Hi there…well I don’t know where to post this, so I do it here ;D
Since a few days I got this on my desktop…appear just few minutes and then it’s gone, and appear again etc:
Question: What the hell is this ??
Is this “thing” the “because” of my high Ping ?? I’m a gamer (Pr3ds multi-gaming clan) and since few days my ping is always around 200 !!
I hope you guys can help me…I never had any problems with Avast, so I don’t understand what’s happening.
ps: I tried the Forum’Faq but it gaves me a 404 Not found :-[
thx, and sorry if this is a stupid question ( who knows =x)
This is the avast Internet Mail provider checking email (see image icon arrowed), which I assume is being sent (or possibly received though I doubt that).
Do you have your email periodically check for email ?
Does the IP address or domain look familiar, your ISP for instance ?
I assume that you weren’t sending any email at the time ?
If not you may have an undetected email spambot running on your system.
Hi thx for your answer !
For sure I’m not sending mails…just sometimes through Hotmail that all !
And no, the adresse doesn’t look familiar…I scaned my computer with Hijack this…nothing !
Should I try a “reboot avast scan” ??
I don’t know, how can I find this email spambot ???
Try to scan with hijackthis when I see the avast icon ??
What the hell is avast doing ? I mean it knows that’s a email spambot does it ? Weird
Hmm… you’re seem infected… what do you mean that HijackThis showed nothing?
Can you post its log here (maybe dividing it into pieces to fit in forum)?
Maybe this infection is being ‘shown’ but not detected by avast.
I suggest you to follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.
HiJackThis doesn’t detect, it is an analysis tool and just reports what is running on your system, which needs to be analysed. So we will need to see the log, as Tech mentions, paste the contents of the log here, it may take more than one post depending on the size.
Waouw thx guys for your answers ; great job ^^ !
OK:
-This guy in Australia, I don’t know him, total unknow !
-Secunia told me : Detection Statistics:
11 Applications Detected in Total
0 Insecure Versions Detected
11 Secure Versions Detected
Running For:
0 Minutes, 17 Seconds
Errors Detected:
0 Errors Detected
-I always used Ad-adware, but this monring a have downloaded a freee trial version from Avg anti spy…
Conclusion ? Ad aware sucks Oh My God !!!
Avg found 150 tracking cookies and on thing located on my second hard disk, a data called downlad.small.bgv, Avg gave him “high rank priority dangerous”…
Well I Destroye everthing, and I will try my ping…hope it will be ok now…
Oh yes when I said hijackthis “found” nothing, I mean I posted the Log on the hijackthis website, and it told me everthing is “green”
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:52, on 23/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Avg found 150 tracking cookies and on thing located on my second hard disk, a data called downlad.small.bgv, Avg gave him "high rank priority dangerous"...
Tracking cookies are common as muck almost every cookie could be considered a tracking cookie and there is no way I would consider it a “high rank priority dangerous” to my mind they over inflate the ranking of tracking cookies which I would consider low risk. AdAware also finds tracking cookies (depends on what your settings are) and they deem to call them critical, cr*p a cookie is a simple text file that contains data usually about visits to that site and that one alone.
You are best served by something like cookiesafe, a firefox extension where you can determine who is allow to set cookies, etc. There are other cookie functions which can be set like not allowing third party cookies (not from the site domain you are visiting) and other cookie tools to keep those on your system to a minimum. This is called treating the disease and not the symptom, the cookie on your system detected by avg-as or adaware.
Right cookies are not dangerous !
I was speaking about the data download.small.bgv, this was the High rank dangerous !!!
Avg found this cookies, Ad adware didnt…
I will try tonight to play with my team mate, wait see ( there is a God of ping right ? ;D)
But you didn’t say what the file name or location of this was, it is often hard to keep calm when the dark brown stuff hits the fan after a detection and you should always analyse what is set in front of you.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can’t do this with the file in the chest, you will need to move it out.
Because if this download.small.bgv was serious, not only did adaware miss it so did avast, the multi-engine scanners above confirm or deny detections. If it is a god detection you need to send a sample to avast for it to analyse and update the VPS signatures.
