Avast WEBforum

Other => Viruses and worms => Topic started by: kristen874 on August 14, 2012, 03:26:05 PM

Title: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 03:26:05 PM
Hello!  I keep getting a message from Avast! saying that it has blocked Win32:Small-NNE [Trj] and I was wondering where this virus is coming from and how can I keep it from popping up.  Is it coming from a specific website that I'm visiting? Why does it pop up immediately when I open up Firefox? I know Avast! is blocking it but it's making me a bit nervous. :(

By the way, I did a full scan with Avast!, MalwareBytes, and Spybot Search and Destroy and everything came up clean.
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 03:29:20 PM
did you update Malwarebytes before you did the quick scan ?


follow this guide and attach    OTL and aswMBR logs
http://forum.avast.com/index.php?topic=53253.0
Title: Re: Win32:Small-NNE [Trj]
Post by: Milos on August 14, 2012, 03:49:27 PM
Hello,
maybe similar to this: https://forum.avast.com/index.php?topic=103154.0
Panda updates his antispam and there are some non-crypted URL signatures.

Milos
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 03:58:11 PM
i guess we see if panda is installed from the OTL log ?
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 05:33:08 PM
Hope I did this correctly!
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 06:02:57 PM
i guess we see if panda is installed from the OTL log ?

Pondus, I don't have Panda antivirus but I did the rest of what you asked and attached to results in the above post. I hope this helps you! :)
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 06:06:57 PM
you did not attach OTL log .......   but i think this is your problem    http://forum.avast.com/index.php?topic=103158.0
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 06:13:05 PM
you did not attach OTL log .......   but i think this is your problem    http://forum.avast.com/index.php?topic=103158.0

Aw, I knew I'd screw something up. :( Sorry. 

So, with respect to that thread, will this pop up just go away eventually or should I just keep ignoring it?
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 06:19:09 PM
do you have this program installed   see picture in reply #2   http://forum.avast.com/index.php?topic=103160.0
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 06:23:18 PM
do you have this program installed   see picture in reply #2   http://forum.avast.com/index.php?topic=103160.0

I'm so sorry, I don't see the picture of the program (me=numbskull), what is the program called?
Title: Re: Win32:Small-NNE [Trj]
Post by: Theo Peterbroers on August 14, 2012, 06:30:59 PM
hxxp://software.visicommedia.com/en/products/antiphishing (replace xx with tt) contains a link to test if your pc has visicommedia_antiphishing.
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 06:32:09 PM
do you have this program installed   see picture in reply #2   http://forum.avast.com/index.php?topic=103160.0

I'm so sorry, I don't see the picture of the program (me=numbskull), what is the program called?
Anti-phishing Domain Advisor       Visicom Media inc  (powered by panda....
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 06:38:38 PM
do you have this program installed   see picture in reply #2   http://forum.avast.com/index.php?topic=103160.0

I'm so sorry, I don't see the picture of the program (me=numbskull), what is the program called?
Anti-phishing Domain Advisor       Visicom Media inc  (powered by panda....

Yes, I just did so!
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 06:39:40 PM
did what?
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 06:54:05 PM
did what?

I just installed Anti-phishing Domain Advisor as you advised.
Title: Re: Win32:Small-NNE [Trj]
Post by: Pondus on August 14, 2012, 06:57:07 PM
did what?

I just installed Anti-phishing Domain Advisor as you advised.
you mean uninstalled / removed ?   as that program may be the problem .....
Title: Re: Win32:Small-NNE [Trj]
Post by: kristen874 on August 14, 2012, 07:02:40 PM
did what?

I just installed Anti-phishing Domain Advisor as you advised.
you mean uninstalled / removed ?   as that program may be the problem .....

No, I installed it, I thought you were advising me to install it.  Since I have installed it I haven't gotten the annoying pop-up from Avast. But I also installed Comodo firewall.
Title: Re: Win32:Small-NNE [Trj]
Post by: shawnmberry on September 07, 2012, 08:41:21 AM
Every time I scan I get Threat: Win32:Small-NNE [Trj] in file: C:\Users\admin\AppData\Local\searchcom_003\data\120906112445-f.list
I delete the file but it returns within seconds. No other scanners will detect the threat. There is little help on line other than people selling removal software. They make this threat sound very dangerous to my computer's security. I have even seen a couple of sites saying that it is doug in so deep into the system that it can't be removed. Have the brains at Avast figured out an update to get rid of this pest?
Title: Re: Win32:Small-NNE [Trj]
Post by: Theo Peterbroers on September 07, 2012, 10:22:35 AM
Hi shawnmberry,

Thanks for showing us the path for that list file.

Searchcom_003.exe seems to be another product from visicommedia.
Emsisoft deems searchcom_003 safe http://www.isthisfilesafe.com/ search on product for searchcom_003.

Most likely, your pc is not infected with Win32:Small-NNE [Trj]. You could just uninstall the visicommedia product to get rid of the detection.

Explanation. Visicommedia uses Panda [another antivirus company] virus signatures to deliver to you a safe browsing experience. Unfortunately, Panda does not encrypt their signatures. Avast detects  those signatures in the .list file as the real thing and gives you an alert.

Best regards,