Help! Persistent pop-ups from localsrv.net

Viruses and worms
1

We’ve been having major malware problems for the last couple of days. I have run my Avast Home Edition and have followed the instructions whenever it detects malware (I move the infected items to the chest…although I like to delete them after the sacn is finished just to be sure). These trojans include Win32:Adloader-KH, PurityScan-AF, Win32:Tiny-IF, Agent-Luq, Trojan-Gen, and WinFixer. I might have forgotten to write down one or two in between pulling out my hair. These all appear to have been removed, although a couple of them reappeared several times and had to be deleted again. (Hopefully they’re not still lurking.)

The one that seems to be most presistant is something (not sure what) that is causing a pop-up ad window with the url http://localsrv.net to appear every couple of minutes while I’m online. Multiple virus scans, file and cookie deletions, and even system restores have failed to get rid of this particular malware. (I have also gone into my control panel and removed programs known to be linked to malware, although there were only one or two in my list.) I’m not even sure which trojan might be linked to localsrv.net, so if anyone has any suspects, please let me know.

This is driving me crazy. Avast has been good about detecting malware, but I don’t know why the problem keeps persisting if Avast said the deletions were successful. The localsrv.net popups are really a pain, and working online is difficult because there seems to be some lagtime in addition to the pop-ups, and it’s aggravating because I know the lagtime means that I have some kind of unresolved infection.

I am VERY technologically challenged and joined this forum because the others (like MajorGeeks, etc.) have left me scratching my head and dropping choice words even though they’re supposedly written with inexperienced users in mind. I am looking for any help that might lead to a successful resolution of this problem…but be warned that you are dealing with a complete computer blockhead and will probably need to speak in very plain English, LOL!

Many thanks in advance.

PS: I use Avast rather than AVG (I also refuse to use Norton or McAfee) because AVG has serious compatibility issues with my ISP and/or browser. Just mentioning ahead of time in case anyone suggests installing AVG again.

2

If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:

  1. Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.

  2. Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

  3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

  4. It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
    If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

  5. If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Panda.

  6. Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

  7. After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

  8. Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.

3

You may have an undetected or hidden trojan on your system downloading this stuff, which is subsequently detected by avast. What is your Firewall ?

We would suggest installing another AV to solve a problem, but there are anti-spyware applications which are more specialised at detecting spyware in the form of trojan downloaders.

Some of which Tech has suggested.

I understand the aversion with AVG anti-virus, though I can’t understand why it would be a problem with your ISP unless they also supplied anti-virus/security software ?