Repeatedly sandboxing AVG files that don't exist ???

[languy99]

now you say you have uninstalled AVG, but I see a ton of junk left over.

C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\AVG\AVG9\avgemc.exe

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O4 - HKLM..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

I also see some things that need to be removed like this:

O24 - Desktop Component 0: (no name) - (no file)

O9 - Extra button: (no name) - AutorunsDisabled - (no file)

I also see you have spyware terminator installed, is it running in real time because by this entry I think it is

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

and I would recommend uninstalling it. ST sucks and is just making your computer slower by taking up resources. If anyone has anything to add, please do, before he makes any changes.

[donclarke]

FIRST … I never said I had uninstalled AVG. IF I had done so I wouldn’t be here trying to figure out why CIS keeps giving my pop-ups for one of AVG’s exes.
SECOND … I have no idea how to remove those two items you mentioned as I had never used HijackThis before. I don’t even know where to find those ? AutoRuns ? Config ? Reg ? Some directions …
THIRD … no problem with Spyware Terminator … didn’t realize it had a bootable running feature.

[languy99]

here is a quick tutorial on how to fix those two that say (no file). http://www.ehow.com/how_2282419_use-hijackthis.html

My mistake on removing AVG, I swear you said you had removed it at the beginning of the thread.

[mouse1]

@donclarke post:38

With much care I checked spelling/location/etc and all is good.
I then moved the avgdiagex.exe file from Pending to Safe and voila … no pop-ups on boot.
So, no idea what’s up … perhaps other member that said it worked was mistaken or just accepted the pop-up without checking further. Anyway, at this point the workaround with dummy exe in Safe Files solved the problem … my choice until “real” problem is resolved … thx …

OK so its confirmed then that the following works:

1. creating a false .exe on the path CIS thinks the file is
2. moving it from ‘Pending’ to ‘Safe’ files, or deleting from Pending and adding to Safe
3. maybe adding it manually to the sandbox via ‘Add a program to the sandbox’ (May not be needed)

I’ll back out now and let languy sort your uninstallation of AVG problems…

Thanks for bearing with the process

Best wishes

Mouse

[mouse1]

@mouse1 post:33

Re Don Clarke’s question - why does file ‘disappear’ from My Safe Files, auto purging seems a reasonable guess in this case. You could create a .bat or .cmd file, run it, choose do not sandbox again, then delete and reboot just to see if interested! Please report here if you do, would be useful diagnostic info.

Did you try the work-around by the way, and did it work for you?

Best wishes

Mouse

Having experimented I can confirm that autopurging takes place. So this helps explain the continued alerts.

[piet2468]

Just to be complete.
The avgdiagex.exe file never showed up in my pending files.
I added this file manually to the sandbox. It is visible now in “my own safe files”
Teh Pop up disappeared!

Answers from AVG are not satisfying for me. I removed AVG and used a removal tool they provided, reinstalled AVG and got the message again. They believe it is caused by a previously installed trial version (which apparently differs from the free version). However I believe I never used a trial version AND after the removal tool they provided, no traces should have been present. So I’m not expecting much from them.

To be complete I also added my hijackthis file.

[attachment deleted by admin]

[languy99]

here is my question, why are you using AVG? Did you buy it or something? If you are using the free version, why? It has ■■■■■■ detection and cannot protect against rootkits, why not just use the AV built into comodo, it has a much better detection ratio and works perfectly with the rest of the program.

[mouse1]

@piet2468 post:46

Just to be complete.
The avgdiagex.exe file never showed up in my pending files.
I added this file manually to the sandbox. It is visible now in “my own safe files”
Teh Pop up disappeared!

Answers from AVG are not satisfying for me. I removed AVG and used a removal tool they provided, reinstalled AVG and got the message again. They believe it is caused by a previously installed trial version (which apparently differs from the free version). However I believe I never used a trial version AND after the removal tool they provided, no traces should have been present. So I’m not expecting much from them.

To be complete I also added my hijackthis file.

Thanks piet.

Mouse

[mouse1]

Added to the FAQ at 6, here.

Many thanks for everyone’s help with this!

Best wishes

Mouse

[donclarke]

@languy99 post:47

here is my question, why are you using AVG? Did you buy it or something? If you are using the free version, why? It has ■■■■■■ detection and cannot protect against rootkits, why not just use the AV built into comodo, it has a much better detection ratio and works perfectly with the rest of the program.

I’m using the free AVG because currently it gets better reviews than the CMI version. I guess that’s the reason a lot of us do things … we read reviews of compeditive products and make decisions. Perhaps you could share the links that show that the CMI anti-virus is better … I’m sure we’d all appreciate that.

[languy99]

http://malwareresearchgroup.com/?page_id=186 look here, just remember these tests are of the older version of comodo and the current version is much better. Also look here https://forums.comodo.com/empty-t57794.0.html this is the newest test as of yet.

[donclarke]

OK … so I’ll give the CIS a try.
I currently have Firewall 4.1.149672.920 installed. So I don’t have to read thru the minutia … do I need to uninstall this before installing the latest CIS (cispremium_installer_x86.exe) …

[languy99]

nope, just uninstall AVG, and also use their uninstall tool.

Then go to start → programs → comodo → add remove components.

[donclarke]

@languy99 post:53

nope, just uninstall AVG, and also use their uninstall tool.

So, I use the standard Control Panel Add/Remove programs for AVG and then I also use the remover that was suggested on page-1 of this thread ?

@languy99 post:53

Then go to start → programs → comodo → add remove components.

I am using Firewall v.4.1.149672.920 and this is not an option. So, I have downloaded what you call the CIS (cispremium_installer_x86.exe) and need to know if I can just install this over the current CFW or do I have to uninstall the Firewall program first …

Sorry to seem sooooooooooooo dense …

[languy99]

@donclarke post:54

So, I use the standard Control Panel Add/Remove programs for AVG and then I also use the remover that was suggested on page-1 of this thread ?

I am using Firewall v.4.1.149672.920 and this is not an option. So, I have downloaded what you call the CIS (cispremium_installer_x86.exe) and need to know if I can just install this over the current CFW or do I have to uninstall the Firewall program first …

Sorry to seem sooooooooooooo dense …

yes to the first part and yes to the second part, it will ask you if you want to modify the installation when you run the installer, just make sure both the av and firewall are checked.