Avast in hardened mode is stopping many .exe and .sys like crazy

essexboy · 2015-06-09T13:17:27.000Z

You have Avast set to aggressive hardened mode

fetn63.sys VIA Rhine Family Fast Ethernet Adapter
Viprt.sys VIA SATA IDE Device Driver
VIA SATA IDE Driver. Vibus.sys

These are old via drivers and as such are no longer prevalent on the Avast data base

So disable the aggressive hardened mode or allow those files as exceptions

system · 2015-06-09T13:31:39.000Z

What about WinRAR, arpproducticon.exe, and all of the others? Avast has always been in hardened mode and this is the first time something like that happens. Should I allow everything?

essexboy · 2015-06-09T13:50:28.000Z

The main thing is the lack of signatures on your files. The only way around that will be to either re-install XP or install SP4
http://www.msfn.org/board/topic/171171-introducing-unofficial-windows-xp-sp4/

system · 2015-06-10T11:03:41.000Z

Reinstalling XP is not an option, so I tried installing SP4 from the link. Once it started, Avast detected 3 threats. I cancelled the installation.
If the files are not signed, is it possible to know if those are the “real” ones or if they are infected files? Was the computer clean or infected before what I got during the installation of SP4? Should I throw everything away and sit down and cry? :-[

Edit
The computer was too slow before for me to attach screenshots, but now I have a few. New things are popping up, like dc23.exe and dc24.exe.

essexboy · 2015-06-11T10:33:00.000Z

Lets run a second opinion check, I do not believe though that it is malware

Create an emergency repair USB drive:
Download Dr Web Live USB to your desktop

[]Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
[]Launch drwebliveusb.exe.
[*]The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).

https://dl.dropbox.com/u/73555776/liveusb_ru.jpg

[]To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
[]Files will be copied automatically.
[]Once the copying process is completed, press the Exit button to close the application.
[]Reboot the infected computer with the USB in the drive
[]Ensure that the first boot device is USB - If you are not sure about that then see this page for instructions
[]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

https://dl.dropboxusercontent.com/u/73555776/Live%20boot%20screen.png

[*]Use arrow keys to select DrWeb-LiveCD (Default)

https://dl.dropboxusercontent.com/u/73555776/drwebselect.JPG

[*]Press select objects for scanning

https://dl.dropboxusercontent.com/u/73555776/drwebfolders.JPG

[*]When the system is loaded, check the disks or folders you want to scan, and click on Start.

[*]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so

https://dl.dropboxusercontent.com/u/73555776/drwebscan.JPG

[*]When it has completed

https://dl.dropboxusercontent.com/u/73555776/drwebscancomplete.JPG

[]Select Open Report and copy to the USB
[]Once completed reboot to normal windows, and attach the report here

system · 2015-06-12T09:44:19.000Z

I tried several times, and it was unsuccessful. I do not get the screen in which I can choose DrWeb-LiveCD (Default). I followed the steps carefully, but I don’t know what is wrong.

essexboy · 2015-06-12T12:42:58.000Z

Have you set the computer BIOS to have the USB drive as first boot

system · 2015-06-12T12:46:24.000Z

Yup. Actually, I have 3 different USB options to boot in BIOS. I tried them all.

essexboy · 2015-06-12T12:49:18.000Z

OK lets see if we can get the signatures back on the drivers … I have been looking at this and it appears to be unique to xp

[step 1] Navigate to %WINDIR%System32CatRoot2 and locate the file edb.log

[step 2] Click start->run and type services.msc to open the system services dialog, then click OK.

[step 3] Stop the Cryptographic Services service.

[step 4] Rename edb.log to edb.old.

[step 5] Start the Cryptographic Services service.

Reboot and let me know if Avast is now quiet

essexboy · 2015-06-12T12:50:52.000Z

There is also an MS fixit for this https://support.microsoft.com/en-gb/kb/822798

system · 2015-06-13T15:14:26.000Z

I did everything. Now, I just need to wait till the hour when it usually goes crazy. I’ll keep u posted when it happens.

system · 2015-06-16T01:39:21.000Z

Avast is still doing the same, and the computer is taking more time to boot and start up (which was already a lot). Actually, once it starts, it gets stuck on the desktop screen with no icons nor task bar. I have to reset it a couple times to make it work. Also, I get a prompt that says: “Service and HPD loader have encountered a problem and need to close.”

essexboy · 2015-06-16T14:04:48.000Z

That is related to your S3 graphics methinks that your system may be on its last legs

system · 2015-06-16T21:41:26.000Z

It is time to face the truth… The end is near, right? Should I get another computer? Can this one be rescued?

essexboy · 2015-06-17T13:48:17.000Z

Due to the age probably not as the motherboard will probably not be able to handle the newer AGP graphics cards etc…

system · 2015-06-18T12:34:20.000Z

Today, I didn’t get the pop ups from avast in hardened mode for the first time, but I started getting the “threat has been detected” that many people has been getting lately.

I haven’t read their threads, but they all seem to have trouble with svchost.exe and Win32:Malware-gen according to the first page of the forum. That’s what I got 3 times.

Rednose · 2015-06-18T12:44:29.000Z

Hi Attacked2015

Run FARBAR again and post a fresh FRST.txt log so Essexboy can look at it.

Greetz, Red.

essexboy · 2015-06-18T14:06:42.000Z

If it is just svchost then

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-06-19T07:59:58.000Z

Hi!

Should I run it in safe mode?

I have news. I did get the pop ups again, at a different time and twice today. As I said before, it used to happen only once a day, everyday in a period of 2 hours, but now that changed.

I recently got new popups from avast in hardened mode too. It prevented from starting the same .exe that were the object of the threat last night.

essexboy · 2015-06-19T12:01:56.000Z

Normal mode will be best

Announcements