Boot scan

Does someone know how I can only scan memory at boot time ?

I have avast!4.

Sincerely.

Let me guess, you have to execute:

“C:<avast folder>\Ashquick.exe” “*STRT-MEM-SHORT”

  1. You can put a link for this into the StartUp folder
  2. You can set it into Run section on Windows Registry

If “at bootime” means “from the avast! boot-time scanner”, than I guess you can’t do it. I think it wouldn’t have much sense anyway - the viruses would not be active (in memory) at this moment.

Yesterday, when I’ve lauched “avas! antivirus” it has detected a virus while scanning memory and startup items. But I’ve received previously me message.

It asked me for boot-scan and I answered Yes. When I started my computer again, Avast has scanned the PC for viruses. Nothing was found.

Can someone explain me why I didn’t got message, and why it has found someting wrong ?

Thank you for an answer.

Do you remember what virus did avast! announce when scanning your memory (and startup items) - and maybe what was the filename?
What did you do with the warning message - you only selected “Schedule boot-time scan” and restarted immediatelly, nothing else?

Sorry, but I don’t remember what avast! announce and I’ve not written it.
It seems me it has asked if I want to scan or repair ( or something like that ) and I’ve chosen to schedule boot time scan and restart.
If I’ll have such case in the future, I’ll write the informations avast! give and what all what I do.

Is someting written in logs when avast! detect virus ?

Sincerely.

Thank you for the ashquick …

Is it possible to launch it before Windows starts and is there other parameters than “*STRT-MEM-SHORT” ?

Thank you for your help.

Sincerely

What exactly do you mean by “before Windows starts”?

When I turn my PC on, it tells me the version of BIOS ( I can hit Del ) indicates the amount of RAM. I would like to start Ashquick at this moment ( if possible ) before launching Windows ( autoexec, start… ).
I’m under Windows XP home edition

Sorry, it’s not possible.
The avast! boot-time scanner is a special NT module - which can be executed before the full OS is loaded. The aswQuick program, however, is an ordinary Win32 application - it cannot be started that soon.
I don’t know for sure, but I think the boot-time scanner doesn’t support the special areas (such as the scan of “startup” items). As I already said, scanning the memory doesn’t have much sense at this moment (i.e. it’s not supported either I guess).

Igor, if you read again my post you will see I said to use ashquick at ‘login’ time (by the link at startup folder) or ‘after’ the OS is lauched (by the Run Registry Command)…

You’re right, the ashBoot.exe won’t scan anything if you manually delete the ‘area’ to be scanned into Windows Registry, nor even the memory and won’t make much sense to scan at this time.

Maybe the user can use avast 7.0 for DOS but it will be a little complicated to configure the Windows XP boot to do it… :wink:

I’ve inserted a link in Startup menu and all is OK.
Is it possible to gie Ashquick other parameters than
STRT-MEM_SHORT

ashQuick program is the Explorer Extension that, just like avast! and ashCmd, is a scanner for viruses. It is usually used to scan files from the local context menu, e.g. from Explorer. In other cases, it is better to use avast! or ashCmd.

For ashCmd commands, see help file in topic ‘ashCmd Program’
I think ashQuick does not allow so many ‘others’ parameters. This one is a ‘secret’ from our guru (Vlk) :stuck_out_tongue:

I have the free version of avast! ; I haven’t found ashcmd ( in same folder than ashquick )

ashCmd (the command-line scanner) is really not avaialble in the Home version, it’s limited to Professional version only.

As for the other “secret” areas… you may try *STARTUP-SHORT to scan the startup items for the current user (i.e. the modules loaded in memory are not included, unlike *STRT-MEM-SHORT) or *STARTUP that will scan the startup items for all the users (sometimes, it may take a while to load the registry hives for the other users).

How, some un-documented features or secrets are being revealed… 8)
Thanks Igor.

Sorry gtaillandier, I do not realize that you are not using the Profesional version… :cry:

I added ashavast.exe to startup programs, it loads the (pre-simple interface) splash screen up and scans memory and startup programs once there all started after booting.

I noticed that the screen saver can scan memory block, whilst ashavast.exe only scans programs in memory and startups. The screen saver scan picks up win32:sqlslammer worm in memory block but the ashavast.exe scan doesnt. So I assume memory block is different to programs in memory.

In avast home, to scan entire memory, including the blocks, you can run

ashQuick.exe “*MEMORY”

That will be equivalent to the scan that the Screen-Saver is doing.

Vlk

thanks,

So is the following correct, to sum things up: (parameters)

“*STRT-MEM-SHORT” memory & user startup
“*MEMORY” memory blocks and memory
“*STARTUP-SHORT” user startup
“*STARTUP” all users startup

Can more than one session be used at startup ie “*MEMORY” then “*STARTUP”.

I assume user/all user startup scans means all applications, as it appears to scan programs that arent actually started during startup process.

Cheers

I just tryed giving ashquick.exe 2 parameters and it appears to work in one session “*MEMORY” “*STARTUP” COOL ;D

When I select “Schedule boot-time scan”, the program starts correctly.

I haven’t found the entry in Windows Xp registry, can you give me the full key name.

Is it possible to add a parameter such “*STRT-MEM-SHORT” ?