smbcve20170144 virus

[REDACTED]

Hi. I google searched this virus, found one avast link but all it said was this topic has been discussed before.  Registered for this forum and searched the virus name and nothing comes up in the results.

I just moved house and as soon as I got internet connected this virus alert keeps coming up regularly.  Avast virus program finds nothing, malware bytes finds nothing.  How do I fix this please?

[Pondus]

If avast found nothing then what is giving that message?

and we need all info from that message, screenshot would help   

[Pondus]

or is the message   smb:CVE-2017-0144  ?

If so your google (and forum) search will look completely different
 

[REDACTED]

Yes thats the virus name, but when I search for it in the manner youve written it my thread is the only result.

Also Im trying to attach images but its not letting me.  All that happens is...  (edit) ok its not displaying whats happening.  All its displaying is img written twice in these brackets [] with the second having / before it.  Does this make sense?  I know its code that the website reads but its not asking for the image I want to attach.

[DavidR]

Lots of hits for smb:CVE-2017-0144 on a Yahoo search https://uk.search.yahoo.com/search?p=smb%3ACVE-2017-0144&ei=UTF-8&fr=moz35

Your best bet is to save the image you created to your system.
Then you can use the Attachments and other options below the reply text window.

[REDACTED]

oh I didnt see that...

If avast found nothing then what is giving that message?

and we need all info from that message, screenshot would help   

Lots of hits for smb:CVE-2017-0144 on a Yahoo search https://uk.search.yahoo.com/search?p=smb%3ACVE-2017-0144&ei=UTF-8&fr=moz35

Your best bet is to save the image you created to your system.
Then you can use the Attachments and other options below the reply text window.

[REDACTED]

Lots of hits for smb:CVE-2017-0144 on a Yahoo search https://uk.search.yahoo.com/search?p=smb%3ACVE-2017-0144&ei=UTF-8&fr=moz35

Your best bet is to save the image you created to your system.
Then you can use the Attachments and other options below the reply text window.

Im really not having much luck. Ive been checking th elinks on your yahoo search and so far they either say to go into safe mode and look for the offending program in the programs list and uninstall it.  Its not in the list... OR download spyhunter... I do and run the scan, not only does it NOT find anything resembling the smb virus, but it comes up with all these OTHER APPARENT issues and says I have to pay for the software if it wants me to remove them.  WHat is the point of having avast or malware bytes on my laptop if they dont detect the problem at all?

[DavidR]

The way I'm reading it given this appears to be a web shield alert, is that the Web Shield alerted on a site that sought to use an exploit that a windows update/s (CVE-2017-0144) should have patched.  Whilst that should have patched your system, it doesn't prevent attempts.

The Web Shield should abort the connection to prevent infection, but avast is saying you should run a scan to ensure nothing got through.

What is your system OS and is it fully patched on the Windows Update side?

[Pondus]

I do and run the scan, not only does it NOT find anything resembling the smb virus

It is not a virus, CVE-2017-0144 is a exploit / Vulnerability

CVE list  https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=30010


Try close port 445 on router and see if message goes away
Does router have latest firmvare?

[REDACTED]

What is your system OS and is it fully patched on the Windows Update side?

I have windows 7. Patched??? It had an update today

I do and run the scan, not only does it NOT find anything resembling the smb virus

It is not a virus, CVE-2017-0144 is a exploit / Vulnerability

CVE list  https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=30010


Try close port 443 on router and see if message goes away
Does router have latest firmvare?

I dont have a router.  Ethernet cable straight to NBN box.

[Pondus]

wrong port posted above, edited

In your computer try disable the file sharing on your computer and block the incoming traffic on port 445

Ethernet cable straight to NBN box

Does it containe a firewall?
Do you have log in access?

[REDACTED]

In your computer try disable the file sharing on your computer and block the incoming traffic on port 445

Ethernet cable straight to NBN box

Does it containe a firewall?
Do you have log in access?

(Have not replied because of work)

Ok I've done all that, I'll see how it goes.  I don't know how to answer the firewall question.  When you ask do I have log in access... Do you mean do computers need a username and password to connect to my internet? Yes.