Anti vir updates crashing computer.

The last two nights, after Anti vir auto updates the computer reboots automatically, I checked event viewer and it showed faultrep.dll as the source which is microsoft file linked to save dump.

Has any one else had this issue?

i'm running XPSP2, Jetico, SSM, spyware terminator, boclean and proxomitron!

 

The problem most likely is SSM. Avira told me to remove SSM and ProcessGuard as incompatible with Avira. I was having another problem...not the crashing you report with updating. I told Avira that I had not had SSM on the computer for a couple of months and I didn't think PG was a problem because it had been working fine with Avira until the April 18 update. My problem was connected to the anti rootkit (I was getting a STOP error on boot after installing it and it messed up my printer although part of the printer problem turned out to not have to do with Avira). Avira had me do a HijackThis and to my surprise, there was a SSM process running even though SSM had been uninstalled some time ago.

You might read this thread:
https://www.wilderssecurity.com/showthread.php?t=173996

 

ok cheers Mele, I also downloaded the avira rootkit update but it was running ik up until last night, I'll wait and see what others say, maybe I can uninstall the Avira anti rootkit?

 

Quite a few users have reported the anti rootkit working ok at first and then suddenly causing problems.

Uninstall it. Avira will give you popup a few times after you uninstall it wanting to install it again. Just click cancel and after a few times, Avira will not bug you further about reinstalling it. You can easily reinstall it from Add/Remove Programs if you decide you want it back and Avira has stopped giving you the popup about installing it. Om Add/Remove programs under Avira click change and then modify. That is where you uninstall it also.

I don't think the antiroot kit is ready for prime time. I think it needed more beta testing before public release. I'm not going to reinstall it for some time.

 

I have had the same problem Khazars, and at first I was not sure what was causing it as I had the anti-rootkit installed and running ok for a couple of days. I have now uninstalled AntiVir.

https://www.wilderssecurity.com/showthread.php?t=173996

 

i'v avira pe classic with antirootkit and it didn't cause any problem for me and it works great .

 

ok guys, cheers for the info. I tried what Mele posted and it was crashing the computer so I had to boot to safe mode to uninstall the rootkit within anti vir, now I'll just have to see if it updates ok tonight or Anti vir will be coming off!

 

Look at {THIS THREAD} on the AntiVir Forum:

I have not seen any issues with Rootkit on AntiVir Classic, but hope that the above will offer hope for those that have.

 

mine was actually updating after it rebooted, I didn't have BSOD, when avir updated it would just shut off the computer and then reboot. When I tried a manual update same thing, so I have uninstalled the rootkit withih Avir!

 

I have not had any problems with AntiVir. Runs fine with PG free and updates automatically on a limited XP user account.
Just my comment added to this thread.

 

I was using antivir PE Premium with kerio 2.1.5 and SSM free.My system is WınXP SP2.I am behind a router.Since last week I am not able to update antivir.While updating the process stops and while restarting it gives STOP error.(rootkit driver avipbb.sys).After reading posts about the same problem I uninstalled SSM free.Now I am waiting for a new file to try my update.

 

I uninstalled Antivir 3 days ago and reinstalled. No problems with updates, but that isnt to say others arent having issues. They will get it rectified soon, I am sure.

 

OK after removing SSM free and cleaning the registry everything went smoothly.Updated easily.Now using winpatrol.

 

i suffered the same,
are you using the P version?
now I find the C virsion is alright.

 

One of my clients had the same problem. Hers is a XP with AntiVir free and SSM free. Initially, there was no problems with the rootkit scanner. That started maybe 2 nights ago? I had to boot into safe mode to remove the rootkit component. In normal mode, trying to remove it resulted in the same BSOD that happens during the update process. I'll know for sure tomorrow when I can update AntiVir again, but it appears that SSM free and AntiVir can coexist as long as the rootkit module for AntiVir isn't installed.
Rick

edited to fix typo's

 

mine is updating ok now after removing the rootkit component!

 

AntiVir updates normally again on my clients PC as well.

I wouldn't be in too big of a hurry to blame SSM for this. Antivir has had problems before with not getting all the bugs fixed before releasing a new version, feature, etc.

This does demonstrate the type of problems users can face when more than one security app works at a kernel level, and one of them updates the components.
Rick

 

I got the pop up message about selecting the rootkit option for the program, but I did not select it so I guess it isn't activated. Thanks for the info about possible problems with it.

 

On XP systems I saved my peace of mind by killing off AntiVir 7, cleaning out the registry, downloading the last version of AntiVir 6 from www[dot]oldversion[dot]com and updating AV 6 by way of the fusebundle. Do not overwrite the AV 6 avewin32.dll and the avrep.dll! I tried AV 6 on some recent tojans, and it worked. It reads approximately 20,000 less signatures than AV 7, but those are -- I am told -- the antispyware signatures, which can be covered with SpyBot's TeaTimer, or any AS app you choose to use. AV 6 sees rootkits! IT DON'T DRIVE YA UP THE WALL IN SEEING ROOTKITS!

Dave

 

Both avewin32.dll and the avrep.dll can be updated manually. Avewin.dll is part of the scanning engine update, which includes ave32.exe and avguard.vxd for 9X units. Not sute about the update for XPs scanning engine, might contain just the avewin32.dll. There's at least 4 different scanning engine updates available. Finding the correct one for your system is the hardest part.

The avrep.dll is in the specvir.zip update. AFAIK, there's one version for 9X systems and one for NT systems.

There's also 4 separate VDF downloads, 0,1,2,3. VDF3 is updated often, with the lower numbers less frequently.

For anyone interested in using AntiVir 6, I have 10 separate links for all the updatable files. They are working links to AntiVir servers, not someone elses mirrors. You'll have to work out which of the scanning engine links fits your system. Just back up the files to be replaced beforehand. The updater for AntiVir 6 can still be used to tell you which files need updating at any given time. Just select "NO" on the version conflict/license runoff message.

I question just how necessary that rootkit module is, unless the user already has one installed. SSM is completely capable of preventing a rootkit from installing, providing the user doesn't choose to allow it to happen.
Rick

 

Rick, thanks. Would you please post those links or provide a link to where you have them posted?

Thanks,
Dave

 

VDF links:
VDF0.zip
VDF1.zip
VDF2.zip
VDF3.zip

Non-incremental VDF.zip (14+mb)

SpecVir links (avrep.dll):
SpecVir_h for 9X
avrep.dll for XP


Scanning engine links:
Engine9X_h.zip
Engine9XE_h.zip
Engine_h.zip

I don't know what all the differences are between the different scanning engines other than the language version. You'll have to check thru that yourself as I don't have AntiVir 6 installed on any XP units.
Rick

edited 5/17 to correct links

 

herbalist, what could the world do without you!

Thanks,
Dave

Ps. How did you get the version 7 avrep.dll to work? That keeps crashing my AV 6.

 

It seems that my link to specvir.zip leads to an old version, 6.25.00.07. Bad assumption on my part that it was for XP. I should have verified the version number. The specvir_h.zip link gets version 7.00.00.01. Apparently, there's only one usable specvir link.

The scanning engine links have the same problem. 3 lead to older versions. I've removed them from the post. Only the "_h" links are good and are the present version number. Simplifies the scanning engine choices. Sorry about the inconvenience.
Rick

 

Rick, I'm doing something stupid with my AntiVir 6, because the 7.00.00.01 keeps causing it to crash. A dll crisis!

Dave