You are not logged in.

Saturday, April 19th 2014, 7:24pm

Dear visitor, welcome to Avira Support Forum. If this is your first visit here, please read the Help. It explains in detail how this page works. To use all features of this page, you should consider registering. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.

  • "PermaSt0ne" started this thread

Date of registration:
Nov 20th 2008

  • Send private message

1

Thursday, November 20th 2008, 11:40pm

aecore.dll error - Luke Filewalker

so when i right-click on a file and tell Avira to scan it (i've tried .txt, exe, zip, doc, rar, etc.) i get this error: "While loading the module (aecore.dll) the following error occured: Self test failed." i've tried replacing aecore.dll with the one in the installer package but that doesn't work.

however, this function works perfectly in safe mode!

interestingly enough, i also had the problem of Avira constantly telling me that my program hadn't been updated in 1 day like in this thread http://forum.avira.com/wbb/index.php?pag…72824&pageNo=2&, but re-installing Avira has fixed that.

i should not that this problem just started happening a couple days ago. i don't remember changing any system settings. i know for sure that i don't have any viruses/malware/torjans etc. and i've tried everything i could think of ?(

Running Vista Ultimate x64 SP1 (fully up to date)

aecore.dll file hashes: CRC32 - A09DD7D3
MD5 - 5590027780B302D637E594489C313BC5
SHA-1 - 1F32EFF05F5D2C05D66226A517B0A26A1AEE2706
SHA-512 - 92DA8219226AA22C20EDF0C3DF8A11D12EC1C9BC2DD5CD20CC208369224163F614FBCF08C5F3B136660491E878DA8A35187BBA60AC84A1B7A27540D74ACC07C6

Avira Version Info:
Product version 8.2.0.336 10/30/2008
Search engine 8.02.00.34 11/17/2008
Virus definition file 7.01.00.116 11/20/2008
Control Center 8.00.70.08 6/26/2008
Config Center 8.00.70.03 6/12/2008
Luke Filewalker 8.01.04.07 6/26/2008
AntiVir Guard 8.00.01.30 10/15/2008
Filter 7.00.02.06 5/21/2008
Scheduler 8.00.00.17 10/15/2008
Updater 1.02.10.34 6/27/2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:39:12 PM, on 11/20/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files (x86)\Free Download Manager\dllink.htm
O20 - AppInit_DLLs:
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: Virtual Disk (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Stardock WindowBlinds (WindowBlinds) - Stardock Corporation - C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\VistaSrv.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 2209 bytes

i have Comodo Firewall and Comodo BOCleaner installed but i have disabled them for the meantime while i'm trying to solve this problem. Avira also had no problem with them before so i doubt they are the problem

any ideas? :huh:

This post has been edited 2 times, last edit by "PermaSt0ne" (Nov 20th 2008, 11:47pm)


Date of registration:
May 22nd 2006

Operating System:
XP

  • Send private message

2

Friday, November 21st 2008, 9:52am

Hi,
Please disable Windows Defender also: Control panel -> Windows Defender -> Tools -> Options -> untick "Use Real-Time Protection" and "Use Windows Defender".
Nicolae Moldoveanu
Avira Operations GmbH & Co. KG

  • "PermaSt0ne" started this thread

Date of registration:
Nov 20th 2008

  • Send private message

3

Saturday, November 22nd 2008, 12:52am

Hi,
Please disable Windows Defender also: Control panel -> Windows Defender -> Tools -> Options -> untick "Use Real-Time Protection" and "Use Windows Defender".


i disabled windows defender a long, long time ago. i just checked and it's still disabled; so that's not the problem.

any other ideas? i'm quite computer savy so don't be afraid to throw out any "complicated" solutions or tests you'd like me to do. i'd definitely like to solve this problem

NiteHawk

Community member

Date of registration:
Feb 14th 2006

Operating System:
XP Pro SP3, Windows 7 Pro - Ubuntu 10.04 LTS

  • Send private message

4

Saturday, November 22nd 2008, 12:10pm

Hello PermaSt0ne!

Your aecore.dll seems 'out of sync'. The current version is 8.1.5.1, and it should have a file size of 172406 bytes and MD5 2f9989d2b679fa6c908719d8fa47f5d3.

Try the following: locate the file master.idx and delete it (for AntiVir Personal it should be under C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\IDX\master.idx). Removing this file forces AntiVir to do a 'full version compare' on all program files upon the next update. Now launch the update using preupd.exe from AntiVir's Program folder (C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe). Afterwards, check your update report to see if aecore.dll has been replaced. Hope this helps. (If not, try to delete aecore.dll as well, and repeat the steps above once more.)

Regards, NiteHawk

  • "PermaSt0ne" started this thread

Date of registration:
Nov 20th 2008

  • Send private message

5

Monday, November 24th 2008, 1:37am

Hello PermaSt0ne!

Your aecore.dll seems 'out of sync'. The current version is 8.1.5.1, and it should have a file size of 172406 bytes and MD5 2f9989d2b679fa6c908719d8fa47f5d3.

