Virus...AFTER downloading recent AVAST update

Really curious about this one. Have been using Avast for a long time. Running XP machine, use firefox browser.

A day or two ago, I auto downloaded the most recent AVAST update. My PC acted very weird during the update. Shortly thereafter, I began having issues- Click the start button, the word “start” disappeared. Then all my icons in the start button lost their color. Some disappeared. Then web pages began to lose info on them slowly and become unresponsive. When I would close firefox, then try to reopen, I got errors like “DWWIN.exe failed to initiate”. Then every program I tried to open gave me authentification errors with dll files. Then eventually, I couldn’t open any programs at all and had to reboot. Would reboot and the system would work fine for a few hours, only to have it happen all over again. All while this was happening, the “AVAST Virus database has been updated” lady would chime in a couple times a day. Except rather than saying it once, it would go “Avast, Avast virus, virus database has been updated”. It had become clear to me something was not right.

Well, after 2 lost vacation days of trying to figure this out (+ using Malwarebytes, Superantispyware and rootkill), I finally found what I think happened. Normally trustworthy AVAST let through something called the “Heuristic.Reserved.Word.Exploit” virus. This thing appeared to attack the winlogon.exe file. After hitting my system with rootkill and re-running Malwarebytes, it finally picked this up and killed it. I’m still trying to figure out why I need 3 additional diagnostic tools to kill something off that my antivirus software should have stopped. But rather than complain anymore, I decided to post this to see if others have had a similar issue after updating AVAST in the last few days.

My system appears to be stable now after about 6 hours of use since the cleaning, but I’m dreading hearing the avast update lady stutter again. Whatever this was seemed to hit the Avast program as well, because in 3 years of using Avast, I’ve never heard that on an update.

I'm still trying to figure out why I need 3 additional diagnostic tools to kill something off that my antivirus software should have stopped
there is no security program wih 100% detection..... if they did there would not be a virus problem

if you think you are infected…or want a specialist to see if you removed it all…
follow this guide and attach (not copy and paste) logs from Malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

@ jb2012 , having the exact same problem aswell

:frowning: This is a REAL problem. I got an update today 7.0.1456 and that may have fixed the problem. The Avast “Subscription” tab was showing EXPIRED and at the same time saying that I had 233 days left on my subscription. When I moved the cursor over various fields they would go blank, even in Windows Explorer. I installed an earlier Avast update a few days back, and I suspect that there was something wrong with that update. Running Windows XP

Will there be a fix for this problem or instructions on how to fix it released ,
Thanks

indeed i have been having this same problem, everything seemed fine after updating but then… then its web pages that get unresponsive, computer freezes a bit, if i try to open task manager i just get a 0xc000012d error… its been a pain actually.
after a restart it stays fine for a while but eventually this problem happens again, i’ve used spybot and am going to try malwarebytes to track down this problem…

a fix would be gladly appreciated, avast never gave me problems in the years i’ve used it and i am very satisfied with it but these tricky problems are indeed annoying :slight_smile:

Sorry to post again but can anyone give advice on how to fix this or confirm a fix is due please
Thanks

I already cleared up the virus with Malwarbytes (after a deep scan with avast found zippo). I then downloaded the July 4th version of Avast. I’ve been running almost 24 hours now without a problem. I agree that no antivirus is foolproof. But there was something really wrong with the update they sent out a couple of days ago- it just sent my pc to the moon, and as others have noted, this wasn’t an isolated incident. I do nothing dangerous on my pc -just your standard work, news sites,etc.

I’m not looking for anything from AVAST, but it would be nice to get an explanation from them as to what happened. Because losing 2 days to something that should have been prevented is no fun. I will definitely post logs if this problem returns, but as of now, I am crossing my fingers that it is ok.

I will post here regarding this

avast definition update yesterday appears to have led to a FP. Prior to yesterday the Quick Scan did not identify C:\Windows\System32\services.exe as a Trojan. Last night it did but today it did not.

After it did last night I ran some on-demand scans of that file and none of them said that it was a Trojan but all of them said the file was clean.

However, I did find this on the Net after I completed all my scans on services.exe

ZeroAccess – From Rootkit to Nasty Infection

June 25, 2012

Services.exe infection
Since a few weeks we receive reports of slightly changed versions of services.exe. This Microsoft component is the Services Control Manager and is responsible for running, ending, and interacting with system services. Upon closer inspection, the minor changes to services.exe are not malicious at all. But they do uncover a new and novel way of hiding malicious payload making ZeroAccess invisible to most antivirus products.

more on link


https://hitmanpro.wordpress.com/2012/06/25/zeroaccess-from-rootkit-to-nasty-infection/

I will continue to monitor but for now I think it was a FP

I had same problem. Called Avast and was required to pay $99 for help with uninstalling and reinstalling. Has anyone else had this experience?

after running numerous scans and found nothing unfortunately,
Installing the latest update ( version 7.0.1456) seems to have solved the problem…
since yesterday I have been running my computer and the unresponsive web pages/errors haven’t shown themselves anymore… will be here for a while more and see if its back or not but apparently its fixed…