Just installed the latest avast after uninstalling Norton.
After successful installation, I surfed the web, and I sometimes get a message that pops up above the clock which goes something like: Successfully blocked [virus? not too sure of the text here] from IP address. A couple of minutes later, I get a message about some process not working, and my web connection does not work. I reboot. I can surf again. And then this message comes up again. Same story.
I do a manual scan, and I come up with a virus/trojan on my machine. I forgot the name (not at my PC at the moment).
Any advice on how to keep my internet settings?
How can I setup the program to block all suspect attempts to access my PC (or at least prompt me with a confirmation message)?
It is particularly important to run the removal tool in step 3.
I would actually recommend you uninstall avast!, run the Norton removal tool, and then reinstall avast! to ensure a clean install.
When you have reinstalled avast!, update and run a boot time scan. Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested.
After the scan, try to connect again. Try to note down any messages, or check in the avast! log viewer- right click the avast! icon in the notification area.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:23:07, on 2007/08/15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
I managed to finally get windows updated to SP2 level (the reason for my delayed response). I must still do a boot time scan, the results which I will post tommorow.
You don’t appear to have an active firewall or are using XP firewall ?
Your version of JAVA is way out of date.
Ensure you have the latest version of JRE (JAVA Runtime Enviroment) because older versions can be vulnerable to malware. First remove All Older Versions From Add/Remove Programs.
Then get the latest update from here http://www.java.com/en/download/index.jsp
Running hijack this from a Temp location isn’t advised as any backup of items fixed would be lost if the temporary folder is cleared.
C:\Documents and Settings\WinXP User\My Documents\HiJackThis\HijackThis.exe
Whilst this (UIUCU.EXE) looks legit I find it strange that it is running from a Temp location, what do you know about it ?
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\WINXPU~1\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
[b]uiucu.exe - uiucu - Process Information[/b]
Process File: uiucu.exe or uiucu
Process Name: Universal Device Install Application
Other than that I can’t see anything obvious, it looks clear.
You don't appear to have an active firewall or are using XP firewall?
I think after I updated to WinXP SP2, I saw something that looks like firewall options from Control Panel.
1. How do I confirm if I have XP firewall?
2. Is XP firewall enough?
3. If not, what is the best freeware firewall.
Your version of JAVA is way out of date.
Thanks for that tip. I will do an update.
Running hijack this from a Temp location isn't advised as any backup of items fixed would be lost if the temporary folder is cleared.
C:\Documents and Settings\WinXP User\My Documents\HiJackThis\HijackThis.exe
Should I remove Hijackthis from [My Documents]?
Whilst this (UIUCU.EXE) looks legit I find it strange that it is running from a Temp location, what do you know about it?
I have no idea what that is. Should I remove it?
My boot time scan seems to report nothing wrong (I checked the avast! logs and they are all empty).
Thanks for taking the time to look into my problem and giving me giudance to remove and install apps.
Control Panel, Windows Firewall, if you have that section in control panel then you have it available. You should check the Control Panel, Security Center, which will tell you which firewall you have and if it is active.
Personally No I don’t think it is enough.
Windows XP’s firewall is better than no firewall but, it lulls you into a false sense of protection, it doesn’t provide outbound protection.
I would however, say you need to look at a third party firewall to protect against unauthorised outbound connections.
Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.
There are many freeware firewalls such as, Comodo, PCTools Firewall Plus, Jetico, etc. - Zone Alarm free works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated with trial ware and is also crippled as far as outbound protection goes.
See http://www.matousec.com/projects/windows-personal-firewall-analysis/leak-tests-results.php later set of results
You should create a folder outside My Documents (which is a strange folder, different from a regular folder), where it is regular folder, C:\HiJackThis would do or a name and location of your choice.
I have no idea what it is either and can’t make that decision for you, you will have to investigate using google, etc. but you don’t want to get rid of something you need, My major concern if it is a legit application why is it in a temp folder.