Don’t know what the board etiquette here is - when I thought to post on a thread titled the same, I got this message:
Warning: this topic has not been posted in for at least 20 days.
Unless you’re sure you want to reply, please consider starting a new topic.
So, I am posting a new topic.
To the reason for the post - This morning, I accessed a hacked page of anonplus.com and within 5 minutes got a BSOD
While I am running a boot scan, I thought to check here and read previous posts about aswSP.sys - BSODs and saw that the reason for the BSOD was related to the anti-rootkit functionality of Avast.
Do I need to be concerned that a rootkit has been installed or am I just being paranoid?
The machine is running XP SP3 with the current AvastPro.
I should also tell you I uninstalled Avast Free ( I thought that I was running Pro then remembered that I couldn’t reorder Pro due to the purchasing process erroring out when there was no place to put in my state >:( - another issue, another time ) and was able to download aswMBR.exe.
I then reinstalled the Avast Free and it BSODed before I could get this written - so I uninstalled it again, ran aswMBR.exe.
Below is the output of running aswMBR.exe
aswMBR version 0.9.8.978 Copyright(c) 2011 AVAST Software
Run date: 2011-08-10 08:44:12
08:44:12.625 OS Version: Windows 5.1.2600 Service Pack 3
08:44:12.625 Number of processors: 2 586 0xF0D
08:44:12.625 ComputerName: AUM UserName:
08:44:16.375 Initialize success
08:44:31.406 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-1
08:44:31.406 Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 3
08:44:31.421 Disk 0 MBR read successfully
08:44:31.421 Disk 0 MBR scan
08:44:31.421 Disk 0 unknown MBR code
08:44:31.421 Disk 0 scanning sectors +976768065
08:44:31.468 Disk 0 scanning C:\WINDOWS\system32\drivers
08:44:33.359 Service scanning
08:44:33.671 Service vsdatant C:\WINDOWS\System32\vsdatant.sys LOCKED 32
08:44:34.171 Modules scanning
08:44:44.890 Disk 0 trace - called modules:
08:44:44.937 ntkrnlpa.exe CLASSPNP.SYS disk.sys iastor.sys hal.dll
08:44:44.937 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0x86d4a030]
08:44:44.937 3 CLASSPNP.SYS[f76c6fd7] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-1[0x86d47028]
08:44:44.937 Scan finished successfully
08:45:37.734 Disk 0 MBR has been saved successfully to “C:\Documents and Settings\RSAS\My Documents\MBR.dat”
08:45:37.734 The log file has been saved successfully to “C:\Documents and Settings\RSAS\My Documents\110810_aswMBR.txt”
[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in netsvcs
%SYSTEMDRIVE%*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs
No traces of malware showing there which is good - just for my peace of mind I would like to do one further check on the MBR
Areyou still getting the crashes ?
Please download MBRCheck.exe to your Desktop. Run the application.
If no infection is found, it will produce a report on the desktop. Post that report in your next reply.
If an infection is found, you will be presented with the following dialog:
[QUOTE]Enter ‘Y’ and hit ENTER for more options, or ‘N’ to exit:
[/quote]
Type N and press Enter. A report will be produced on the desktop. Post that report in your next reply.
I am running a dual boot system with Mepis 11. I have had this setup for the past six months and long before getting the BSOD.
I am not getting crashes as I do not currently have Avast installed. As I explained previously, when Avast was installed I was able to boot into a desktop and then ~ 5 minutes later I would get the above referenced BSOD.
I have been only activating the wireless connection to check here and, as you may have seen, have AdBlock Plus and NoScript running. I also have not been using my mail client while I am exposed.
Thanks for your ongoing help and patience as I work through this issue.
Your comment to do a clean install triggered an idea. I did a system search for ‘avast’ and found the remnants of previous installations and deleted them.
Then I downloaded a new copy of avast via cnet ( as the avast download page came up with a 404 ).
While XP was shutting down it installed 8 updates/upgrades. I am assuming these were for avast.
The system ran for about half and hour fine until it BSOD with the below screen
Why the need to use registry cleaners for Avast old (un)installations?
Clean your web browser’s cache and download the latest stable Avast setup from Avast’s official website (if it works) or from http://www.filehippo.com (for example).
Try http://www.avast.com/uninstall-utility instructions (maybe better under Windows Safe Mode), and use the new setup just downloaded to reinstall anew. Reboot between EACH step, including after the latest Avast installation finishes.
My only thought was that since I have been using Avast Pro since at least version 4, perhaps there are remnants of previous installations making life difficult for me now, so …
Rebooted back into Safe mode
Selected Avast 6 Free/Pro
Showed that files removed
Shut down Windows
Rebooted back into Safe mode
Selected Avast 4 Free/Pro
Showed that files removed
Shut down Windows
Rebooted back into Safe mode
Selected Avast 5 Free/Pro
Showed that files removed
Shut down Windows
Rebooted back into Safe mode
Selected Avast 32
Showed that files removed
Shut down Windows
Rebooted to normal desktop
Ran setup_av_free.exe ( version 6.0.1203.0 )
So far so good, though while typing this an Avast “Suspicious Files Found” window popped up
Suspicious files have been detected ( using a heuristic method). This may be a sign of malware infection. Please allow the files to be submitted to our virus lab for analysis.
Further information
File name
C:/Documents and Settings\RSAS\...\sessionstore-103.js
with the Ignore / Delete options in the Actions To Take box available
I am leaving it open until I hear back from you about your advice regarding Ignore/Delete
So the good news is that I have been able to type this post without seeing a BSOD and possibly may have found an issue ( the Suspicious File Found window popped up about the same time that the BSOD usually showed up )
