Hello,
I downloaded a file: “CD Utils” and scanned it with Avast (home edition, recently updated). It showed no problems. When I ran the “run” exe I immediately got a balloon saying Avast was disabled and I had no virus protection. I tried running Avast and got a message saying, “ashAvast.exe is not a valid Win32 application.” I took a look at the file and saw that the ‘modified’ date was just now. In fact, watching it, I saw that it was being modified every few seconds!
So I tried a couple of other scanners I have with the same results. It’s even happening to Hijack This.
So I tried rebooting in safe mode; Nope. My PC keeps rebooting until I choose Normal Mode. Also, when I boot up an explorer window come up showing my documents and settings. I looked in msconfig and saw nothing unusual in the startup. I know because I had been looking at the startup entries recently.
So . . . does anyone know anything about this? Am I doomed to format my C:?
I’m afraid it isn’t particularly good news - Your system is infected, probably by a variant of beagle that tries to disable anti-virus programs, the error you mentioned appears to be one of the signs of that.
I tried running Avast and got a message saying, "ashAvast.exe is not a valid Win32 application."
I took a look at the file and saw that the ‘modified’ date was just now. In fact, watching it, I saw that it was being modified every few seconds!
So because of this modification it may indicate that it has got past the self-defence module and this is another pointer to a variant of beagle.
As you are finding it is disabling other security applications also.
Commonly this is hidden by a rootkit, so you can try these tools.
That is just one of the tools, keep trying in the hope one gets through, you should also send this to avast.
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
I’m wondering here, how come Self-Defense didn’t help here? I know it can still be bypassed like any other thing out there but this easy?
Or maybe he turned off Self-Defense…
There is one beagle variant that I know of that can get past most AVs including avast’s self-defence. Hopefully they will get the sample to analyse and combat the element that is effectively disabling avast.
First of all, I didn’t turn Self Defense or anything else off.
Ok. Here are the results of my efforts thus far.
Online scanners:
Kaspersky - Scans but does not repair anything.
ESET - Found the virus but only in the file I downloaded, “CD Utils.rar”.
It deleted that file but did nothing for the system which is still infected.
Bit Defender - I cannot get to their online scanner. It shows a EULA with an “Accept” button but clicking that does nothing. I am awaiting a response to my email to their support service. They acknowledged the email and said I will be contacted within 48 hours.
Trendmicro house call - Another app that scans only; no repairs.
F-Secure - Will not load and run. Says I don’t have some authority needed. (I am the administrator of this PC)
Bootable CDs:
Dr. Web - Boots but doesn’t do anything. Am I missing something here?
Bit Defender - Boots and goes through its installation process until it gets to “Trying to update Bit Defender Scanner . . .” then hangs for a bit before rebooting itself to normal Windows.
F-Secure - This one ran successfully. It took a few hours and it did find a couple of viruses hidden in some things I don’t ever use (got them in case I ever needed, glad I didn’t). But it did not detect the Beagle or Bagle virus.
I have not yet tried the other bootable CDs but will be doing so as you read this. I also will get another copy of the Cd Utils file and send it to Avast in a password protected RAR. I’m not sure how I would put it in the Chest without the use of Avast.
If there is ANYTHING anyone can think of for me to try I am able and willing. I would REALLY rather not format my C: and have to reinstall 111 gig of applications that I need daily. I really appreciate your efforts and whatever further assistance you might have for me.
sepulchre, you did a huge job trying to cleaning…
I wish avast team take a look in this dangerous virus that, for years, is the weakness of avast installation, destroying it.
The better would be trying to improve avast detection of this particular variant of Beagle.
Do you have any known file that is infected with it?