Trying to fix a pc, Vista with IE8 for a friend. She had this little lovely trojan “cleanup antivirus”. Now I have got ridden the trojan and convinced her to have a virusprotection on the pc. (yes, thats right she had run the pc without virus protection). The problem is that I can not update the Avast. It´s start to retrieve the file servers.def.vpx but end with the text it can´t reach the server. And the other funny thing is that she can´t open www.avast.com in IE8. Other pages goes just fine but not this one. Could there be something left from the Trojan that is stopping her to conect to Avast homepage? Any one who has a clue?
It could be that the virus infection she had also changed the hosts file to try and block access to security sites.
- HOSTS file redirect a common malware tactic to block AV sites making it difficult to remove malware - 127.0.0.1 check your HOSTS file using notepad or a text editor of your choice, C:\WINDOWS\system32\drivers\etc\hosts or do a search for HOSTS to find it if not there.
Once open you are looking for entries with avast.com on the line, you may well see other AV sites, post the contents of the hosts file. http://en.wikipedia.org/wiki/Hosts_file
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
-
- MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later. - 2. SUPERantispyware On-Demand only in free version.
Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Thank you for the answer. I will look in to the host file. The 2 programs you tipped about I had allready run on her PC. Malware didn´t find anything so I tried with SuperAntispyware and that program find some but not all so I had to go in to regedit for the final erase. Actually I (she) can´t reach Superantispywares homepage either so probably can a look in to the host file be a good tip.
also look if there’s a LMHOSTS file on her machine (other than lmhosts.sam) if lmhosts is activated in the network tcp/ip preferences (under WINS)
use a² free to scan the system. update!! b4 scanning! (http://www.emsisoft.com/en/software/free/)
asyn
Thanks to you to. 
u’re very welcome!
btw: could u please post back, if it helped u or if u could solve ur prob otherwise…
thanx a lot - we never stop learning, too! ;D
asyn