Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: MrT on September 06, 2003, 03:32:14 AM

Title: Scanning Files
Post by: MrT on September 06, 2003, 03:32:14 AM

Hi:

   Win2K sp3

   On 9/3 I got the first viruses I have ever had.

    Avast alerted me to blaster & nachi. I moved mblaster and DLLHOST.EXE to renamed .vir.

   I found others which avast did not. SVCHOST.EXE for example.

    I got rid of the virus files and removed the reg keys etc.

    After that ( I must have done something with avast), whenever I clicked on an Icon (like windows expolorer), an avast window popped up showing a bunch of files it was scanning. Slowed things down so I stopped avast and uninstalled it. All is well now.

    What would I have done to cause this file scanning?

Title: Re:Scanning Files
Post by: igor on September 06, 2003, 12:16:16 PM

Haven't you changed the settings of resident protection (Standard Shield)? In particular, the second and third page of the configuration dialog ("Scan files on open" on the second page, or "Show detailed information" on the third page)...

Title: Re:Scanning Files
Post by: MrT on September 06, 2003, 02:06:07 PM

I did not change the setup as far as I know.

Title: Re:Scanning Files
Post by: igor on September 06, 2003, 02:09:54 PM

OK, and when you disable these options - does it come back to what you were used to?

Title: Re:Scanning Files
Post by: raman on September 06, 2003, 02:18:48 PM

Quote from: MrT on September 06, 2003, 03:32:14 AM

  Win2K sp3
    Avast alerted me to blaster & nachi.

   I found others which avast did not. SVCHOST.EXE for example.

I do not know if you have done that allready, but if you do not "patch" your Windows, blaster and nachi(blaster Variant) will allways come back and what makes you think that the svchost.exe is a virus too?

Title: Re:Scanning Files
Post by: MrT on September 07, 2003, 02:00:44 AM

I have applied the ms patch.

I had two svchost.exe on my machine. One in lower case whose original filename was svchost.exe and one in uppercase in the system32\wins directory whose origianl filename was tftpd.exe. It otherwise identified itself as the original MS filename and version.

When the svchost.exe virus is present it repeatedly posts an error saying can't read memory and shutting osne or one time it said -k rpcss and killed itself. Since I deleted the viral version, no such messages.


Do a search on "svchost.exe virus" on google and you will find a number of items.

Title: Re:Scanning Files
Post by: raman on September 07, 2003, 10:18:51 AM

Yes, i know, but i did not thought that the name is used by Malware under  NT and Avast did not find it(because it seemed to be a part of a Blastervariant)