Avast going nuts after today's update (solved)

system · 2006-11-02T06:06:23.000Z

Hello. I’ve just registered here to report the same problem.
I’m a home user of Avast but a really careful one. Really careful about my internet and files.

I was playing a game using my wheel tonight when the auto update happened.
A short time after that i’ve got the report that wmjoyfrc.dll, located at windows\system32 was infected by a worm:

NetSky-BG

Man… i uninstalled my wheel (that .dll is used by the wheel, it is a Logitech Force Feedback something heh…) at once and then went nuts on the next two hours scanning my system using possible means.

Turned out pristine clean every time…
And then even after i downloaded the wheel driver again from Logitech, Avast would come and tell me it was infected again heh…

So yeah, i’m pretty sure it’s not infected and that we need a fix for it, i"ll wait.
But in the mean time there’s anything that i can do to “ignore” that and at least make use of my wheel again? Tomorrow is a holiday and i would like to play my racing games hehe!

Thanks for your time!

And i’m sorry about my poor english, i’m from Brazil.

Cheers.

system · 2006-11-02T06:17:23.000Z

Meanie post:9:

Hello. I’ve just registered here to report the same problem.
I’m a home user of Avast but a really careful one. Really careful about my internet and files.

I was playing a game using my wheel tonight when the auto update happened.
A short time after that i’ve got the report that wmjoyfrc.dll, located at windows\system32 was infected by a worm:

NetSky-BG

Man… i uninstalled my wheel (that .dll is used by the wheel, it is a Logitech Force Feedback something heh…) at once and then went nuts on the next two hours scanning my system using possible means.

Turned out pristine clean every time…
And then even after i downloaded the wheel driver again from Logitech, Avast would come and tell me it was infected again heh…

So yeah, i’m pretty sure it’s not infected and that we need a fix for it, i"ll wait.
But in the mean time there’s anything that i can do to “ignore” that and at least make use of my wheel again? Tomorrow is a holiday and i would like to play my racing games hehe!

Thanks for your time!

And i’m sorry about my poor english, i’m from Brazil.

Cheers.

a temporary fix is to pause or stop the standard shield. it seems to re-enable disabled apps

alanrf · 2006-11-02T07:56:26.000Z

In the avast Standard Shield click the Customize button > Advanced tab …

There is a box where clicking the “Add” button will allow you to add the path and filename of a file that you want to be excluded from avast scanning. You can add the filename that you believe to be a false positive so that you can continue normal operation until the avast team have a chance to take care of a false positive in an upcoming VPS update.

system · 2006-11-02T08:57:09.000Z

Thanks a lot for the prompt support

system · 2006-11-02T10:57:49.000Z

Have encountered nothing but problems since update…ie-Logitech worm warnings. Made exception for Logitech folder, and above mentioned .dll file…all working again now. Please fix this…thanks.

system · 2006-11-02T11:31:32.000Z

JimC1702 post:1:

…

The first one was wmjoyfrc.dll.
…

Same here ???

system · 2006-11-02T12:51:56.000Z

My problem has been already fixed with new VPS 0645-1

system · 2006-11-02T14:40:47.000Z

the latest update, did not fix my problem.

system · 2006-11-02T17:14:11.000Z

I’m having problems too! I am careful on the internet and last night for the FIRST time with Avast, it turned up FOUR problems. One was related to Dell’s MyWay Search Assistant they install on new pcs, two were dll files associated with two ISP programs on my pc that have dial-up accelerator features, and one was buried somewhere in the system restore folder (which I couldn’t even find with windows explorer).

The newest update today 645-1 did NOT fix the problems. Avast is still indicating these same files as threats.

Avast, PLEASE check into this.

system · 2006-11-02T17:21:43.000Z

Will91 post:17:

One was related to Dell’s MyWay Search Assistant they install on new pcs

Could this be a genuine detection?

Castle Cops
Dell Fourums

Are a couple of links amongst many others.

