Adware virus

[fishpier]

sorry to have posted in the wrong area. I am having trouble with avast scanner messages comming up every 5 minutes warning me about Win32:Adan-094, http://195.95.218.100/users/serg/web/files/images/bndmod/jpg and Win32:Adan-078,htpp://195.95.218.100/users/serg/web/files/images/hlmicro.jpg. I press the Abort button and they continue to come up. I am running XP, avast!4.6, have Spyware Blaster (unable to locate anything), Spybot Search and Destroy which located 2 files and then 10 further on and I destroyed, rescaned twice with no findings, Ad Aware Se, and MicrosoftAntispyware. Cannot locate these files in Microsoft search either. I am very new at this and am not to technical

[FreewheelinFrank]

Posting in the wrong place is only a problem in that people don't see your topic as a new one and don't notice you!

Have you tried a boot time scan with avast!?

Start avast! and select shedule a boot time scan. (Right click on the screen.)

Also worth a try is Ewido Trojan scanner.

http://www.ewido.net/en/

If you still have a problem after these scans, please post a HijackThis! log:

http://www.bleepingcomputer.com/forums/tutorial42.html

[DavidR]

You won't find anything on your computer as these are being detected by the web shield and the act of aborting the connection stops the infected file being downloaded. Is you can see the location points to the internet not your HDD.

I am having trouble with avast scanner messages comming up every 5 minutes warning me about Win32:Adan-094, http://195.95.218.100/users/serg/web/files/images/bndmod/jpg and Win32:Adan-078,htpp://195.95.218.100/users/serg/web/files/images/hlmicro.jpg. I press the Abort button and they continue to come up.

Either you are visiting some suspect/dubious sites or something has hijacked your browser  to theses sites. If you are using IE I suggest you use a browser that is less suceptable to these attacks (browser hijacks), firefox or opera.

The tool of choice is HiJackThis as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
OR HiJackThis Log file - On-line Analysis 2

[FreewheelinFrank]

Oops! Sorry didn't spot that was webshield.
The 'Abort' message should have been a give away.
Thanks David.

[DavidR]

There is nothing to say there may not be something which redirects to a site that trys to infect the computer. So there is nothing wrong with the Ewido recommendation. Followed by hijackthis.