Author Topic: Scanning Files  (Read 5806 times)

0 Members and 1 Guest are viewing this topic.

Offline MrT

  • Newbie
  • *
  • Posts: 5
  • Cuba Libre
Scanning Files
« on: September 06, 2003, 03:32:14 AM »
Hi:

   Win2K sp3

   On 9/3 I got the first viruses I have ever had.

    Avast alerted me to blaster & nachi. I moved mblaster and DLLHOST.EXE to renamed .vir.

   I found others which avast did not. SVCHOST.EXE for example.

    I got rid of the virus files and removed the reg keys etc.

    After that ( I must have done something with avast), whenever I clicked on an Icon (like windows expolorer), an avast window popped up showing a bunch of files it was scanning. Slowed things down so I stopped avast and uninstalled it. All is well now.

    What would I have done to cause this file scanning?

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re:Scanning Files
« Reply #1 on: September 06, 2003, 12:16:16 PM »
Haven't you changed the settings of resident protection (Standard Shield)? In particular, the second and third page of the configuration dialog ("Scan files on open" on the second page, or "Show detailed information" on the third page)...

Offline MrT

  • Newbie
  • *
  • Posts: 5
  • Cuba Libre
Re:Scanning Files
« Reply #2 on: September 06, 2003, 02:06:07 PM »
I did not change the setup as far as I know.

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11808
    • AVAST Software
Re:Scanning Files
« Reply #3 on: September 06, 2003, 02:09:54 PM »
OK, and when you disable these options - does it come back to what you were used to?

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:Scanning Files
« Reply #4 on: September 06, 2003, 02:18:48 PM »
  Win2K sp3
    Avast alerted me to blaster & nachi.

   I found others which avast did not. SVCHOST.EXE for example.

I do not know if you have done that allready, but if you do not "patch" your Windows, blaster and nachi(blaster Variant) will allways come back and what makes you think that the svchost.exe is a virus too?
MfG Ralf

Offline MrT

  • Newbie
  • *
  • Posts: 5
  • Cuba Libre
Re:Scanning Files
« Reply #5 on: September 07, 2003, 02:00:44 AM »
I have applied the ms patch.

I had two svchost.exe on my machine. One in lower case whose original filename was svchost.exe and one in uppercase in the system32\wins directory whose origianl filename was tftpd.exe. It otherwise identified itself as the original MS filename and version.

When the svchost.exe virus is present it repeatedly posts an error saying can't read memory and shutting osne or one time it said -k rpcss and killed itself. Since I deleted the viral version, no such messages.


Do a search on "svchost.exe virus" on google and you will find a number of items.

Offline raman

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1062
Re:Scanning Files
« Reply #6 on: September 07, 2003, 10:18:51 AM »
Yes, i know, but i did not thought that the name is used by Malware under  NT and Avast did not find it(because it seemed to be a part of a Blastervariant)
MfG Ralf