Avast WEBforum
Other => Viruses and worms => Topic started by: gabpsy on November 08, 2010, 08:16:58 PM
-
Hello,
I'm having this message to often:
"avast Network Shield has blocked a harmful site."
Object: 10.248.120.193:135/tcp (the ip address is different each time)
Infection: DCOM Exploit
Action: Blocked
The popup message has this link:
"http://www.avast.com/program/api/redir.php?u=virus-alert&action=1&p_age=233&p_cpv=83886757&p_elm=7&p_inf=10&p_lan=1033&p_lci=4106&p_let=24&p_lex=311&p_lid=es-gt&p_lng=en&p_lqa=0&p_lst=0&p_lsu=24&p_osv=6.0&p_pro=0&p_rcv=1&p_reh=768&p_rew=1366&p_uid=f000&p_vbd=677&p_vep=5&p_ves=0&p_wnf=3&p_vir=DCOM%20Exploit"
But the link only show message about "you're safe bla bla bla"
Can someone tell me more info about it?
Thanks for the help.
Best regards.
-
DCOM Attacks are speculative, not targeted and tries to exploit a vulnerability in out of date OS, if your OS is up to date then you aren't vulnerable to the exploit. That doesn't stop them (usually someone from the same ISP with an infected computer) trying to see if it can infect others.
Your firewall should be the first line of defence in this, but avast also monitors common attack ports using the Network Shield, ideally the firewall should block it and avast wouldn't know about it, but for whatever reason avast is first in line over your firewall.
What is your firewall ?