LSASS Attacks detected by Avast

Viruses and worms
1

I got a notifications from Avast about LSASS attacks (pease see screenshot)

Can someone tells me more about this?

2

Yep, it means, that someone from 88.186.229.176 is infected by virus and it tries to exploit your computer as well. Avast network shield detects these attacks and blocks them. If that computer is e.g. in your home network, then you know it’s infected and should clean it.

3

but I dont have any network ???

4

but you’re connected through your internet provider and you’re not alone there… if you don’t know what computer it is and you don’t have a physical access to it, then ignore these warnings.

5

what is “physical access”?

6

Physical access to a computer mean you have actual access to the machine itself. You can look at the computer you can type on it. You physically (in the real world) have access to it.

7

cska133, this IP address “88.186.229.176” is coming from France:

(Whois:)

inetnum: 88.174.0.0 - 88.187.255.255 netname: FR-PROXAD-ADSL descr: Proxad / Free SAS descr: Static IP address (Freebox) descr: NCC#2007023917 country: FR admin-c: ACP23-RIPE tech-c: TCP8-RIPE status: ASSIGNED PA remarks: Spam/Abuse requests: mailto:abuse@proxad.net mnt-by: PROXAD-MNT source: RIPE # Filtered

role: Administrative Contact for ProXad
address: Free SAS / ProXad
address: 8, rue de la Ville L’Eveque
address: 75008 Paris
phone: +33 1 73 50 20 00
fax-no: +33 1 73 92 25 69
remarks: trouble: Information: http://www.proxad.net/
remarks: trouble: Spam/Abuse requests: mailto:abuse@proxad.net
admin-c: RA999-RIPE
tech-c: FG4214-RIPE
nic-hdl: ACP23-RIPE
mnt-by: PROXAD-MNT
source: RIPE # Filtered
abuse-mailbox: abuse@proxad.net

role: Technical Contact for ProXad
address: Free SAS / ProXad
address: 8, rue de la Ville L’Eveque
address: 75008 Paris
phone: +33 1 73 50 20 00
fax-no: +33 1 73 92 25 69
remarks: trouble: Information: http://www.proxad.net/
remarks: trouble: Spam/Abuse requests: mailto:abuse@proxad.net
admin-c: RA999-RIPE
tech-c: FG4214-RIPE
nic-hdl: TCP8-RIPE
mnt-by: PROXAD-MNT
source: RIPE # Filtered
abuse-mailbox: abuse@proxad.net

% Information related to ‘88.160.0.0/11AS12322’

route: 88.160.0.0/11
descr: ProXad network / Free SAS
descr: Paris, France
origin: AS12322
mnt-by: PROXAD-MNT
source: RIPE # Filtered

8

hm, ok. I dont have anything in commom with France

Bysides there are diffrent IPs

9

Yes, and the IP address you are showing us on is within that range.
(88.174.0.0 - 88.187.255.255)

10

Omega40, maybe just de-activate the links in your quote box please? Save the curious…

http://www.mywot.com/en/scorecard/www.proxad.net

-Scott-

11

proxad is the owner of a major ISP (“Free”) in France :wink: … so may be there’s a hacker somewhere on their network, but they’re not the hacker ;D