hi ya all howdy… ;D
hi Davidr,tech
i am still enjoying my vaction roaming,movies etc 8)
anyways i still have one more week left but i think this needed ur atmost attention… :
ok here is a virus that i have that is exclusive made for avast…
AND THIS THING INFECTS JUS BY VISITING A HOST SITE …
READ THIS WHOLE THING PROPERLY COS THIS IS A ATTACK ON avast users
i was googling for something while comodo firewall warned that a program svicpa.exe
from C:\windows\temp is trying to connect to the net…i blocked it
then another file 14q…exe in C:.…\system32.exe tried to modify IE in the memory i blocked it also
then is all stated …all my browser windows closed automatically…
when i clicked on ie ashDisp.exe tried to do something which comodo warned …but i allowed it then
the malware stopped me from visiting avast.com AND virustotal.com and as suspected all othe related sites
i closed IE opened mozilla firefox … this time comodo warned me and i blocked it but alas
it damned malware …i could not open any site…
i later got a warning that a process RTHDCPL.exe… [realtec audio high def somthing that comes with my motherboard CD] is doing the same
i ended both of them and tried ie … with no use
i figured that there is a rootkit
and scanned with
1>>panda anti root kit… no use
2>>avg anti root kit …no use
3>> fsecure backlight…now this thing hanged my system i had to restart and when i did
i got the follwing warning from avast
i scanned my with backlight again and it caused a hangup again but the results were negative
now i killed RTHDCPL.exe and every thing is back to normal… for now
i cant find the exe in system32 now but i managed to save the svcipa.exe and i sent it to virus total… and seems that it is a malware…
so waiting for furthe advice guys …this thing was made to attack avast users
Are you saying that submitting ashdisp.exe to virustotal it’s reported as being infected? ???
If it is the original avast file it’s pretty clean for sure…
DAMN it is infected man… ???
File ashDisp.exe received on 08.19.2007 17:37:53 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
If you haven’t already done so send the sample to avast for svcipa.exe, 14q…exe and ashDisp.exe.
Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.
I suggest that you rename ashdisp.exe to ashdisp.old and try an avast repair to see if that will replace the missing file.
Yes that would be helpfully, especially if you have put the other two files in the avast chest and deleted files in the original location. It would indicate that there is something else going on.
MyComputer > Control panel > Add or remove programs > scroll down & click on avast! antivirus > click on Change/Remove button > scroll down to Repair & click to select > click on Next > follow instructions
hi guys really sorry … … my comp was totally screwed… got infected buy rootkitS… torjans …
they would not let me access the net i had so… well i sent it to avst for analysis
n i had to install a freah copy of xp on my system… and well i sent al the other samples i could salvage to avast
This is quite scary that the virus has targetted Avast and replaced its files :o, is there someway this can be covered in an update to make Avast immune against it.
It is nothing new that malware targets anti-virus and firewalls and not just avast.
The key is to try and prevent rootkits/malware get established, for most of this to happen they usually need to place files in system folders and create registry entries.
You might also consider proactive protection, in order to place files in the system folders and create registry entries you need permission. Prevention is much better and theoretically easier than cure.
Whilst browsing or collecting email, etc. if you get infected then the malware by default inherits the same permissions that you have for your user account. So if the user account has administrator rights, the malware has administrator rights and can reap havoc. With limited rights the malware can’t put files in the system folders, create registry entries, etc. This greatly reduces the potential harm that can be done by an undetected or first day virus, etc.
Browsing the Web and Reading E-mail Safely as an Administrator. This obviously applies to those NT based OSes that have administrator settings, winNT, win2k, winXP. Check Bob’s, setup instructions and importantly the dropmyrights.msi file needed as MS have now cleared the original link. http://mysharedfiles.no-ip.org/dropmyrights
