hi all, i’m from ireland and would be delighted if someone can explain whats going on.
the avast (virus blocked) pop up appears a few times a day with the last 3 days.
the computer shut down a couple of times aswell.
i’ve scanned the computer and the result says no infected files.
i’m presuming there must be a virus because computer has shut down a couple of times.
the pop up has appeared even when not on the internet.
any ideas anyone?
thanks in advance.
I suggest:
- Clean your temporary files.
- Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
- Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
- Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
- Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
- Clean your Hosts file (replacing it) with HostsMan tool.
- Disable System Restore and then reenable it again.
- Immunize your system with SpywareBlaster.
- Check if you have insecure applications with Secunia Software Inspector.
i’m only a beginner but i’m going to try. thanks very much.
Feel free to ask for further help.
But understand that is difficult to guess what’s wrong with your computer without having it in front of us…
ok done some of those things and thought everything was ok until just now.
pop up appeared saying something like virus blocked ssla e2k.
not sure about the ssla part but something like that.
hi kevw,
what things did you try per Tech’s suggestions?
please post the logs, without it helping is going to be difficult.
I did a search on the ssla e2k mention, and only came up with this thread.
Sat
hi, it’s lsass. done some research and its a sasser worm.
avast is blocking it but it keeps popping up.
any thoughts how to stop it.
if i format the drive will it be gone for good?
I’d certainly try MBAM (from the list provided above) well before formatting, though formatting will eliminate it. And all your files.
Which of the suggestions posted by Tech did you try?
first cleaned out temporary files and everything else with Ccleaner, i then done a boot scan then i i scanned with dr.web cure it. results showed no viruses.
thought everyhing was ok as no pop up all day then it started again.
will try MBAM next.
i don’t have a clue about trojans or worms or any kind of virus.
i’m wondering is the worm after infecting my computer even though avast is saying virus blocked.
if i did format could i save some files beforehand or would they be infected.
just tried mbam and it found something.
i’m after putting it in to quarantine.
is it ok there or should i delete it?
i hope it’s the little bugger that’s causing the trouble.
Registry Keys Infected:
this is the infected file from the log :
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) → Quarantined and deleted
no it’s still happening.
scanned again with mbam and nothing is showing up.
Might help if we could have the full text of the popup message, including which of the shields is creating the notification.
seems to be different things coming up in the pop-up.
this is what the last one said.
object:213.182.246.148:135/ TCP
infection: DCOM
action: blocked
What firewall do you have?
If this is the network shield (and the example you posted is) every time, you aren’t infected.
i think i have problem fixed.
firewall automatic updates was turned off and needed to updated.
no virus alert pop-up since i updated yesterday.
fingers crossed everything is ok.
thanks to everyone for their input which is greatly appreciated and very helpful.