Yellow folders gone after scan

Hallo everybody.

I’m Irish living in Germany at the moment with a German Windows 98 SE. I like this operating system and would like to work with it for a few years more. I am very thankful that the Alwil programmers still take time to include Win98.

About 3 months ago I was shortly in the internet unprotected and picked up a virus which damaged exe files. For example the opening memory scan of AVAST was taking about 15 minutes. I can go back and get more details if this is necessary.

After a new installation of Win98 and AVAST (with update), I checked all my back up CDs and no viruses were found. I reinstalled about half the programmes and copied back some of the data. I have had no problems for 3 months BUT every time after I do an AVAST scan, every window that I open has only text! The symbols (for example the yellow file symbols) are all gone. This makes me very nervous. A Windows new start corrects this situation.

My AVAST doesn’t detect the EICAR test virus. DRWeb doesn’t find anything either.

I would like to fully reinstate my Windows OS but before this I would like to clear up this situation. Why are my symbols vanishing?

Thanks in advance.

Virmick

Hello Virmick

  1. open up task manager and see whether the avast processes are running(see pic)

  2. can you post a pic of “every windows i open has only text!”.

edit : the first process in the pic is not an avast! process. sorry for the mistake.

Hi nmb,

The effect happens after a scan but only after I shut down the main AVAST window. A picture is included.

I am not sure about the English names but in Germany you need Strg, Alt and Entf(remove) pressed simultaniously. I presume this is the Task Manager. ashmaisv.exe and ashwebsv.exe are present but not the others you named.

I am blocking RPCSS.exe (from Windows/system), with my firewall.

Thanks again.

Virmick

could you do a scan of hijack this and post the log, please. do only a scan. do not fix anything. get it here

try repair of avast from control panel>add/remove, reboot and see if all the services i mentioned are running.

post the log of hijack this.

Hallo nmb,

I couldn’t install Hijack This. I got the error message “Necessary File MSVBVM60.DLL is missing”. This happens with some programs on my OS and I always assumed it was because they were not written for Win98.

I will try downloading the latest AVAST version, remove the old programme and make a new installation.

Thank you again.

Virmick

hijack this works in win 98.

regarding the error, install this : http://download.microsoft.com/download/vb60pro/Redist/sp5/WIN98Me/EN-US/vbrun60sp5.exe

and try to install hijack this again.

if it doesn’t work come back.

Hi,

I got Hijack from another website for Win98. You were right. I got the same error message.

I had the VB Runtimes 4 to 6 on my old installation. I will install them again.

Thanks again.

Virmick

come back and post the log after you have done that.

Hi,

Bingo! Here is the log. Thanks again. Virmick

Hallo,

Here is a second log with AVAST started.

What is RPCSS.exe? Should I allow it to go in the internet?

Virmick

Log looks okay… someone will be commenting on it later… i think there are some entries to be fixed. but this icon problem is not due to avast, i think, because there are so many people experiencing this… i have seen it in other forums. i found this, it might help you : http://www.annoyances.org/exec/forum/win98/1073760082 (be careful)

I would call someone in here, at this time… someone who has used win98 earlier… :cry:


This entry should be fixed with HJT if you do not recognize smartsurfer.web.de :

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://smartsurfer.web.de/client/distribution/?partnerid=0&distribution=00000000 0480&affiliate=0&affiliate_user_input=&version=5.2.0.13&transfererror=0&winver=W in 98 SE (obfuscated)

When something is obfuscated that means that it is being made difficult to perceive or understand. In Spyware terms that means the Spyware or Hijacker is hiding an entry it made by converting the values into some other form that it understands easily, but humans would have trouble recognizing, such as adding entries into the registry in Hexadecimal. This is just another method of hiding its presence and making it difficult to be removed.

If you do not recognize the web site that an R1 entry is pointing to, and you want to change it, then you can have HijackThis safely fix these, as they will not be detrimental to your Internet Explorer install. If you would like to see what sites they are, you can go to the site, and if it’s a lot of popups and links, you can almost always delete it. It is important to note that if an R1 entry points to a file, and you fix the entry with HijackThis, Hijackthis will not delete that particular file and you will have to do it manually.


you might want to check these two links:

from auditmypc.com:
http://www.auditmypc.com/process/rpcss.asp

bleepingcomputer.com warns this is an undesirable program:
http://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html

Hallo Greyshade,

The two links were contadictory. One suggested it was a normal Windows program (RPCSS.exe) and the other that it has something to do with a worm. I checked the properties back then and found it was a Microsoft program. I presumed it was a phone home - nothing seemed to happen when I stopped it. I have allowed it to go into the internet now and will see if my internet works better.

Thanks.

Hallo CharleyO,

Smart Surfer is a very well known and respected German internet access program (Low Cost Router). I can imagine that the German programmers try to obfuscate their programs on the basis that everybody else is really stupid and should not mess around with their work!

AVAST may not be causing my problem but it is certainly doing something to my W98, maybe in conbination with another program. The problem only occurs after I do a scan and close the main AVAST window. I am only concerned that this is symptomatic of a virus - I can simply leave AVAST running until I turn the computer off then the problem is “solved”!

I was pleased to hear that others have this problem without a virus infection. It would make me even happier to know why AVAST doesn’t recognise the EICAR test virus.

Thanks again.

Virmick

P.S.

I forgot to mention that I get thrown out of the internet by updating the virus data bank - 2 or 3 times at the end of the process.


No problem, Virmick. As I indicated, as long as you know the site, then it should be OK. :slight_smile: