Problem post install (aswCmnOS.dll)

Avast Free Antivirus / Premium Security
1

Have installed Avast (Home) on son’s machine post major virus infection (now appears clear). Getting windows warning on boot for Ashdisp.ex that aswCmnOS.dll cannot be found and that reinstalling may fix. Ran your remove module and reinstalled and have the same. Previous AV was AVG but I have uninstalled and cleared that from folders and reg and used ccleaner for that too. Z Alarm firewall running.

He was (pre infection) on XP SP2 but I have put him up to SP3. Dell Inspiron desktop. We have now sorted several issues with .net frameworks but still have issues with some Win updates not installing. Apologies for all this guff but I wish to give you the full picture!

2

Try this first - AVG8.x (or higher) Remover, download tool from here, http://www.avg.com/download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.

Then try a repair of avast. Add Remove programs, select ‘avast! Anti-Virus,’ click the Change/Remove button and scroll down to Repair, click next and follow. This has in the past resolved this out of sync issue between reported and actual VPS version.

If the problem still exists then you may not be completely clear of the infection, see #### below.

avast! icon missing - As a temporary measure until this is resolved you can create a desktop shortcut for this file C:\Program Files\Alwil Software\Avast4\ashDisp.exe (the avast icon and interface to the providers). Right click on the file and select Send To, Desktop (create shortcut). You will need to run this after each boot until the problem is resolved.

What other security based software do you have that might block new startup entries, e.g. Spybot S&D (TeaTimer), AdAware (AdWatch), SpySweeper, Spyware Doctor (StartUpGuard or OnGuard), PrevX, WinPatrol, ProcessGuard, etc. ?

Check the option in the Appearance tab of Program Settings. Or Make a link to ashdisp.exe in your startup folder. I wouldn’t try this as a first option (but a final one) as you won’t be able to find the true cause of the problem.

If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

3

Hi Guys first time on, can you help? I downloaded avast a few weeks ago but yesterday I decided to register not as simple re copy paste re key as I have windows 7 and get no blue avast balloon at bottom right of page like my old outlook used to so any advice?
ta,

4

I suggest an installation from the scratch:

  1. Download the latest version of avast! Uninstall Utility and save it.
  2. Download the latest avast! version and save it.
  3. Uninstall avast from Control Panel (if possible). If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after that.
  4. Run the avast! Uninstall Utility saved on 1. If, for any reason, you can’t run it, try booting in Safe Mode and doing it from there. Anyway, boot after you’ve run it.
  5. Install avast! using the setup saved on 2. It will be good to accept the boot time scanning. Boot.
  6. Insert the license key you’ve got.
  7. Check and post the results.
5

Cheers mate will give it a try.

6

DavidR - thanks for that - I had seen those options on this forum before. The only one I have not done is to double-ensure I ‘killed’ AVG and will do that today.

MBAM and SAS were used to attack the infection, and I also ran combofix and have run sfc since. (It was a particularly bad attack showing both Virut and Vitro among other more minor ones). We already have the desktop icon and ‘rotating balls’ in the sys tray are there. Every virus scan I run including a boot scan with Avast, House Call, MBAM and SAS are showing clean. Boot scan is not enabled now and none of those progs run on startup.

What other security based software do you have that might block new startup entries, e.g. Spybot S&D (TeaTimer), AdAware (AdWatch), SpySweeper, Spyware Doctor (StartUpGuard or OnGuard), PrevX, WinPatrol, ProcessGuard, etc. ?
 Z Alarm only

Check the option in the Appearance tab of Program Settings. Or Make a link to ashdisp.exe in your startup folder. I wouldn’t try this as a first option (but a final one) as you won’t be able to find the true cause of the problem.

All ‘appearance’ items ticked. I had put ashdisp.exe into startup at one point - I will make sure it is out but there is now only one call in MsConfig startup.

Would the setup.log be of any use to you?

7

The setup log isn’t particularly helpful in regard to the tray icon.

Virut/Vitro are particularly aggressive file infectors once established and if you got away without having to reformat and start from square one you would be considered lucky. Whilst DrWeb is supposed to be able to repair some of these, the process of infection can damage the file so that even after repair the file might not work.

So we will see if the AVG removal tool helps restore the avast icon (you would obviously have to reverse the addition to the start-up folder to check.

8

Thanks David - just finished a Teamviewer session on his machine and:-

I discover I HAD placed shortcuts in his ‘All Users’ startup folder, because the Avast ‘balls’ were not appearing in the sys tray a few days back. S/cuts removed. NO MORE WINDOWS WARNING ;D

The Update issue I discover was a common one - Sec update for Win Xp SP3 KB 9520679 which seems to plague many. For anyone else’s benefit we have fixed it after much work by updating WMP 9 to 11 and the sec update has gone away.

Appreciate your time - and I am ALMOST confident that I am a ‘lucky one’ with Vitro/Virut! I hit them hard with lots of resources, but time will tell as we all know.

Case closed for me. I should add in praise of Avast that a boot scan pulled scores of Windows system files which had to be SFC’d. Most grateful!

9

No problem, glad I could help.

A belated welcome to the forums.