Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Serverboats on May 11, 2004, 02:22:53 AM

Title: NBNS Scanning
Post by: Serverboats on May 11, 2004, 02:22:53 AM

I have an ill Compaq running XP. I have removed Nachi-B, Blaster, Blaster-B and Sasser-B from the system. I have verified their removal by running Symantecs specific removal tools. I have run A complete and through scan using the latest Avast!. I have installed all applicable patches.

This system still kills my Netgear firewall router in < 3 Mins. My sniffer shows multiple NBNS Registration requests and TCP scans of random ip addresses by altering the 4th octet using the first 3 octets of my subnet.

This sounds like SASSER or a variant but neither Symantec or Avast tools can find anything. Have I missed something here?

Please Advise,

Serverboats

Title: Re:NBNS Scanning
Post by: igor on May 11, 2004, 09:59:21 AM

Hard to say...
Are there any suspicious items in the system autostart entries? (e.g. in HKLM\Software\Microsoft\Windows\CurrentVersion\Run)