Application Popup

[east yorkie]

Got the following popup when I booted up today:

Event Type:   Information
Event Source:   Application Popup
Event Category:   None
Event ID:   26
Date:      10/10/2009
Time:      11:41:41
   
Description:
Application popup: Avast! Warning : avast! detected unauthorized modification of this program file
(C:\Program Files\Alwil Software\Avast4\ashWebSv.exe)

Continuing can be dangerous. Run the program anyway?

                              -------------------------------------------------------------------

There were no entries in the Avast log file so I did a repair via Add/Remove programms and re booted, so far the pop-up has not appeared again.  I do not know what caused this problem as all malware scans have come back clean and Avast seems to be working fine.  Is there any other course of action that I should take?  Thanks  

[bobo1]

Have you run a boot time scan to ensure that the computer is clean. Have you got any antispyware software installed eg Spybot Search and Destroy etc. Run this to ensure that you are clean?

[east yorkie]

As I stated all malware/spyware scans have shown the system as clean.

What I want to know is if any unauthorised modification of program file ashWebSv.exe has been made how can I ensure that the web shield is still fully operational and has not been compromised in anyway.  

[Lisandro]

What I want to know is if any unauthorised modification of program file ashWebSv.exe has been made how can I ensure that the web shield is still fully operational and has not been compromised in anyway. 

Can you try to repair your installation?
Go to Control Panel > Add/Remove programs > avast! antivirus > Remove. Then choose Repair function in the popup window (Repair).
If this does not help, can you uninstall / boot / install / boot again?

[east yorkie]

Thanks for your reply Tech.  I carried out an installation repair and all appears to be fine I was considering removing/reinstalling Avast but I think I will leave it be and just keep an eye on things for now as all providers appear to be working fine.

One thing I did noticed was that my Avast file in C:\Program Files is 506MB which seems a lot, is that about right?

[Lisandro]

It depends on which logs, temporary files, dumps, reports are stored and, mostly, the skin folder and the VRDB (\data\int folder).

[east yorkie]

The biggest file I have is aswAr1.log which is 390587kb and then the next largest is 400.vps which is 29053kb.  Would a reinstall be a good idea or is it best to leave well alone?  Thanks for your help.

[DavidR]

My aswAr.log (no aswAr1.log) is only 28KB, so I'm somewhat surprised to find your a massive 390MB are you sure that is right.

I don't know why you have an aswAr1.log, my aswAr.log only contains information on the last anti-rootkit scan and is overwritten next time it is run.

[east yorkie]

My aswAr.log is 59KB but the entry for aswAr1.log is 390587KB (381MB) also it will not open in Notepad.  Any suggestions?   Thanks

[Lisandro]

Never heard about aswAr1.log...

[DavidR]

It is too big to open in notepad, wordpad might work but I doubt you would glean any useful info from that.

Check the file properties of both files and see when they were last modified, I suspect one of them may not be in use regularly. I don't believe if they were removed it would cause an issue as avast should recreate it/them.

I don't like deleting anything right off, so first disable the avast self defence module (Program Settings, Troubleshooting, disable self-defence) and rename them aswArOld.log and aswAr1Old.log.

Now reboot, after 8 minutes avast should run the anti-rootkit scan and create any log file required. Give it a reasonable time 10 minutes or so to check for the presence of the newly created aswAr log/s. If at least aswAR.log is there I would say it is safe to delete the renamed aswArOld.log and aswAr1Old.log files.

Now you should enable the self-defence module by reversing the previous steps.

[east yorkie]

Checked the properties of both files which showed they were last updated on the 13th October 2009.  I will now follow your suggestions and will let you know later today how I get on.  Thanks for your help.

[DavidR]

You're welcome.

[east yorkie]

BTW The aswAr1.log file was created on 12th December 2008 whilst the aswAr.log file was created on 7th May 2008.  Seems strange as I thought it would have been the other way round!

[DavidR]

If for some reason a file isn't present or corrupt I can only assume it would create another, if aswar.log is there then perhaps that is where the 1 bit comes in. Though how it got to this size is beyond me.