Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: hariskar on May 26, 2003, 02:56:11 PM

Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 26, 2003, 02:56:11 PM
I run  everyday a whole system scan with avast and I find everytime this script in my documents. Why does avast not see it the time it is coming in my pc? Is it dangerous? Why do I find it everyday in my pc? Where does it come from?
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 26, 2003, 02:58:01 PM
I run  everyday a whole system scan with avast and I find everytime this script in my documents. Why does avast not see it the time it is coming in my pc? I have the script control set to on. Is it dangerous? Why do I find it everyday in my pc? Where does it come from?

<Vlk's note: Merged with the duplicate thread in the Viruses&Worms category.>
Title: Re:VBS: Malware (Script)
Post by: Vlk on May 26, 2003, 03:06:14 PM
Where is it located (in which file)?
Is it always in the same file?
Do you have the resident scanner sensitivity set to Normal or High?

Vlk
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 27, 2003, 07:54:38 AM
Yesterday i set the script sensitivity to high and today I found again this script in this file: C:\Documents and Settings\dex\Local Settings\Temporary Internet Files\Content.IE5\CPIVS9U7\index[2].htm
Why doesn't avast block it?
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 27, 2003, 08:05:34 AM
I looked at the script sensitivity level after I wrote the previous message and it was to custom, allthough i put it at high yesterday, is it to custom because I unchecked Mozilla and Netscape and the splash screen? If yes what is the level, high or normal?
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 27, 2003, 10:25:32 PM
I found again this script today in a whole system scan in this file: C:\Documents and Settings\dex\Local Settings\Temporary Internet Files\Content.IE5\2P8FYTQ5\index4[1].htm
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 28, 2003, 02:55:19 PM
In a whole system scan, I found again the same script (VBS: Malware (Script))in this file: C:\Documents and Settings\dex\Local Settings\Temporary Internet Files\Content.IE5\09UZCHQZ\doa2.host[1].
Title: Re:VBS: Malware (Script)
Post by: Vlk on May 28, 2003, 07:05:51 PM
You can send the file to us (e.g. to support@avast.com or divis@avast.com) to see what's really inside -- it's hard to tell from the name.

Thanks
Vlk
Title: Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 29, 2003, 02:55:29 PM
Any news about this script?
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on May 30, 2003, 07:09:20 AM
Again the same virus in this file: C:\Documents and Settings\dex\Local Settings\Temporary Internet Files\Content.IE5\G98P6ZO5\index[1].htm.
Could you please tell me what is happening here???
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: kareld on June 02, 2003, 10:16:39 AM
Dear  Hariskar,
   VBS:Malware is a generic name for a lot of different pices of malware. We are not able to tell what it really is without the infected file. Please send it to me, divis@asw.cz, or to support@asw.cz for analysis.
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: ghj290 on June 02, 2003, 11:34:07 AM
Download Internet Sweeper from here:- http://www.bmesite.com/  this will delete the index.dat file and the malware along with it.  As with the above poster I kept getting this on every scan and because the malware file is in the index.dat file it can't be moved to the chest or deleted by Avast, as it can't be moved to the cheat it isnt possible to send it to Avast.

HTH,
Trev
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 02, 2003, 01:42:09 PM
kareld I sent you the file attached in an email. Thanks for helping!


ghj290 avast can delete the file, but after one or two days I find it again in my pc...
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: joanlui on June 02, 2003, 06:19:17 PM
I have the same virus Malware problem...It appears in HTML saved page (usually index.html)...I saved it in chest and I am sending it... ::)
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: joanlui on June 02, 2003, 07:16:49 PM
Ok...I sent it ti Avast! support for check...

I found this MALWARE by surfing this site: www.kazaalite.tk

Maybe it's a Kazaa virus... 8)
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 02, 2003, 07:35:26 PM
Yes, I found it in the same site, www.k-lite.tk
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: ghj290 on June 03, 2003, 11:21:43 AM
kareld I sent you the file attached in an email. Thanks for helping!


ghj290 avast can delete the file, but after one or two days I find it again in my pc...

It doesn't come back, it just isn't deleted from the index file.  No one, single, file can be deleted from the index file.  It is one file in it's own right and contains all your internet history and just gets bigger and bigger over time.  The only way to delete any one file is to delete the whole index file, but this can't be done using the Windows delete function, Windows will just replace the file as is.  This is a known "feature" (bug) in all versions of Windows and IE.  In 95/98/me you could boot to DOS mode and delete it that way, however in WIN XP this isn't possible and therefore the need for tools as I suggested above.
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 03, 2003, 01:06:17 PM
I can delete it the way you tell me, but I visit this site often (www.k-lite.tk). Do I have to delete it everytime? I wonder why avast can't block it. And when it finds it in the scan it says that it is deleted successfuly...
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: ghj290 on June 03, 2003, 08:20:25 PM
I went there and the script blocker jumped up straight away warning about malware script.  I told it to delete it but it still ends up in the index file when I use the on demand scanner.  Would be nice to know what it is I must admit.

Trev
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 03, 2003, 08:48:12 PM
I am not being warned about the script... i can find it only with the on demand scanner..
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: kanga2cool on June 05, 2003, 12:02:53 PM
 >:( Hi have the same problem as you guys doa2.host did any one get any feed back from avast support did internet sweeper work on this malware any other ideas wood be good.
Thanks guys have a nice day hope we can get rid of it for good.
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 05, 2003, 12:15:46 PM
I did not get any feedback till now. And I didn't try the internet sweeper because I visit this site quite often, I don't think I want to use everyday the internet sweeper to delete this script...
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: kanga2cool on June 07, 2003, 08:47:04 AM
 ;D Hi guys I got a reply from avast support it was a faults alarm will be fixed in next virus sig updates good for us thanks avast for the reply.
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 07, 2003, 08:51:52 AM
Thanks kanga2cool! This is good news!
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 11, 2003, 05:27:04 AM
The problem still remains...
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: Vlk on June 11, 2003, 09:12:57 AM
Hariskar, I have the impression that you have to be already frustrated with our poor tech support, aren't you? :-\

I'm sorry - it's always taking some time - it needs to pass some testing etc. - this is the way it goes... ;)

Vlk
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 12, 2003, 12:49:55 PM
No I am not frustrated, I am happy with avast and your help, Thanks. I write only to inform you about this problem and help you to solve it, not to complain
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: joanlui on June 14, 2003, 12:41:51 AM
 i understood it was a false alarm...All is ok now!  ??? THX!
Title: Re:Infected with VBS: Malware (Script) allthough avast running...
Post by: hariskar on June 17, 2003, 05:33:06 PM
Everything is ok now! The problem doesn't exist anymore. Thanks a lot for support!