info wanted

Viruses and worms
1

Hi,

Excuse my poor englisn but i’ll trye to be as clear as possible

Maybe this is the wrong section to post this in please forgive me in advance.

Avast blocked couple attacks today and i was wondering where to search to get clear infos about it. I mean i get a short message saying avast blockes an attack but didn’t have time to write the ip address and all infos about it. So I can’t respond nor search from who’s the attack is coming from.

Please let me know where to search in order to get the datas from these attaques in my avast

Many thanks in advance and once more, yopu guys doing hell of a job :wink:

2

Right click the ‘a’ blue icon and choose to Start avast antivirus.
Right click the skin and choose Log Viewer.
Is there any relevant info in the section Warning? And at the other ones?

3

Actually I was wrong I wasn’t really attacked but someone tried couple times to scan my computer. Avast blocked it I guess but as a little windows opened up with a name and ip i’m looking fward to get this ip in order to find out who it was (i might be dreaming maybe but i have some pretty tools here) don’t know where to find that datas. I might also say that i don’t have the pro version but the free one :slight_smile:

4

Which firewall do you use?

5

Windows XP one

6

I really suggest a ‘full’ firewall with both inbound and outbound protection.
You can ‘see’ in the firewall logs and alerts what is going on, which one is trying to ‘attack’ your computer.
For instance, ZoneAlarm, Kerio, Sygate, Comodo, Jetico… there are a lot of them.
Here you have a comparison: http://www.firewallguide.com/freeware.htm

If you want to stay with only the XP SP2 one, then see: http://www.download.com/XP-Firewall-Viewer/3000-2085_4-10305656.html

7

Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.

Zone Alarm free http://www.zonelabs.com works fine with avast and has a reasonably friendly user interface. There are others, Jetico, Sunbelt Kerio, etc.
See some firewall tests for comparison, some are freeware but many are paid for versions http://www.firewallleaktester.com/tests.php. Also see http://www.thefreecountry.com/security/firewalls.shtml

8

all right guys many thanks for the help and good edvices

I found out one IP number i checked on the who’s who and it happened to be my own access supplier scanning my ports. So I do know what the hell they’re doing this

keep on the good works and many thanks

9

No problem, a belated welcome to the forums.

Sometimes ISP do this to check if your connection is alive/active, usually for dial-up connections. Even though the IP might belong to your ISP, don’t forget that the range of IPs are used by their customers, so it is possible one of their customes systems is infected or is protscanning random ports in the ISPs range.

10

I installed zonealarm and turned off the XP firewall, but then I couldn’t connect to the internet at all. Explorer wasn’t blocked in ZA and no error/warning messages were given. Just no connection was made in the “LAN console” (don’t know how it’s called in english).

11

Ensure that Zone Alarm allows access to ashWebSv.exe, it looks like you blocked access for it not knowing what it was.

You can test this by pausing the web shield provider or visit an https: secure web page which isn’t monitored by web shield.

12

That can not be the problem as I installed it before avast. I started searching for anti virus programs when my XP firewall kept starting up without firewall. Then I noticed IE was sending data and didn’t stop doing so.

So far I’ve avast and firefox that work. I wish to install zonealarm but as I said that completely confused my LAN-program in making any connection to the modem. Though I’ve installed ZA on another PC (win98) which shares the same connection and there it works fine.

13

If you don’t want to try what I suggest I can’t help.

Installing on win98 is different because you have to manually setup the browsers to use the web shield proxy.

14

Yep, but ashWebSv.exe is an avast process and avast wasn’t installed when I tried to install ZA.

What’s a web shield proxy? If I think about it, I really can’t blame people for getting infected. There’s no such thing as installing an anti-virus program and being safe as I just read the best selling anti-virus programs can shield only 20% of the virusses.