Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: runningdeere on January 07, 2007, 03:09:39 PM

Title: DSCE-Demo
Post by: runningdeere on January 07, 2007, 03:09:39 PM
Hi,

I Keep getting a warning from Avast when I go to Web sites, that files contain the DSCE-Demo virus / worm.
I get this on reputable sites, always in an JPG image file, and it's starting to get very annoying   >:(

I even got a warning about this same one when I came to the Avast site to leave this message, although it was in a Javascript file. (sorry, I didn't take note of which one, but it was on the home page when I went to Avast.com)

This has only just started happening, so I'm thinking it's down to the latest database?

I am Running Avast 4.7.892 Home version, virus database 0701-1 (05/01/2007)

Thankyou.

Paul

Title: Re: DSCE-Demo
Post by: DavidR on January 07, 2007, 03:22:22 PM
Check the avast! Log Viewer (right click the avast icon), Warning section, this contains information on all avast detections.

When pasting the locations ensure they aren't clickable, e.g. break the link http: // www . exampleofinfected.com/infectedfile.jpg That will stop the terminally curious or accidental click through being exposed.
Title: Re: DSCE-Demo
Post by: runningdeere on January 07, 2007, 03:38:15 PM
OK, so far it's been logged in these files:

http:// newsimg.bbc.co.uk /nol/shared/js/livestats_v1_1.js?noccache3
http:// www. dabs.com /images/product/uni2/44/4412_standard.jpg
http:// www. dabs.com /images/product/uni2/4b/4b5m_standard.jpg
http:// www. dabs.com /images/product/uni2/4b/4b5p_large.jpg
http:// en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/\unp89238856
http:// en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/\unp237721711
http:// en-us.www.mozilla.com/en-US/firefox/2.0/firstrun/\unp2892989
http:// www. itv.com /masthead_2006/funcs.js 
http:// www. itv-f1.com /ImageLibrary/40724_3.jpg
http:// www. avast.com /dynmenu.js 
http:// www. google.co.uk/\unp107820542 


Just in the middle of re-building my PC, so these are all the examples I have so far.


Thankyou.

Paul
Title: Re: DSCE-Demo
Post by: DavidR on January 07, 2007, 04:05:40 PM
Checked 4412_standard.jpg link with DrWeb link checker and avast no detection
Also 4b/4b5m_standard.jpg, 4b/4b5p_large.jpg, ImageLibrary/40724_3.jpg.

The google one is weird as that doesn't show a file other than the avast unpxxxx unpack file, so I can't test that.

Also checked livestats_v1_1.js?noccache3 no alert on DrWeb. Since I use firefox and use NoScript .js don't run by default, but I was able to open the .js page and download it no avast alert.

Also was able to open and download, masthead_2006/funcs.js, avast.com/dynmenu.js, these were all scanned by ashQuick.exe and no detections.

So I wasn't able to find anything in those files, so there might be something else going on with your system.

I suggest you schedule a boot-time scan.
If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode.
1. Ewido, a.k.a. avg anti-spyware (http://www.ewido.net/en/download/) If using winXP. or a-Squared free (http://www.emsisoft.com/en/software/free/) if using win98/ME.





Title: Re: DSCE-Demo
Post by: runningdeere on January 07, 2007, 04:51:18 PM

OK, Thanks for checking that out.

It's a brand new installation of Windows (from yesterday) and I have checked it with Ad-Aware and Spybot S&D, but I'll give it a go with the AVG one and see if it turns anything up.

There's definitely something strange going on.



Title: Re: DSCE-Demo
Post by: bluejk on January 07, 2007, 07:58:57 PM
I'm having the exact same problem. Started very recently. Happens with different websites including eBay. But the aVast scanner does not offer a fix for it. Since this is an old virus there should be a fix for it. Please let me know what to do.
Title: Re: DSCE-Demo
Post by: DavidR on January 07, 2007, 08:59:00 PM
The web shield detection doesn't offer to fix, there is nothing it can fix, the file is on the internet not your system. The only option is to abort connection so the file doesn't end up on your HDD.
Title: Re: DSCE-Demo
Post by: bluejk on January 07, 2007, 09:42:25 PM
 ::)Ok. So with all the different websites doing it what should be done? Try a different virus detection program and see if it does the samething? I haven't seen this problem on other boards. Again this is an old virus, since 1995?
Title: Re: DSCE-Demo
Post by: DavidR on January 07, 2007, 09:52:11 PM
The only thing that can be done is investigate as I have done above and basically shown that something else is in the mix as I haven't found any infection or been alerted by avast on the same files.

So the same suggestion is there try a boot-time scan and use the other tools to see if there is anything else on your system.

I doubt however that you are visiting the same sites, so without knowing what they are we can't check.
Title: Re: DSCE-Demo
Post by: Lisandro on January 07, 2007, 09:52:46 PM
::)Ok. So with all the different websites doing it what should be done? Try a different virus detection program and see if it does the samething? I haven't seen this problem on other boards. Again this is an old virus, since 1995?
Two different programs are relating that the page is infected...
What do you want? A program that tells you what you want to hear?
Sorry, I'm not upset, just trying to face a problem  8)
Title: Re: DSCE-Demo
Post by: stone_age_king on January 07, 2007, 09:54:17 PM
Arrrr, i am getting the EXACT same problem - just started happening this evening. Pretty much every website i go to, or every link i click i get the 'warning: virus has been detected' message because, it says, of th DSCE-Demo virus. All i can do is block it so the problem dosent seem to be getting fixed. I'll try the reboot scan and see what happens. This is EXTREMELY annoying!
Title: Re: DSCE-Demo
Post by: Lisandro on January 07, 2007, 10:53:11 PM
Arrrr, i am getting the EXACT same problem - just started happening this evening. Pretty much every website i go to, or every link i click i get the 'warning: virus has been detected' message because, it says, of th DSCE-Demo virus. All i can do is block it so the problem dosent seem to be getting fixed. I'll try the reboot scan and see what happens. This is EXTREMELY annoying!
If you're sure the webpages are clean you could disable WebShield until this problem is corrected.
No need to be so upset. Just a false positive detection...  8)
Title: Re: DSCE-Demo
Post by: DavidR on January 07, 2007, 11:02:17 PM
There is no way we can confirm it is a false positive without information and to disable web shield which may be stopping malware being downloaded is IMHO a mistake. False positives have to be confirmed.
Title: Re: DSCE-Demo
Post by: Lisandro on January 07, 2007, 11:04:39 PM
There is no way we can confirm it is a false positive without information and to disable web shield which may be stopping malware being downloaded is IMHO a mistake. False positives have to be confirmed.
Well... I suppose the Standard Shield will be there, detecting any file being executed...
The user claims it's a false positive, so, it's his desire  ;D
Title: Re: DSCE-Demo
Post by: stone_age_king on January 08, 2007, 09:55:59 PM
Well i tried the reboot-scan and it didnt pick up any viruses buuuuuuuuut everything seems to be working fine now after the reboot. Havent had the DSCE-Demo message since. How bizzare but relieving none the les. Thanks guys...
Title: Re: DSCE-Demo
Post by: Lisandro on January 09, 2007, 01:15:35 AM
Havent had the DSCE-Demo message since.
Which is your avast version and the virus database version?
Maybe an update solve the problem...
Title: Re: DSCE-Demo
Post by: Vlk on January 10, 2007, 06:09:15 PM
This should now be fixed. Sorry for the trouble..