MZ123456

oshlp_s.rus corrupted?

Recommended Posts

Since then, however, OA has failed to do an update. I haven't found any way to force it to do so. Any ideas? Do I need to uninstall and reinstall?? If I happen to watch from the OA system status, sometimes I'll see something about unpacking a file and a percent complete, then that disappears and I see just the "last updates" date from September.

Share this post


Link to post
Share on other sites

Well I guess I had better replace my ready to fail HD and install Win7 :wacko: I've been running OA for quite a while now on Vista x 64 LOL even bought it.

Share this post


Link to post
Share on other sites

Our Online Armor did an auto-update last night, and since then it keeps popping up with "oahlp_s.rus is corrupted". Any idea what is going on?

Ditto here. Started today after updating, and afterward, even with the new version, is back to the problem discussed here: http://support.emsisoft.com/topic/6136-oa-not-releasing-connections-draining-cpu-slowing-internet-access/

Share this post


Link to post
Share on other sites

I just fixed a problem with the server side update scripts that could cause such error messages. Can you please try to run an update again to see if that solves the issues you are having?

Share this post


Link to post
Share on other sites

I just fixed a problem with the server side update scripts that could cause such error messages. Can you please try to run an update again to see if that solves the issues you are having?

No change.... Downloads the .rus file, and is evidently unable to overwrite the existing .rus, then closes the update. As an aside, I have deleted this file, then done a reinstall, and the file is already back in place, or the installer is corrupt, as it still has the corrupt file message. However, this version when first installed didn't have this problem, so the installer shouldn't be corrupt.

I have found a problem that is likely related..... I've been poking around to see what oddities I could find, and I discovered that the file/command(?) " xb'BVM)8A$4!!!!MKKSkClick2RunMSM64>OO5hSGuIH?xoVn&wQ(Ex " had started executing frequently and upon reboots. Searching for files that had suddenly materialized at the dates and times of these occurrences led me to files in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys. There was a corresponding file for each time that " xb'BVM)8A$4!!!!MKKSkClick2RunMSM64>OO5hSGuIH?xoVn&wQ(Ex " had run. When I clicked on properties for these, they were locked out because no one had taken ownership. After taking ownership, the properties were all related to P2P functions. I closed Win7's P2P programs which were on by default, (IDIOTS!), deleted all of the files, (about 100), and after doing so, OA started flushing closed & invalid connections again, instead of accruing thousands of connections & crashing things.

I think " xb'BVM)8A$4!!!!MKKSkClick2RunMSM64>OO5hSGuIH?xoVn&wQ(Ex " is an enabling device for creating zombie computers. It's a phantom program that I can't find anywhere on my computer, but OA logs occurrences of it executing in 'History', (which it allows, unfortunately). It also shows up in 'Programs', where you can block it, but it's always grayed out as not present in every instance. It enters a duplicate file entry in 'Programs' each time it executes, so the block on the previous grayed out entry is obviously pointless, since OA is treating it as a new file each time. (BTW: Avira, CCleaner, Emsisoft Malware, Emsisoft Emergency Kit, Malwarebytes, Spybot S&D, and System Mechanic are all oblivious to " xb'BVM)8A$4!!!!MKKSkClick2RunMSM64>OO5hSGuIH?xoVn&wQ(Ex ".) Closing Win7's P2P functions seems, (for now), to have stopped any further executions of " xb'BVM)8A$4!!!!MKKSkClick2RunMSM64>OO5hSGuIH?xoVn&wQ(Ex ".

Anyway, since Eastern Bloc countries seem to be most active in creating zombie computers, isn't it a coinkydink that it's a Russian language file that's corrupted at the same time that I'm having this problem????????

Share this post


Link to post
Share on other sites

The weird code is most likely related to Microsoft Office updates.

I've seen the same weird code during an Office update on my XP system.

If you removed those files/entries, check again for Microsoft updates and check OA History.

About the language file, i thought it was fixed server side. There's nothing wrong with the file on your system. The updater is/was given wrong information about the file. I'm sure Fabian will take another look.

Share this post


Link to post
Share on other sites

Anyway, since Eastern Bloc countries seem to be most active in creating zombie computers, isn't it a coinkydink that it's a Russian language file that's corrupted at the same time that I'm having this problem????????

It's a coincidence. Most likely the update would fail for every file. The russian language files are just the first in the update list sent from the server and therefore the first Online Armor tries to download. The original issue I was referring to has definitely been fixed. So the problem is somewhere between the server and your system at home. Does Avira have a webshield? If it does please make sure both oasrv.exe as well as oaui.exe are excluded from any kind of network stream scans. You may also want to do a "ping online-armor.com /t" for a few minutes to see if any packets are lost. If they do, there is a connectivity issue and you may want to contact your ISP. For at least one person it helped to update outside their local rush hours because packet loss is also a symptom of overloaded internet backbones.

Share this post


Link to post
Share on other sites

No webguard on my version of Avira....

I did the ping and it was pretty much in the 17x ms range, until OA tried to go out & update, then it varied between 18x - 23x ms, but regardless of the time, it always delivered 32 bytes. Afterward, I tried a manual update again, and still the same result of failing to update oahlp_s.ru, and then closing. I checked the OA firewall log and oaui.exe is being allowed and alternating between 80.237.52.26 and 80.237.191.14 on successive tries.

Share this post


Link to post
Share on other sites
The weird code is most likely related to Microsoft Office updates. I've seen the same weird code during an Office update on my XP system. If you removed those files/entries, check again for Microsoft updates and check OA History. About the language file, i thought it was fixed server side. There's nothing wrong with the file on your system. The updater is/was given wrong information about the file. I'm sure Fabian will take another look.

Thanks, I seem to recall shutting down some MS Office crap along the way, so maybe that's what stopped it.

Share this post


Link to post
Share on other sites

The weird code is most likely related to Microsoft Office updates.

I've seen the same weird code during an Office update on my XP system.

If you removed those files/entries, check again for Microsoft updates and check OA History.

About the language file, i thought it was fixed server side. There's nothing wrong with the file on your system. The updater is/was given wrong information about the file. I'm sure Fabian will take another look.

UPDATE: This started again, (tried), and OA put up an allow/block window like you showed in your post. However, it showed the path triggering execution as C:\Program Files(x86)\Microsoft Application Virtualization Client\sftlist.exe. Doesn't appear to be MS Office related. .............You might want to check the entries in your machine keys folder, just in case.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.