Help... my ashavast.exe dissapeared !!

system · 2007-02-08T09:46:15.000Z

I use Avast since 3 months and suddenly my avast executable file “ashavast.exe” dissapeared without reason.
I deinstalled Avast with “aswclear.exe” and when I reinstall it the “ashavast.exe” dissipeard again (my desktop icon can not find the exe file).
It seems that I am not the only one with this problem …

Jack

++ To scan my Pc, I installed Spybot and I had the same problem, the “spybot.exe” also
dissapeared ???

DavidR · 2007-02-08T14:29:58.000Z

You almost certainly have a problem, one which as you say has been in the forums and can effect many AVs.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode.

Ewido, a.k.a. avg anti-spyware If using winXP. or a-Squared free if using win98/ME.

This may have a rootkit element to it so it can’t be seen.

BackLight - It can detect rootkits like Rootkit Revealer but can also remove them. http://www.f-secure.com/blacklight/
Panda Rootkit Cleaner - http://research.pandasoftware.com/blogs/research/archive/2006/12/14/Rootkit-cleaner.aspx

system · 2007-02-08T14:58:44.000Z

Thanks for the answer…
For the moment I am scanning my pc with BitDefender.
But I 'll try your solution as soon.

Jack

DavidR · 2007-02-08T15:51:53.000Z

This has been shown to be a beagle variant that comprises a rootkit element to hide it from AVs, if this is the one you mention others having a problem like this.

system · 2007-02-08T17:17:20.000Z

The “Blacklight run” has detected some rootkit files …like
hldrrr.exe
hidr.exe
m.hook.sys

Do you think that it can be the cause of my problem and that I can rename this file without problems and restart ??

DavidR · 2007-02-08T18:36:02.000Z

Almost certainly, the names ring a bell, a search for these files in the forums will confirm this.

If you can send the samples to avast great.
Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject. Or you can also add the file to the User Files (File, Add) section of the avast chest and send it from there (right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest.

Yes you can rename them hldrrr.exe.vir, etc. which is also a method used by avast so it retains the original file name which could help with analysis. However If you know their location try to add them to the user files section of the chest where that can do no harm.

If you can’t send a sample to avast, that’s too bad, the priority is cleaning your system.

Announcements