Lisandro · 2006-11-02T17:49:22.000Z

Will91 post:17:

Avast is still indicating these same files as threats.

To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com

Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

system · 2006-11-02T20:32:59.000Z

Hi:

I don’t think these files are real threats at all. Two of them were dll files associated with my ISP dial-up accelerator folders. One was in Earthlink (which I use) and the other was in Netscape (which I don’t use but was on the pc from Dell). The third file was another dll that Avast found in MyWaySA. I understand this is some sort of search assistant put on the pc by Dell BUT Avast has never flagged this one before either. The fourth file was something I couldn’t make heads or tails out of…it was in the System Restore folder and I couldn’t even view it with Windows Explorer.

I tried to email the dll files to Avast but for some reason it keeps saying access denied. I don’t know what to do about this if I can’t cut and paste them into an email to Avast or some of the other recommended places. What should I do about that??

Again, I still think there is something strange with the recent Avast updates as I believe these files have always been on the pc and Avast has NEVER flagged them before even with the most rigorous, thorough scanning feature selected.

Lisandro · 2006-11-02T23:06:49.000Z

Can you check if with the last VPS 645-3 the false positives are still round?

system · 2006-11-03T02:19:23.000Z

I sure will.

This is two versions newer than what auto-installed this morning. Were some corrections made at Avast regarding some of these issues??

I’m looking forward to updating this on my home pc tonight and checking results. I’ll be holding my breath!

alanrf · 2006-11-03T05:07:50.000Z

I think that we can guess, given the frequency of the updates, that the avast team has been responding to the concerns about false positives.

Tech, like you and me is a user of avast … Tech provides his vast knowledge of avast to help other users but, in moments like this, I suspect his guess is as good as yours or mine.

system · 2006-11-03T05:25:58.000Z

Will91 post:20:

I tried to email the dll files to Avast but for some reason it keeps saying access denied. I don’t know what to do about this if I can’t cut and paste them into an email to Avast or some of the other recommended places. What should I do about that??

Try to sent it like a zip password rpotected archive
EDIT:
Or try to use this form on http://www.avast.com/i_kat_72.php?lang=ENG

system · 2006-11-03T06:00:19.000Z

Thank you everyone.

Good news and bad news.

First of all, the newest update no longer says that the two dll files associated with my two ISP programs are threats.

The bad news is that Avast is still saying there is something suspicious about two files in my C:/System Volume Information. It has NEVER reported this before. I can not find this folder with Windows Explorer but here are the two file names as reported by Avast. I also tried a search on the A0015775.dll files including hidden folders but it couldn’t find it either. The first one says “infection Win3” and the second one says “unable to scan”

C:\System Volume Information_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP108\A0015775.dll INFECTION Win3
C:\System Volume Information_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP39 UNABLE TO SCAN

system · 2006-11-03T07:15:30.000Z

Hi!
Do this:

disable system restore
schedule the boot time scanning & reboot
boot up again & ran a full system scan
enable back system restore.

DavidR · 2006-11-03T13:10:17.000Z

As avatar2005 says, the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points.

As for the one that was unable to be scanned is not a problem, as well as being told it can’t be scanned, avast will also say why it couldn’t be scanned, why couldn’t it be scanned ?

There are many legitimate reasons why a file can’t be scanned. Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others (and avast doesn’t know the password or have any way of using it even if it did know it).

Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

system · 2006-11-03T22:03:56.000Z

Hi:

Could someone please give me a little more information on clearing the system restore?

I think I can find the screen where it can be turned off, but what is meant by “schedule the boot time scanning & reboot”? I’m going to need some idiot-proof step by step instructions here. I’m using Windows XP.

Also, after I do this, does this mean my Windows Restore points will be lost so that if I wanted to go back in time, this will not be possible? What could Avast have found in this System Volume Information folder (which I now understand is assocatied with the Restore Feature).

thanks

Announcements