Try the following: locate the file master.idx and delete it (for AntiVir Personal it should be under C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\IDX\master.idx). Removing this file forces AntiVir to do a 'full version compare' on all program files upon the next update. Now launch the update using preupd.exe from AntiVir's Program folder (C:\Program Files\Avira\AntiVir PersonalEdition Classic\preupd.exe). Afterwards, check your update report to see if aecore.dll has been replaced. Hope this helps. (If not, try to delete aecore.dll as well, and repeat the steps above once more.)

Regards, NiteHawk


good suggestion. i did what you said and my aecore.dll has now been updated to the correct version. it is 172406 bytes and has the same MD5 hash as you posted

but right clicking and scanning still does not work :(

however, it does still work in safe mode

NiteHawk

Community member

Date of registration:
Feb 14th 2006

Operating System:
XP Pro SP3, Windows 7 Pro - Ubuntu 10.04 LTS

  • Send private message

6

Monday, November 24th 2008, 9:18am

but right clicking and scanning still does not work :(

How comes? Is there an error message? Still the same as you described above? ("Self test failed")

It's a bit strange this works in Windows' safe mode and fails in normal boot mode. That may indicate some sort of software conflict. Your HijackThis log seems pretty short, I suspect it doesn't show all the processes (are you using a limited user account?). Try right-clicking hijackthis.exe and "Run as Admistrator", then post the (hopefully more complete) log.

Regards, NiteHawk

Date of registration:
Oct 26th 2005

Version:
Avira Free Antivirus

Operating System:
you name it, i use it....

  • Send private message

7

Monday, November 24th 2008, 1:53pm

1) The "selftest" is not affected by safe-mode or full boot. Basically it is a cryptological checksum / signature check being performed on the binary files. If there are difference when booting in a different mode, the origin of the issue must lie elsewhere.

2) The engine modules (ae*.*) always have to be in a certain specified state (versions/build date etc...), that we have released and tested here. Copying random versions of these files together will not work and always produces a loading error. This is enforced by engine logic.
Marcus Matten
Manager Mobile Engine
Avira Operations GmbH & Co. KG


join us on facebook: http://www.facebook.com/avira

NiteHawk

Community member

Date of registration:
Feb 14th 2006

Operating System:
XP Pro SP3, Windows 7 Pro - Ubuntu 10.04 LTS

  • Send private message

8

Monday, November 24th 2008, 3:57pm

Hi Marcus!

Just to get this straight:

Quoted

2) The engine modules (ae*.*) always have to be in a certain specified state (versions/build date etc...), that we have released and tested here. Copying random versions of these files together will not work and always produces a loading error. This is enforced by engine logic.

That's why I advised to force an update by deleting master.idx and using preupd.exe. This should ensure that all of AntiVir's (relevant) files match their counterparts on the update server (that's what the hashes / MD5 sums are for after all). Or am I wrong here? :huh:

Regards, NiteHawk

  • "PermaSt0ne" started this thread

Date of registration:
Nov 20th 2008

  • Send private message

9

Monday, November 24th 2008, 7:43pm

How comes? Is there an error message? Still the same as you described above? ("Self test failed")

It's a bit strange this works in Windows' safe mode and fails in normal boot mode. That may indicate some sort of software conflict. Your HijackThis log seems pretty short, I suspect it doesn't show all the processes (are you using a limited user account?). Try right-clicking hijackthis.exe and "Run as Admistrator", then post the (hopefully more complete) log.

Regards, NiteHawk

yea i still got the same error message. but i have made progress! check below...

my hijackthis log is small because i run a tight ship ^^ i don't like things starting up / loading if they don't need to be. i use viper's list to slim down the windows services i don't need and will never use (like error reporting or wireless, etc.) and i remove software from the startup list if i don't need it starting up

1) The "selftest" is not affected by safe-mode or full boot. Basically it is a cryptological checksum / signature check being performed on the binary files. If there are difference when booting in a different mode, the origin of the issue must lie elsewhere.

2) The engine modules (ae*.*) always have to be in a certain specified state (versions/build date etc...), that we have released and tested here. Copying random versions of these files together will not work and always produces a loading error. This is enforced by engine logic.


1) we know it only does a checksum and nothing changes . that's why it's such a strange problem and that's why i made sure to point out that it worked in safemode but not under normal circumstances

2) once again, we know. the only files i have downloaded are from you guys. i posted my file versions and the MD5 hash to make sure i had the correct files; NiteHawk noticed that i had an old file version and helped me update to the latest version, that's it. i wasn't throwing random versions together ;)


Hi Marcus!

