Warning Alert? Help? Probably just me worrying but.

Viruses and worms
1

Alright so, I was browsing the internet and suddenly that whole alarm thing goes off and Avast! says something to the effect of detecting something, sorry my mind was a little blurred at the time.

So, I check the log viewer, and I found it. It was under ‘warnings’ with ‘HTML:iframe-inf has been found at http://winnipeg’ and the screen cuts off. Now I’m a complete newbie to this sort of thing, but I still saved the VRDB log as a .txt.

3/4/2009 3:54:20 PM SYSTEM 1608 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
3/4/2009 3:54:23 PM SYSTEM 1608 An error has occured while attempting to update. Please check the logs.
4/1/2009 9:41:05 PM SYSTEM 1392 AAVM - scanning warning: x_AavmCheckFileDirectEx: http://ubuntu.media.mit.edu/ubuntu-releases/intrepid/ubuntu-8.10-desktop-i386.iso (C:\WINDOWS\TEMP_avast4_\unp258529375.tmp) returning error, 00000084.
4/1/2009 9:41:59 PM SYSTEM 1392 AAVM - scanning warning: x_AavmCheckFileDirectEx: http://ubuntu.media.mit.edu/ubuntu-releases/intrepid/ubuntu-8.10-desktop-amd64.iso (C:\WINDOWS\TEMP_avast4_\unp113125386.tmp) returning error, 00000084.
4/1/2009 10:08:10 PM SYSTEM 1392 AAVM - scanning warning: x_AavmCheckFileDirectEx: http://ubuntu.media.mit.edu/ubuntu-releases/intrepid/ubuntu-8.10-desktop-amd64.iso (C:\WINDOWS\TEMP_avast4_\unp253352613.tmp) returning error, 00000084.
4/2/2009 3:23:31 PM SYSTEM 576 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
3/15/2009 7:20:47 PM SYSTEM 1440 Sign of “HTML:Iframe-inf” has been found in “http://winnipegportal.com/winnipeg.html” file.

Eh? Someone wanna translate that to common English? :]

2

I think you haven’t that much to worry.
Webshield stopped the infection and the other detections aren’t infections really.
Anyway, run a full avast scan to be sure 8)

3

Same problem for me, on the same date (tax day :frowning: ).

Last definitions I have are 4/15/09 - VPS Compilation 4/15/09, file version 090415-0. Build Feb2009 (4.8.1335) (home)

Haven’t had any updates since then.

Latest Error Log (beginning and end, to be under character limit)

22.04.2009 17:24:39 general: Started: 22.04.2009, 17:24:39
22.04.2009 17:24:39 general: Running setup_av_pro-537 (1335)
22.04.2009 17:24:39 system: Operating system: WindowsXP ver 5.1, build 2600, sp 2.0 [Service Pack 2]
22.04.2009 17:24:39 system: Memory: 82% load. Phys:92380/523056K free, Page:592152/1542272K free, Virt:2069380/2097024K free

…

22.04.2009 17:52:20 internet: SYNCER: Type: use IE settings
22.04.2009 17:52:20 internet: SYNCER: Auth: another authentication, use WinInet
22.04.2009 17:52:20 internet: while trying to get file ‘servers.def’, error 0x20000004 has occured, try 10
22.04.2009 17:52:22 internet: tried 10 servers to get file ‘servers.def’, but failed (0x20000004)
22.04.2009 17:52:22 file: GetNewerStampedFile:GetFileWithRetry failed: C:\DOCUME~1\Carol\LOCALS~1\Temp_av_proI.tm~a02680\onefile, servers.def, error: 0x20000004
22.04.2009 17:52:22 package: Tried to download servers.def but failed with error 0x20000004.
22.04.2009 17:52:22 package: LoadAllDefs failed 0x20000004
22.04.2009 17:52:32 general: Err:Cannot connect to download939.avast.com (74.54.25.66:80)

Any help here? Can’t get Microsoft updates either: svchost.exe closes down.

What should I do next? Post what info here?

Any help would be appreciated.

Oh, BTW, XP Home SP2.

P.S. Just saw that I can attach the log file – yeah! – here it is.

P.P.S.: Tweaked in avast program settings, for DSL instead of dialup, etc.

Tried to check firewall, error: “Windows cannot start the Windows Firewall Internet Connection Sharing (ICS) service.”

When I went to Services to see what was going on, saw it was set to Automatic but it was not started. Error msg: cannot start it, “Error S: Access is denied.”

Further in Services: Firewall depends on:
Network Connections – which IS started. (Automatic)
Remote Procedure Call – which IS started. (Automatic)
Windows Management Instrumentation – which IS started. (Automatic)
Event Log – which IS started. (Automatic)

Tried manual updating, both definitions and program updates.
Error msg: HTTP server returned Error 501 (no, not Area 51). :smiley:

Now what? What is the “access” that is denied? I am Admin as logged in.

UPDATES NOW DOWNLOADING!!! It was the Proxy setting, which I had never changed from the beginning. Changed from “use IE settings” to No Proxy. Maybe IE settings were not working because I’ve been having massive trouble with it since 4/15, closing abruptly almost constantly. A few moments before the trouble started I had rec’d a “warning” from Avast that it had blocked a certain website (I checked the IP; it’s from Latvia, part of server farm of ripe.com) EVEN THOUGH I was not doing any surfing at the time, merely going to my own website! Downloads are finished but I still have no Windows Firewall.’

Thanks to all who posted. Solution found 'cause I kept reading and tweaking. Thanks, All!