i get unwanted webpages opening while i’m online, my computer is very slow, most of the time i need to force a shut down because it stops along the way.
i have run avast & malwarebytes, normally & in safe mode many times.
the only clue, maybe, is while shutting down, i get a message that daemon.exe is still closing down & that i should wait. i went to a website that claims to explain daemon.exe and it tells me i have a virus called W32.selotima.A i don’t know how it knows that! nevertheless, i don’t know what to do.
I somehow doubt it knows at all and is after money to clean it up (you may end up worse off), there are many such scams going on, don’t run any scan offered and most certainly don’t input any payment information.
Can you give some examples of these unwanted pages, change the http or www to hXXp or wXw so as to break the link and avoid possible exposure to malware ?
Does avast happen to alert when these sites are displayed ?
What is the general content of these unwanted web pages ?
What version of avast are you using avast 4.8 or 5.0 ?
thank you. i found the same website. and that’s where i found the name of the virus. but i don’t know how to remove it. avast doesn’t pick it up, nor does malwarebytes. what should i do? please know i’m a simpleton so i need a somewhat simple explanation. i appreciate your help. thank you!
david - i’m using avast 4.8 free version. i didn’t save any of the pages, but i did check them on nortons website check & they were all considered “safe.” they’ve been related to some of my searches, like yellow pages, or spyware removal sites. i’ll save the names from now on. meanwhile, what to do?
p.s. to david - no, avast didn’t signal anything when the pages popped up. it did block some malicious pages, but i didn’t write down their names because it goes away so fast. thanks for your help!!
I suggest that you install avast 5 (if you aren’t using win9.x or winME that is, unsupported OSes) as it has additional detection routines and functions/features. It has been out for over 5 months now and avast 5.0.594 is the latest version.
You can install that over avast 4.8 and it will retain your registration info, uninstall avast 4.8 and install avast 5.0.
What is your OS ?
I wouldn’t go for housecall right now, that should also be an on-line scanner and all it should need is to download some signatures and limited files, but it is still I would imagine a big download.
Given that about the sites being related to your searches, it is less likely to be Zeus bot activity, so I would hold fire on that also.
I would suggest running an avast boot-time scan - From the avastUI (left click the avast orange icon), Scan Computer section, Boot-time Scan, Schedule Now button and reboot.
Look in the C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\report\aswBoot.txt file, check this file using notepad for info on the scan/detections, etc.
thanks, david. in the meanwhile, i actually did download trend micro housecall & ran a scan. it found nothing! now, i understand you suggest i uninstall my current avast & install the 5. version. but what will happen in the time of rebooting - which takes forever, or doesn’t happen at all? won’t i get flooded with viruses? i’m scared. i can’t seem to restart without forcing a shut down.
No need to uninstall the current version first, I didn’t mention that at all in my Reply #7 - download the setup_av_free.exe link I gave (save it so you can find it again). Disconnect from the internet then run the file and it will take care of the uninstall of 4.8 and install of 5.0.
So whilst downloading this file you still have avast 4.8.
Obviously you can’t do this if you have a housecall scan running.
What do you mean “i can’t seem to restart without forcing a shut down.” Surely you haven’t done anything yet or is this a pre-existing condition ?
dear david - it’s a pre-existing condition that started when my troubles began last week with the opening of unwanted web pages & lots of little glitchy stuff. sometimes it shuts down and restarts & sometimes it doesn’t. meanwhile, i did install the 5.0 version of avast, as you suggested, on top of the old one & ran a boot scan. no viruses detected. how can that be? i know it’s not true. anyway, i’ve picked your brains for a long time & just want to say thanks. let me know if you have any other ideas.
Well what you are seeing may not be classed as a virus, it could be browser hijacking which is getting past not only avast but everything else that you have tried.
Are there any strange entries in windows Task Manager, Processes or in msconfig startup tab ?
thanks for all your time, david. sorry i kept you up so late. i tried everything you suggested & then some. i’m going to check all those things you mentioned tomorrow morning – after i figure out how to look for them. i haven’t a clue as to how to locate “windows task manager, processes” but i will ask google in the morning. i think i can find msconfig startup but i doubt i could recognize what a strange entry looks like. nevertheless, i’ll give it a try & will report back to you. you’ve been a great guide.
thank you!
install screenshot captor and irfanview to take screenshots if it helps, it is free but lengthy to install.
lady, when avast gives you the pop up, trojan blocked (or whatever) and then disappears. fear not, because if you click on the avast maintenance tab and then click on chest, avast will have it stored in the chest keeping your computer safe.
about msconfig, davidr mentioned. this is to see if any unwanted processes are running.
to do this click on start. in the run box type msconfig and click on it. ( i am using windows 7) this opens a box system configuration/ click on tools/ scroll down and click on task manager to highlight it and click on launch. this will list the processes you have running and you could post a screenshot of anything suspicious. ALSO try d/loading ad-aware pro free version from majorgeeks
good morning mrreg. thanks for your help. i opened msconfig & scanned the list. the only suspicious thing i could recognize was “ACDAEMON” a program file in common files, only because sometimes a program called DAEMON takes a long time to close when i shut down. but then, within a few seconds, i got a notice “genuine host process for win32 services encountered a problem & has to shut down.” i shut it down immediately. i’m not eager to go back, & anyway, i don’t really know what might look strange.
david had asked me to give the addresses of some of the web pages that popped up unrequested. last night i went on the atkins website - about diet - and this one popped up: hxxp://www.shopica.com/search.php?q=Diet&txn=3480-8A818E92. (as requested i changed the t’s into x’s.) i checked this website at nortons website checker & it came up “safe.”
so, another day has begun & i don’t know what to expect, but i’ll get back if anything does. meanwhile, i’d love to hear your or david’s ideas.
Download and run HJT and post the contents of the log file (cut and paste or attach the log file, see ### below and image) into this topic, you may need to split it over two or more posts depending on how large it is.
When you click the Reply button, there is an Additional Options link, this expands the options to attach a file, that can be an image file or a text file (.log or .txt). Also see How to post an Image.
good morning david! thanks for sticking with me. i just looked at the tutorial, but haven’t started to download anything yet. when i do, do you suggest i “do a system scan & save a log file?” the warning scares me, but i trust you won’t tell me to do anything beyond my (limited) capacity. as i understand, hjt will only scan & not delete or do anything to files. is that correct? thanks.