Just to get this straight:

That's why I advised to force an update by deleting master.idx and using preupd.exe. This should ensure that all of AntiVir's (relevant) files match their counterparts on the update server (that's what the hashes / MD5 sums are for after all). Or am I wrong here? :huh:

Regards, NiteHawk


nope, you were right :thumbsup:

i'll summarize all that i've done so far in case anyone else has the same problem in the future

now for the progress: once i noticed that it worked in safemode and not normal mode obviously something that's not a core component (necessary to work) of windows was messing it up. So first i wanted to make sure that all the program files were good and that's why it was failing the self check. NightHawk made sure of that (thanks!), but it still didn't work so that made it clear it was a software conflict. however i had disabled all 3rd party software from starting up in any way so it had to be a windows problem. but i figured that avira would have made sure it ran fine on windows :wacko:

however, i use vista ultimate x64; which is very different than all the other versions of windows. so i started disabling the features that make it special (DEP, driver signing, etc.) but none of those worked either. eventually i ran out of ideas and just turned off UAC and viola, it works.

now starts a bigger mystery. when UAC is enabled, i don't get any prompts from Avira asking me if i should let it do whatever it does. this tells me that it's not doing anything wrong, however if i turn UAC off then it works perfectly. so it's obviously automatically blocking Avira from doing whatever it needs to do and it doesnt' even give me the option of letting it happen if i want too :pinch:

so now the question is, why would UAC automatically block it without prompting me? i run as an Admin account 24/7 and i have all the Avira .exe's running as administrator as well. the hunt is on :D

This post has been edited 1 times, last edit by "PermaSt0ne" (Nov 24th 2008, 7:43pm)


NiteHawk

Community member

Date of registration:
Feb 14th 2006

Operating System:
XP Pro SP3, Windows 7 Pro - Ubuntu 10.04 LTS

  • Send private message

10

Monday, November 24th 2008, 8:53pm

Hi PermaSt0ne!

Nice you narrowed this one down. :) I agree that your UAC seems to behave differently from what one would expect normally. I'm not familiar with Vista x64 myself, but I guess some basic principles from the 32 bit version apply, too.

Quoted

i run as an Admin account 24/7 and i have all the Avira .exe's running as administrator as well.

With UAC enabled, even accounts with administrative rights are subject to privilege "elevation" (see http://technet.microsoft.com/en-us/library/cc709628.aspx). If this process somehow doesn't function properly, that may explain some of the problems you experience.

Quoted

i [...] slim down the windows services i don't need and will never use (like error reporting or wireless, etc.) and i remove software from the startup list if i don't need it starting up

Are you sure you did not accidentally disable a service that might be needed by UAC? I could think of AIS (Application Information Service), the "RunAs" service, or maybe even some RPC stuff (?) ...

Did you try "Start scan with the selected profile as administrator" with a search profile? (from "Local protection", "Scanner" - second icon from the left / F6) Does the UAC pop up as expected in that case?

Regards, NiteHawk

  • "PermaSt0ne" started this thread

Date of registration:
Nov 20th 2008

  • Send private message

11

Monday, November 24th 2008, 11:35pm

Quoted


With UAC enabled, even accounts with administrative rights are subject to privilege "elevation" (see http://technet.microsoft.com/en-us/library/cc709628.aspx). If this process somehow doesn't function properly, that may explain some of the problems you experience.


yea i use TweakUAC to turn UAC on silent so it auto-elevates with my admin privileges

Quoted


Are you sure you did not accidentally disable a service that might be needed by UAC? I could think of AIS (Application Information Service), the "RunAs" service, or maybe even some RPC stuff (?) ...

Did you try "Start scan with the selected profile as administrator" with a search profile? (from "Local protection", "Scanner" - second icon from the left / F6) Does the UAC pop up as expected in that case?

Regards, NiteHawk


yup, i'm sure i haven't disabled anything important. i've done much research (and much, much trail and error :P ) to make sure the settings are a-ok

ALAS, I HAVE SOLVED THE MYSTERY!!

in the group policy editor there are 9 UAC options you can mess with. you can reach them via "Start > Run > GPEdit.msc > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options".
one of them is called "User Account Control: Virtualizes file and registry write failures to per-user locations". here's the important part: it is disabled by default

the other day i was messing around with my group policies (best way to learn about your computer in my opinion) and i enabled it!! unfortunately i forgot about this and only remembered when i went to check the settings this time :pinch: . anyways, that's what will give you the error. if you are on Windows VIsta x64 Ultimate and you enable the virutalization of file and registry failures then the right-click scan will fail! :evil:

you guys at Avira got a test machine running Vista x64 that can verify my findings? i assume NIghtHawk doesn't have vista x64 (you said you were unfamiliar) so he can't confirm / deny anything

This post has been edited 3 times, last edit by "PermaSt0ne" (Nov 24th 2008, 11:38pm)


NiteHawk

Community member

Date of registration:
Feb 14th 2006

Operating System:
XP Pro SP3, Windows 7 Pro - Ubuntu 10.04 LTS

  • Send private message

12

Monday, November 24th 2008, 11:46pm

i assume NIghtHawk doesn't have vista x64 (you said you were unfamiliar) so he can't confirm / deny anything
Correct. I currently only have the 32 bit version available.

Regards, NiteHawk