Recently we have come across a new malware (Trojan.Agent.pd) which are also found to be causing the above problem.

Payload: The Malware is known to make changes in the registry that will block important Operating system and Anti-virus services from running.

How to Identify : Below are the steps to identify if problem is due to this particular infection:

Case 1 : Quick Heal protections goes off.

• In this case Quick Heal's protections such as Virus Protection, Email Protection, Internet protections etc. will get disabled automatically.
• Also, Quick Heal's Services such as Online Protection System Service etc will be stopped.
• To verify this, go to Start=>Run prompt and type services.msc and press enter. From the list of services, try to start Online Protection System Service.
• You will encounter below error if Quick Heal's protections are off due to this malware infection:

Case 2 : Internal Error 1603 during Installation.

• Error:"Internal Error occurred 1603" encounters while installing Quick Heal as the malware denies write permission for Quick Heal files.
• First Check Windows Event Viewer logs or the msi****.log located in %temp% folder.
• As soon as you get the error, go to Start=>Run prompt and type eventvwr and press enter.
  
• Under Windows logs select Application logs and click on the Error event seen in the right pane.
• If it is due to the infection then you will find the below error message in the log.

"Error 1321. The installer has insufficient privileges to modify this file C:\Program Files\Quick Heal\Quick Heal\ARCVSDK.DLL.system error 5"

Solution: The solution is released in the form of a patch which you can download from the attachment as per the operating system (32/64 bit).

Running this tool will restore the modified registry entries made by the malware, enabling Quick Heal's Protections and allowing successful installation.

Note: The tool will only restore the registry entry for Enabling the services or allowing the installation.

You need to scan the system for Quick Heal to remove the infection.

If the problem still persists then kindly get in touch with our Technical Support Centre.

-----------------------------------------------------------------------------------------------------------------------