AVG Free updates and flags CPUZ as a virus !

[dr_ml422]

spybot does not need a special uninstaller

http://eset.com/onlinescan

Kaspersky WebScanner

Thnx Chewy. I'll get to installing Spybot again and probably check into these online scans. I'm pretty safe like I mentioned b4 when online. Just mainly go to trusted sites suggested here and other forums, as well as the more commonly known ones for other than software and hardware.

[dr_ml422]

Spybot's in and ZoneAlarm out. Unbelievable how fast and efficient Avira is. What took Avast about 8 maybe 9 mins. Avira did in 5. Well it's only a 90 day license, till then I'll just make the most out of it until further notice.

[dr_ml422]

Hi Fellas. Anyone have any suggestion on what this warning might be about?




AntiVir PersonalEdition Classic
Report file date: Monday, April 07, 2008 10:38

Scanning for 1181591 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: MARIO-26D865F47

Version information:
BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 18:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 17:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 8/14/2007 20:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 17:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 19:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 03:31:45
ANTIVIR2.VDF : 7.0.3.85 434176 Bytes 3/27/2008 13:32:57
ANTIVIR3.VDF : 7.0.3.122 195072 Bytes 4/5/2008 17:48:02
AVEWIN32.DLL : 7.6.0.81 3424768 Bytes 4/6/2008 17:48:02
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 15:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 12:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 18:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/12/2008 03:31:45
AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 12:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 17:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 12:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 16:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 17:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 17:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 14:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Monday, April 07, 2008 10:38

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'VerizonServicepoint.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'locator.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'aspnet_state.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
19 processes with 19 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '10' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!


End of the scan: Monday, April 07, 2008 10:44
Used time: 05:20 min

The scan has been done completely.

2245 Scanning directories
42446 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
42446 Files not concerned
309 Archives were scanned
1 Warnings
0 Notes

[Chewy]

C:\pagefile.sys
[WARNING] The file could not be opened!

hey doc, at my malware university they encourage that we learn how to search and google is one of the best tools as you learn how to use it

everytime we ask a question they answer with a question till we supply the right answer


what is the pagefile?

yes this is a test

next question why can't antivir open it?

that's the hard one, think, google may not help you here

[dr_ml422]

Google's my friend. Have to stick this in my skull b4 ? Ok so it's a vital system file of windows to free up ram so you could do other tasks. It's suggested to not delete it and only alter the size if you know what you're doing. Which I don't.

Now Avira cannot access it maybe because it's protected by Spybot and/or windows is protecting me from unwanted access into my system from an outside source. Even if it's Avira. If it's a vital system file than maybe also even a scan can alter it and screw up my system.

[Chewy]

It's really more of a make believe file, that why it's called virtual memory, just an area of the hard drive that windows reserves to write temporary stuff to that would be in ram normally

when windows boots it keeps some files there(they are already on your hard drive) and writes more from ram there or pulls then into actual ram as it needs them or to make space for other files

since it's locked and in use there's no good way to scan it or a need to

scanning real memory is critical

let it search for rootkits from time to time, they and backdoor trojans are the worst things you can catch

[dr_ml422]

Thnx. I was pretty close. I was trying to find where to make it do a rootkit search. Didn't want to mess things up.

Ok it has a box for all files, file extension list and ignore offline files which is checked. All files and uncheck ignore offline files?

I think I got it. F1 button tells you the settings. If any ?'s I'll be back.

[Chewy]

they say a picture is worth a thousand words

[dr_ml422]

Chewy a rootkit scan is not available w/64 bit systems yet w/this Avira. You know I went into bios yesterday and it said I had a 64 bit system under the processor setting. I thought all along I had a 32 bit system. Didn't the power user guide for the classic windows setting suggest 16 or 32 bit for something?

[dr_ml422]

The rootkit box is checked for local disk c, but on my posted log it says it's off. Do I have to check off all the boxes under the manual setting underneath that rootkit entry in the attachment or it won't do it being I do have a 64 bit system?

Btw I've been downloading apps. all along w/the 32 bit setting when it asks what version of windows you have?

[Chewy]

you might have a 64bit cpu and supporting mobo chipset, but your xp is 32 bit

ignore any references to 64 bit

[dr_ml422]

you might have a 64bit cpu and supporting mobo chipset, but your xp is 32 bit

ignore any references to 64 bit

Ok well then I'll check off the boxes under manual under rootkit in Avira and see what happens. If it still doesn't do a rootkit search then maybe it's taking my processor and chipset into account as 64 bit.


Here's the log:

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Tuesday, April 08, 2008 12:06

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'VerizonServicepoint.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'locator.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'aspnet_state.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
19 processes with 19 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '10' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!


End of the scan: Tuesday, April 08, 2008 12:12
Used time: 05:44 min

The scan has been done completely.

2253 Scanning directories
42845 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
42845 Files not concerned
314 Archives were scanned
1 Warnings
0 Notes

Rootkit off again.

[dr_ml422]

here goes another scan. this time I checked all files and unchecked ignore offline files.
rootkit was checked as was every box under manual. same result.


Version information:
BUILD.DAT : 270 15603 Bytes 9/19/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 8/23/2007 18:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 8/16/2007 17:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 8/14/2007 20:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 8/21/2007 17:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 7/18/2007 19:27:15
ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 3/7/2008 03:31:45
ANTIVIR2.VDF : 7.0.3.127 649216 Bytes 4/7/2008 21:52:25
ANTIVIR3.VDF : 7.0.3.135 57344 Bytes 4/8/2008 01:52:01
AVEWIN32.DLL : 7.6.0.81 3424768 Bytes 4/6/2008 17:48:02
AVWINLL.DLL : 1.0.0.7 14376 Bytes 2/26/2007 15:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 7/18/2007 12:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 4/16/2007 18:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 3/12/2008 03:31:45
AVREG.DLL : 7.0.1.6 30760 Bytes 7/18/2007 12:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 8/28/2007 17:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 7/18/2007 12:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 3/8/2007 16:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 8/7/2007 17:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 8/21/2007 17:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 7/23/2007 14:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Tuesday, April 08, 2008 22:19

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'VerizonServicepoint.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'locator.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'aspnet_state.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
19 processes with 19 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '10' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!


End of the scan: Tuesday, April 08, 2008 22:25
Used time: 06:24 min

The scan has been done completely.

2257 Scanning directories
42874 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
42874 Files not concerned
314 Archives were scanned
1 Warnings
0 Notes

[Chewy]

well that's a trial for you

you are probably wasting your time looking for rootkits w/o some telltale sign like a backdoor trojan detected

http://www.google.com/search?hl=en&q=RootkitRevealer.exe&btnG=Google+Search

interpreting a rootkit scan is an advanced skill, go for it

[blutach]

Get Rootkit Revealer from sysinternals; this is a terrific product.

Note: Do not create any files (including browsing) while it runs or else it will report differences between the registry (which it loads at startup) and API. Some of its reports are harmless - you need to interpret them.

Regards