Avast in hardened mode is stopping many .exe and .sys like crazy

essexboy · 2015-06-12T12:42:58.000Z

Have you set the computer BIOS to have the USB drive as first boot

system · 2015-06-12T12:46:24.000Z

Yup. Actually, I have 3 different USB options to boot in BIOS. I tried them all.

essexboy · 2015-06-12T12:49:18.000Z

OK lets see if we can get the signatures back on the drivers … I have been looking at this and it appears to be unique to xp

[step 1] Navigate to %WINDIR%System32CatRoot2 and locate the file edb.log

[step 2] Click start->run and type services.msc to open the system services dialog, then click OK.

[step 3] Stop the Cryptographic Services service.

[step 4] Rename edb.log to edb.old.

[step 5] Start the Cryptographic Services service.

Reboot and let me know if Avast is now quiet

essexboy · 2015-06-12T12:50:52.000Z

There is also an MS fixit for this https://support.microsoft.com/en-gb/kb/822798

system · 2015-06-13T15:14:26.000Z

I did everything. Now, I just need to wait till the hour when it usually goes crazy. I’ll keep u posted when it happens.

system · 2015-06-16T01:39:21.000Z

Avast is still doing the same, and the computer is taking more time to boot and start up (which was already a lot). Actually, once it starts, it gets stuck on the desktop screen with no icons nor task bar. I have to reset it a couple times to make it work. Also, I get a prompt that says: “Service and HPD loader have encountered a problem and need to close.”

essexboy · 2015-06-16T14:04:48.000Z

That is related to your S3 graphics methinks that your system may be on its last legs

system · 2015-06-16T21:41:26.000Z

It is time to face the truth… The end is near, right? Should I get another computer? Can this one be rescued?

essexboy · 2015-06-17T13:48:17.000Z

Due to the age probably not as the motherboard will probably not be able to handle the newer AGP graphics cards etc…

system · 2015-06-18T12:34:20.000Z

Today, I didn’t get the pop ups from avast in hardened mode for the first time, but I started getting the “threat has been detected” that many people has been getting lately.

I haven’t read their threads, but they all seem to have trouble with svchost.exe and Win32:Malware-gen according to the first page of the forum. That’s what I got 3 times.

Rednose · 2015-06-18T12:44:29.000Z

Hi Attacked2015

Run FARBAR again and post a fresh FRST.txt log so Essexboy can look at it.

Greetz, Red.

essexboy · 2015-06-18T14:06:42.000Z

If it is just svchost then

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-06-19T07:59:58.000Z

Hi!

Should I run it in safe mode?

I have news. I did get the pop ups again, at a different time and twice today. As I said before, it used to happen only once a day, everyday in a period of 2 hours, but now that changed.

I recently got new popups from avast in hardened mode too. It prevented from starting the same .exe that were the object of the threat last night.

essexboy · 2015-06-19T12:01:56.000Z

Normal mode will be best

system · 2015-06-19T14:03:21.000Z

Here it is!

essexboy · 2015-06-19T14:40:22.000Z

Could I have a screenshot of the popup please

system · 2015-06-20T08:50:20.000Z

I got this one (first pic) 3 times, with 3 different objects from F:/ I could only take a screenshot to one of them. PC is too slow.

Then I got like 8 of these with different objects (pic 2)… Same thing, I couldn’t take screenshots to all of them.

essexboy · 2015-06-20T10:06:00.000Z

OK that is in system restore so lets reset them

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

system · 2015-06-20T12:43:53.000Z

Done! Do you need to see the log?

essexboy · 2015-06-20T13:17:55.000Z

Nope not really

Announcements