Scanning Files

[MrT]

Hi:

   Win2K sp3

   On 9/3 I got the first viruses I have ever had.

    Avast alerted me to blaster & nachi. I moved mblaster and DLLHOST.EXE to renamed .vir.

   I found others which avast did not. SVCHOST.EXE for example.

    I got rid of the virus files and removed the reg keys etc.

    After that ( I must have done something with avast), whenever I clicked on an Icon (like windows expolorer), an avast window popped up showing a bunch of files it was scanning. Slowed things down so I stopped avast and uninstalled it. All is well now.

    What would I have done to cause this file scanning?

[igor]

Haven't you changed the settings of resident protection (Standard Shield)? In particular, the second and third page of the configuration dialog ("Scan files on open" on the second page, or "Show detailed information" on the third page)...

[MrT]

I did not change the setup as far as I know.

[igor]

OK, and when you disable these options - does it come back to what you were used to?

[raman]

  Win2K sp3
    Avast alerted me to blaster & nachi.

   I found others which avast did not. SVCHOST.EXE for example.

I do not know if you have done that allready, but if you do not "patch" your Windows, blaster and nachi(blaster Variant) will allways come back and what makes you think that the svchost.exe is a virus too?

[MrT]

I have applied the ms patch.

I had two svchost.exe on my machine. One in lower case whose original filename was svchost.exe and one in uppercase in the system32\wins directory whose origianl filename was tftpd.exe. It otherwise identified itself as the original MS filename and version.

When the svchost.exe virus is present it repeatedly posts an error saying can't read memory and shutting osne or one time it said -k rpcss and killed itself. Since I deleted the viral version, no such messages.


Do a search on "svchost.exe virus" on google and you will find a number of items.

[raman]

Yes, i know, but i did not thought that the name is used by Malware under  NT and Avast did not find it(because it seemed to be a part of a Blastervariant)