I have Windows XP and was recently running McAfee until my virus scan hung up last week. Could not complete a scan of the system since. Based on conversation with a friend, I uninstalled McAfee and am now running Zone Alarm with Avast.
After installing Avast, it rebooted and ran the boot scan. There it encountered 35 files that generated error messages, 8 of which were "0xc00000 3E {Data error} and the balance of which were Error 42003 {Internal program error}. My system is still running very, very slow (although the task bar shows that it is using virtually no resources).
Can anyone provide me with information about these error messages and what they mean? They relate to various files, none of which appear to be Avast files.
David, I ran the tools and then rebooted in safe mofe and ran a scan. I received two infection warnings related to Win32:Klez-H and stating in the log that the files could not be repaired. How do I remove these from my system. Also, I received warnings on the files noted in my last post that they could not be run due to system error. There were also many other warnings that files could not be scanned because they were password protected (I’ve seen some of the other posts on the forum related to that).
Also, after scanning I tried to open the Chest and received a message for intialization that the action was completed with errors. When I go to the Errors Report tab it states “Program cannot use Chest client” (null) followed by an arrow on the next line and “Description: Virus chest server is not runnin, RPC communication failed.”
Can you give me some guidance with these issues? ???
When you said you ran the "tools" ( plural ), I am unsure IF you mean you ran BOTH McAfee
Removal Tool(s) !? There is one for the 2006 products, that DavidR quoted, and a different
one for the 2007 products ( MCPR ).
What you are reporting appears to be a "trojan", best handled by a product that "specializes"
in them . You have NOT mentioned IF you have any antiSPYWARE/antiTROJAN program(s) on
your computer !?
IF not, I recommend you install the FREE version of "SUPERantispyware" from
www.superantispyware.com . After installation, update it, then run its "Full Scan" .
I contacted the techs at McAfee and asked them for the programs that clean their software off my system. I downloaded them (one for each part - Virus scan, personal firewall, etc.). I also run spybot from time to time as my spyware. Many of the Spybot files showed up as password protected in the log scan.
Does avast have a tool to remove? Also, Adaware and Webroot’s Spy Sweeper were recommended to me. Any thoughts on them?
Repair is unlikely to work, but you should be able to send them to the chest. What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
If you have XP or Win2k, you could enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, Menu, ‘Schedule boot-time scan…’ However, since you have other issues (possible bad install) this may not work, see 3. below.
Many programs (usually security based ones) password protect their files for legitimate reasons such as AdAware and Spybot Search & Destroy, there are others (and avast doesn’t know the password or have any way of using it even if it did know it).
When you run scans with the above programs and you delete harmful entries that they detect, a copy is kept (in quarantine/restore/backup) in case you need to reverse what you did. These are usually password protected, you should do some housekeeping and delete old backup/recovery/quarantine entries (older than two weeks or so), this will reduce the numbers of files that can’t be scanned.
By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.
Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.
Because of the issues of possible McAfee elements still remaining avast might not have successfully installed. It may be best to try a reinstall of avast, uninstall, reboot, install, reboot.
Among some in the antiSPYWARE "community", Spybot's "quality" has fallen recently.
AntiSPYWARE Expert Eric Howes has "dropped" it to his "find useful" category, below the others
that he rates "higher"; see www.spywarewarrior.com/rogue_anti-spyware.htm#trustworthy .
I have on my computer : 1) Ad-Aware Personal ; 2) Ewido, now known as AVG Antispyware ;
3) FREE ver of SUPERantispyware . I also have the "Prevent"-type antispyware program called
"SpywareBlaster" from www.javacoolsoftware.com/spywareblaster.html .
SpySweeper seems to be the equivalent of a "Security Suite", which I avoid. Why pay for a
program when there are equally good, some of them better than some of the "components" of
SpySweeper, programs that are FREE . Would NOT advise using SpySweeper's "Rootkit"
Detection "component" and there is some question as to their "Spy Shield" .
Thanks. I found the removal tool and am running it now on my desktop (fortunately my laptop still works!). I can’t give you complete details on the because I made the mistake of closing the scan report to go look at the Chest and see what the options were w/r/t the virus. That’s when i encountered the errors with the Chest.
