sf.bin constantly opening and closing slowing down pc

General Topics
1

Hi
ive just upgraded to avast 5 the latest free program from the avast web site

every 2 seconds sf.bin is opening and closing slowing my pc up

why ???

have run a boot time scan pc is free from bugs

how can i rectify this

thanks

steve

2

The SF.bin is the code emulation part of the avast and is downloaded or updated on virus definitions updates.

Try the repair option in the uninstall manager

This is what i read here

http://forum.avast.com/index.php?topic=65566.0

3

Thanks was no repair option so i uninstalled and reinstalled it seems to have worked for now

many thanks

steve

4

The latest version is avast!6 Hopefully that’s what you actually installed.
Welcome to the forum. :slight_smile:

5

its the latest free addition ive installed and its happening again sf.bin constantly opening and closing slowing up pc
if it carries on will have to use a different AV as this is totally un exceptable
shame ive always liked avast

regards

steve

6

You could try disabling code emulation as a work-around.

That is located in Avast! real time shield expert settings, under Sensitivity. Different shields use it, so you would want to disable it on the specific shield that is causing it. I would start with the File System Shield first if its constant whether you are browsing or not.

7

ok tried that in all the shields no difference ???

8

Which Firewall do you use? Any other security software installed? Which Windows version?

I guess Sf.bin is also executed when a suspicious file is detected to do some emulations.

9

windows xp pro sp3
no other firewalls or internet security installed

never had a problem with the older versions of avast

10

Did you do a full scan with Avast? Try it

Try Malwarebytes

http://www.malwarebytes.org/

And do a Full Scan

11

Have done a boot time scan nothing detected will do a full scan now see what happens

12

Hi
have done a boot time scan and a full system scan nothing detected

Have also contacted avast support see what they have to say

thanks for the input

steve

win xp pro sp3 32bit
avast6 free version
no other fire walls or security apps installed

13

@ Puffing
I have watched this topic, but no one has asked why the sf.bin would be active:
The short answer is because files are being scanned and emulation is part of the scanning process, so we have to identify the cause of this activity and even so the sf.bin activity shouldn’t have this kind of performance impact.

So how are you determining that the sf.bin is being opened every 2 seconds, what monitoring program ?

What else are you doing whilst this activity is going on ?

Can you post your system specifications, CPU and RAM ?

Have (or did) you another Anti-Virus installed in this system other than avast (what previous avast installation what version, 4.8, 5.x ?), if so what was it and how did you get rid of it ?

Gargamel360 suggested disabling code emulation and you answered "ok tried that in all the shields no difference." Which is very strange if the code emulation is disabled then the sf.bin effectively shouldn't be called to emulate anything.

Essentially you need to find out which shield is actively scanning whilst these sf.bin occurrences are running as that could pin down which application is causing avast to scan and consequently sf.bin.

^^^^
It may be that you need to do a 'clean' reinstall and ensure all remnants of a previous installation of avast are gone. But we will cross that bridge if we need to based on your answers to the above questions.
14

Agree with the above comments.

Best option is to fully remove all versions. Download the latest Avast version direct from www.avast.com and install it.

15

ok
have already done a clean installation of avast dl from avast web site

i am able to tell sf.bin is opening and closing by looking in task manager processes you can see it

have found out which shield is causing it. Its the behavior shield activating the sf.bin
this is being caused by 2 programs ‘aegwp.exe’ and ‘cbzvl.exe’ both programs located in c/documents and settings/steve

have searched c/documents and settings/steve can not fined these files there not hidden and simply not there only avast seems to detect them

any thoughts

regards

steve

16

I’m drawing a blank on that first one, but the second (cbzvl), I am pretty sure I have seen associated with infections, I know for sure I have seen it deleted during infection clean-ups before. Which might explain things a little, if it is indeed a sign of infection. See links for more info of cases it was infection associated.
http://virscan.org/report/1db6b946cca51c3aef74a1ad8bad27cc.html
http://www.prevx.com/filenames/3528355392091954939-X1/CBZVL.EXE.html
http://greatis.com/blog/how-to-remove-malware/cbzvl-exe.htm

Anyway, I’m an armchair enthusiast at best, so from here, if you want to investigate the possibility you are infected, see this guide by the local malware expert>>http://forum.avast.com/index.php?topic=53253.msg451454#msg451454

17

ok

updated avast virus data base scanned only c/documents and settings :slight_smile:

found both exe programs and 3 more all seen as malware have deleted through avast
problem seems to be sorted

fined it strange that avast couldn’t detect it on a full system scan maybe its only the latest vdb that detects it

so im happy now thanks to everyone that has taken the time to offer there assistance

kind regards

steve

18

Score, glad to help get you sorted, also glad Avast! is detecting.

You might want to follow up with a full or boot scan, that might not have been all there is.

Also, in the future, don’t use delete right away, always quarantine first if possible. Avast! is pretty low on false positives but it isn’t immune to the possibility, and you wouldn’t want to permanently delete something over nothing, especially something system critical.

19

hi
have already done a boot time scan no problems at all

just thought id list the 7 files found in documents and settings incase it sheds a bit of light on the original cause

“aegwp.exe”
“cbzvl.exe”
“100.exe”
“544.exe”
“5817.exe”
“774.exe”
“988598.exe”

i have done a little research into these files and they do seem to come back as melware

i hope there is not a deeper problem or app that originally set this problem in motion

regards

steve

20

Many forum users find MBAM an effective complement to Avast’s powerful scanning engine.

It can be downloaded from here: http://www.malwarebytes.org/mbam-download.php

A quick scan usually finds most nasties which it detects.