Strange : avast! Said : "You had a Trojan" ...

Avast Free Antivirus / Premium Security
1

???
Hallo avast!webforum

Something Strange happend today…

I Googled “Spywarefri”, bacause I would find a Danish Forum -
And at the moment the page came avast! 4.7 came with a Yellow Warning and “Sirene-Sound”
“You had a Trojan” “But it was stoppen” - Or something like that. (So my PC should be safe!)
I did not quite notice the whole text, because I was so surpriced and it did happen so fast)

And I did not even click on a Google-Link !! (Only got the search-results comming)

http://www.google.dk/search?client=firefox-a&rls=org.mozilla%3Ada%3Aofficial&channel=s&hl=da&q=Spywarefri&meta=&btnG=Google-søgning

This was the searchresult (Who I have visited before - But not with avast! 4.7)
(And I have been to Spywarefree Forum several times without any Trojan)

What do you think did happen?

I might add, that I did that on a clean system with Firefox.
(I installed a fresh system today)

Have installed McAfee Site Advisor as Firefox Ad-ons (But have no troubles with that)

Greetings
Jørn

2

what’s the trojan name?

3

Hey author=Maxx !

“what’s the trojan name?”

… Do not know … It happen so fast, and I do not believe avast! 4.7 said the name
(But I am not quite sure)

And Avast seams to have fixed it (As far as I know)

But - I did not even puch one link.

I am new to avast!, so I was surpriced.

Jørn

4

avast is always showing the name of infection (and waiting for user action), afaik… :wink:

5

“avast is always showing the name of infection (and waiting for user action), afaik… ;)”

… Yes?
But it is too late now, as I did not decite any action… Still I believe it was handled …
(Hope so, anyhow)

Can I see it in the program-files?

Jørn

6

you can see it in your log… look to your avast log directory and try to find the related item in warnings.log…

7

Hi Jorn,

Tell me what the entry in the log was.

You could do with an extra full scan of a non-resident free scanner like DrWebCureIt.
Download it from here: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

If you are clean you are clean, but you can also post a hijackthis log here,
and I will have a look at that as well,
download from link below:
http://www.spychecker.com/download/download_hijackthis.html

Your full hijackthis log may need several postings in this thread.

polonus

8

Hi polonus !

Thanks For the links !

Tell me what the entry in the log was.

… Warning :
System 1680 - Sign of win32:small-LX [trj] has been found in "Http:www.google.dk/search…

You could do with an extra full scan of a non-resident free scanner like DrWebCureIt.
Download it from here: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe

:slight_smile:
Dr.Web said: Scanned 775
Done - No Virusses found

So - This was good information !
And I suppose all is OK. (No need for more?) Hope not…

Very strange with that “Trojan”, as I did not even puch one link - Don´t you agree?

By the way - Poland is a nice country - I´ve been to Warsaw, Krakow, G´dansk as child.

9

Hi Maxx_original !
you can see it in your log… look to your avast log directory and try to find the related item in warnings.log…

… Thanks, here it was …
… Warning :
System 1680 - Sign of win32:small-LX [trj] has been found in "Http:www.google.dk/search…

By the Way Praha is a Nice Town, been there as child.

Jørn

10

It was a WebShield detection. The virus was blocked even before any file was saved to your disk. But you should expand the column width of the log to see what is behind the …

11

Hey Tech !

Sign of win32:small-LX [trj] has been found in "Http:www.google.dk/search…
[/quote]
It was a WebShield detection. The virus was blocked even before any file was saved to your disk. But you should expand the column width of the log to see what is behind the …

… Thanks, Nice to know !
The Log said:
No 1 !! (Nothing)
No 2 ! (Nothing)
No 3 Fire (Nothing)

No 4 Mistake :
System 1692 AAVM-Scanningerror:X-AavrnCheckFile Direct Ex: avfilesScanRealofC:Windows/

No 5 Warning:
2 "Sign of Win 32: Small_LX …

  • The one from Mistake

(Can´t find more then that)

Is that what you ment?

Jørn

12

Hi Tech !
“But you should expand the column width of the log to see what is behind the …”

… Sorry for being so Stupid … But how do I do this? …

Ask Jørn
::slight_smile:

13

Go to the column separator line, click with the left mouse button and adjust…

14

Hello!

Admin at Spywarefri.dk here

First of all: If Mr. Jorn think there is a trojan on our site Spywarefri.dk why don’t he mail us or place a question in our Forum? I think that would have been most correct of you Jorn.

We have no trojans, malware or the like on our site. We fight against such things and have done this for many years. We have daily over 5.000 unique visitors and have been computerexperts for the national radio and television for years. Bankers are linking to our site and Microsoft too. Why should we place at trojan on our site?

Why is the name Spywarefree mentioned several times in this thread? Please note that we have nothing to do with the site Spywarefree.dk Our site is Spywarefri.dk

Jorn says: Sign of win32:small-LX [trj] has been found in "Http:www.google.dk/search…
[/quote]
It was a WebShield detection. Let me hear what webshield you refer to?

Best regards

Admin
Spywarefri.dk

15

avast WebShield, a provider.
Seems, as you’ve said, a false positive detection.
Hope they correct it.