After I run the virus tool, I’ll reboot and uninstall/reinstall Avast and then do another safe mode scan. By the way, Avast did do a boot scan when I fist installed it and that’s when I got the error messages first reported above. Still don’t know what those mean (assuming McAfee remnants are now gone from the system).
I’ll let you know what comes back after the above steps.
Spiritsong, thanks for sharing your thoughts on the spyware software.
Now I’m really confused. I ran the virus removal tool and the scan it performs said no files were infected. Is it possible the two files previously detected somehow ended up in the Chest (even though I received an error message when I went to open it) and that’s why the removal tools doesn’t see them?
Whilst it is possible that the files originally found might have been dealt with, It may have been something else that the error related to. But without a file name and location it is difficult to say and difficult to check subsequently.
Scans run in safe mode might not reveal something that isn’t active in safe mode, e.g. something injecting code into another process and that is what is being detected by the resident scanner and not the originating file, but that is speculation as I have nothing to work on.
Anything that was in the chest is now gone after an uninstall, so no way of checking their or from the avast Log Viewer, Warning section.
OK, I reinstalled and ran the scan again, this time not in safe mode. It came back with no infected files. However, there were 31 files that could not be scanned. When I tried to move them each one at a time, I received message that “An error has occurred in the processing of 1 result(s).” I did not get this message for one file, a .DOC file, which Avast was able to move to the chest. The result description for that file in the Results of Scan screen was “File is OK.”
With respect to the other 30 files I received the following messages under result in the Results Scan screen:
(A) 5 files read “Unable to scan: The system cannot find the path specified”
(B) 3 files read “Unable to scan: The system cannot read from the specified device” and
(C) 23 files read “Unable to scan: The request could not be performed because of an I/O device error.”
In the results of scan page under Operation, each file for (A) and (C) above had the same message. However, the files in the (B) category had no message, even though I was unable to move them to the chest.
Any additional thoughts on what the problem is? Thanks.
Firstly I wouldn’t advise moving files to the chest just because they can’t be scanned.
Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned. As I have previously said in my other posts.
Whilst (A) seems strange, how could it attempt to scan it if it can’t find the path specified (it must have found something to initially scan). Can you give any examples of the file names and there location ?
As I also asked in previous posts, error messages in isolation don’t provide much to work with.
The (B) is also a similar issue, what were the specified devices, etc. ?
Again with (C) it isn’t possible to give an answer without information on the file names and locations, as to why there might have been any I/O device error, this is similar to the reason given in (B) as it too relates to a device.
The c:\System Volume Information folder is a part of the system restore function and as such is protected by windows, the only way to clean infected _restore points is to disable system restore and reboot. This will clear ALL _restore points. Once you have disabled system restore, reboot, scan your PC again and if clear enable system restore.
However, since these weren’t flagged as infected I wouldn’t worry so much, but there would be no problem in disabling system restore, reboot, enable and reboot, This would clear ALL restore points and then create a new restore point when you enable and reboot. Obviously you would want to be sure your system is clean before re-enabling system restore, other wise moving or deleting any infection in system folders could simply copy that infected file into a restore point.
The (B) items might well have some form of protection relating to Symantec Live Update, do you have any symantec programs installed ?
Did you have Symantec AV previously installed, if so what ?
Sorry I’m at a loss as to why the (C) entries would have a problem unless these dlls are loaded on boot, but the boot scan should get in before that.
Thanks for the feedback. I’ll try the scan after disabling the system restore to be sure.
I did try Symantec’s password protection software at one point, but didn’t like it and uninstalled it. I do have pc anywhere on my system, so I’ll bet there are some shared files for Symantec.
Could registry issues be causing the (C) file errors?
Would encourage you to read our "FAQs", which answers questions like the "Unable to Scan",
located at : www.avast.com/eng/faq-avast-4-home-professional.html .
Using a Good & SAFE Registry cleaner is "Step #4" in my "COMPLETE REMOVAL" of an unwanted
program; Steps #1 & 2 are "uninstall" from "Add or Remove Programs" AND use a product's
"Uninstall/Removal Tool" . Step "3" is use your computer's "Search > All files and folders", using
the appropiate search "term" and "Delete" all appropiate Items. IF any fail to "delete", even
after a reboot, use the Good & FREE "Unlocker" program .
Hi Carkeni :