Zulu virus

Hi, its me again ::slight_smile:
Just connected to the internet and had message come up saying: sign of VBS Zulu found in my ISP. Tried clicking on the links of the message but they dont appear to be working so I clicked on ‘abort connection’
What it is the next step I should take please - do a scan then put the virus in the chest? Also, when I next reconnect to internet, am I likely to get the virus back again if its coming from the ISP?
Thank you :slight_smile:

The abort connection means it wasn’t able to get onto your pc, what URl/Website are you getting the warning from?

do a scan then put the virus in the chest?

Well you can scan if you want, but it wouldn’t be the virus from the warning.

–lee

Thanks Lee. The website is www.virgin.net

Im not getting any warnings from that site cagor :-, is there a specific part of the site that gives you the warning, are you trying to download something from there?

–lee

No problems at all here. What are your settings in the Webshield provider?
And what vps version do you have?

I’m not getting any warning from that url, using firefox though (nor with Avant browser).

There should be something in the avast logs that exactly identifies the location (full path to location). Can you check that again ‘C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log’ you can view it using notepad or a text editor.

When you post links to suspect locations leave off the www. part that way the link isn’t active ‘virgin.net’ just text. This avoids the accidental and simply curious easy access. You might want to edit the active link in your post.

Virgin is my dial up ISP, and when I connected to the net, Avast popped up a message saying sign of vbs zulu found in virgin net. Virgin is my home page, but I didnt get as far as that as I came straight from connecting to the net to the Avast forums.
I’m using Avast Home, latest version, and latest VPS.
Webshield settings are: Sensitivity normal, enable web scanning, use intelligent stream scanning, ignore local communication, and scan all files

What exact url path is in the ‘C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log’? you can view it using notepad or a text editor.

Hi David, it just says Virgin.net file

This is an example of an entry in my Warning.log file from testing another suspect link.

23/02/2005 21:41 1109194889 SYSTEM 996 Sign of "VBS:Malware [Script]" has been found in "http:// membres.lycos.fr/xxxxx/CF/" file. 23/02/2005 21:41 1109194892 SYSTEM 996 Sign of "VBS:Malware [Script]" has been found in "http:// membres.lycos.fr/xxxxx/CF/index.php?" file.

So as you can see it is a little more, date, time, virus name and full path, etc.

The only reason for asking was so we could investigate further, this however, may be pointless since three other people using a range of different browsers aren’t getting the warning.

I think we can only put it down to a glitch since your log details don’t appear to be complete.

Thanks a lot for your help David :slight_smile:
Like a few others, I’ve now disabled the web shield as it seems to be causing me a lot of hassle all round.

I would seem that you have spyware/adware on your machine causing the warnings. I’d suggest running Hijackthis, and see if there isn’t something that shouldn’t be there.

Like a few others, I've now disabled the web shield as it seems to be causing me a lot of hassle all round.
Why?

What hassle? Is it working or not, if not I assume that you have posted the problems you are experiencing in another thread? I can’t see any recent posts were you report problems with web shield.

One blip with web shield, is hardly hassle?

Rather than throw the baby out with the bath water, don’t give up, get even and let us help get it working.