A-Squared found a Trojan in AVAST Home Edition executable

Viruses and worms
1

Can someone knowledgeable give me advice on what is happening?
Emsisoft A-Squared found this Trojan-Crypt!IK in Avast’s ashserv.exe.

Even though I tick the radio button in A-Squared to Exclude Avast from A-Squared protection, A-Squared
still returns the same Alert.

Is this a false positive?

Finally, do you think I should just use Emsisoft A-Squared as a scanner-on-demand rather than on-access protection as I think A-Squared is conflicting with Avast.

This problem only happened this past week and I’m getting frustrating with the Alert.

Any help would be appreciated.

Attached screenshot showing the Alert and the path of the infection:

http://i47.tinypic.com/fegz9c.jpg

2

A-squared is full of them.

Finally, do you think I should just use Emsisoft A-Squared as a scanner-on-demand rather than on-access protection as I think A-Squared is conflicting with Avast.

using more than one on-access scanner is a bad idea.

3

Definetly FP, A-Squared is full of them

using more than one on-demand scanner is a bad idea.
On-demand ones are fine (many use Avast+MBAM), but however resident ones conflict with each other, and using more then one resident scanner is bad.
4

Another reason to NOT trust in a-squared TONS of false positives.
Anyway, two scanners at the same time could conflict. That is an avast temporary file.
By the way, why are you still using version 4.8 ::slight_smile: Upgrade :slight_smile:

5

Thanks Everyone, for the help.

So, it is a FP from A-Squared and it targets ashserv.exe everytime it creates a temporary executable file.
What I showed in the screenshot is just one of the temporary files that ashserv.exe creates.

I’m turning off on-access resident protection for A-Squared. In fact, I’ve half a mind to uninstall it since
it is prone to FS and there it is tedious to analyse which alert is a FS and which one is not.

6

I tried A-squared myself for a few days, and like you said, it gets tedious researching false postives.

So I uninstalled it. MBAM and SAS on demand is good enough for Me.

Sat

7

Hi Tech,

Is this the latest version? Avast Free Antivirus 5.0.545.100524
It is from this link: http://www.avast.com/free-antivirus-download

Can I just simply download and install this version without the need to un-install the present version 4.8 that I’m having?

I really do not know why I’m still using version 4.8. Every now and then, I’ll click “Update” at the system tray. I’ll faithfully update iAVS as well as update Program. I have no idea version 5 is available, as Avast did not prompt me.

Please kindly advise. Thanks.

8

Hi Saty,

What is SAS? Do you mean SuperAntiSpyware from http://www.superantispyware.com ?

I’m using another anti-malware software known as SpywareBlaster and of course Sybot & Destroy.

9
  1. Direct link for the latest free version (5.0.545): http://files.avast.com/iavs5x/setup_av_free.exe
  2. Usually yes…!
    asyn
10
  1. LIES. You have to remove the current version (rather, update) in order to install new one
11

wrong, 13th, asyn is correct. installing avast 5 over 4.8 is fine

12
wrong, 13th, asyn is correct. installing avast 5 over 4.8 is fine
correct, it will then also read the register info from avast 4.8

but some have lots of problems after installing it this way, so i would go for the uninnstall first and then install V5

13

@ bigspanner

yes, My mistake, SAS is superantispyware, your link is correct.

Spyware Blaster is a good immunization tool. Im not to sure if Spybot search and destroy is any good, as I dont use it, and havnt really seen it recommended here.

Usually you can upgrade to 5 on top of 4.8, I did, and didnt have any problems. if you have problems you’ll need to do a complete unistall via the control panel. Which is usually enough, if not the removal tool will need to be used. There’s been different steps in doing this exactly so if you have problems, just ask and someone will help you.

Sat

14

I’ve two questions.

  1. Most likely I’ll be un-installing version 4.8 using Revo Un-installer. That means, I’ll be removing the program as well as all the leftover files. My question then is what will happen to those Quarantined files in Avast Chest? Will these files be deleted during the un-install?

  2. I’ve a licence key for version 4.8. Can I still use the same licence key for version 5?

Thanks in advance.

15

Id suggest if your liscence key is up todate on 4.8 to upgrade on top with 5, the update should read your key and carry over.

if you do need to get unistall 4.8 yourself, those files in quarentine go along with it, no worries.

Sat

16

No good choice anymore…!
Also some users reported problems running it together with avast 5.
So you better drop it before installing the new avast.
asyn

17

Yes. The virus definition are from today although. You need to update them.

The setup will invoke the 4.8 uninstall. Anyway, I’d rather suggest an installation from scratch:

  1. Download the latest version of avast! Uninstall Utility and save it.
  2. Download the latest avast! version and save it.
  3. Uninstall avast from Control Panel (if possible). If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after that.
  4. Run the avast! Uninstall Utility saved on 1. If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after you’ve run it.
  5. Install avast! using the setup saved on 2. Boot.
  6. Register your free copy or add the license key for Pro.
  7. Check and post the results.
18
  1. Download the latest version of avast! Uninstall Utility and save it.
  2. Download the latest avast! version and save it.
  3. Uninstall avast from Control Panel (if possible). If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after that.
  4. Run the avast! Uninstall Utility saved on 1. If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after you’ve run it.
  5. Install avast! using the setup saved on 2. Boot.
  6. Register your free copy or add the license key for Pro.
  7. Check and post the results.

Can I skip step 3 and proceed with step 4 in safe mode. After step 4 is finished, can I boot normally instead of boot in safe mode?
Then proceed to step 5 to install Avast! and after that, boot normally again.

I am installing the free version of Avast! and not the Pro version.

I’ve Online Armor as my firewall, so I presume I’ll have to turn it off before I do the un-install and the install of Avast!, correct?

19

Why not going the normal way before going the special+ way…??
asyn

20

Do in normal Windows booting. Go to Safe Mode only IF it fails.

Not necessary. It could be on.