yorkie

  • Guest
Re: Application Popup
« Reply #13 on: October 14, 2009, 01:29:01 AM »
BTW The aswAr1.log file was created on 12th December 2008 whilst the aswAr.log file was created on 7th May 2008.  Seems strange as I thought it would have been the other way round!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89349
  • No support PMs thanks
Re: Application Popup
« Reply #14 on: October 14, 2009, 01:34:35 AM »
If for some reason a file isn't present or corrupt I can only assume it would create another, if aswar.log is there then perhaps that is where the 1 bit comes in. Though how it got to this size is beyond me.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security