Problem while installing Microsoft .net Framwork 2?

[infernal535]

My avast antivirus, for some odd reason posted me a popup, saying that when installing microsoft framework, retrieved from http://msdn.microsoft.com/en-us/netframework/default.aspx this website, that some form of malware was being installed in my windows folder.

Why did this pop up?

I then proceeded to do a boot time scan, and nothing happend then.

[Lisandro]

avast does not have this popup... or your computer is infected with scumware (fake avast) or so...
I'm not sure, but that site seems clean (for both avast and Dr Web, and other antiphising tools).

[Lisandro]

I've forgot to say that I think Microsoft NetFramework is not need for anything related to avast...

[DavidR]

What exactly was the alert - What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

Did the screen go a transparent colour with the alert (avast self-defence module) if so info on that is contained in this file, C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log, you can check it with notepad.

[infernal535]

12/31/2008 1:17:53 PM   SYSTEM   1504   Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004. 

Is that what your looking for?


I actually received two notices, one with a virus detected, notice to either ignore or delete, then after I hit ignore (as I really did not believe it was a virus, and it would just mess up my install) a second blue cube popped up saying that it was dangerous to run the computer while there was this virus .. and to press ok to restart and run a boottime scan

It definetly is not a fake avast as well, as it was downloaded straight from this website.

[DavidR]

1. That isn't an alert on an infection, that would look like this.

13/11/2008   01:02:43   1226538163   SYSTEM   1452   Sign of "Win32:Crypt-CZU [trj]" has been found in "E:\Downloads\mbr.exe" file. 

What you posted is just an inability to scan a file, nothing to worry about.

2. The Ignore/Delete comes from the anti-rootkit scan 8 minutes after the boot and info on that can be found in this file, C:\Program Files\Alwil Software\Avast4\DATA\log\aswAr.log open with notepad, at the bottom of the file is a summary. There should I believe also be what was detected.

With a possible rootkit avast would normally suggest a boot-time scan, you should allow that, there is a possibility it won't find anything as the anti-rootkit scan uses other detection methods (heuristic, etc.).

When the system reboots after that scan, 8 minutes later it may alert again (make notes, file name, location, text of alert, etc.), allow the file to be sent to avast for analysis, check and take the recommended action (likely to be Ignore if not a 100% positive detection).

[infernal535]

1. That isn't an alert on an infection, that would look like this.

13/11/2008   01:02:43   1226538163   SYSTEM   1452   Sign of "Win32:Crypt-CZU [trj]" has been found in "E:\Downloads\mbr.exe" file. 

What you posted is just an inability to scan a file, nothing to worry about.

2. The Ignore/Delete comes from the anti-rootkit scan 8 minutes after the boot and info on that can be found in this file, C:\Program Files\Alwil Software\Avast4\DATA\log\aswAr.log open with notepad, at the bottom of the file is a summary. There should I believe also be what was detected.

With a possible rootkit avast would normally suggest a boot-time scan, you should allow that, there is a possibility it won't find anything as the anti-rootkit scan uses other detection methods (heuristic, etc.).

When the system reboots after that scan, 8 minutes later it may alert again (make notes, file name, location, text of alert, etc.), allow the file to be sent to avast for analysis, check and take the recommended action (likely to be Ignore if not a 100% positive detection).

hmm, well it was the on-access scanner that detected it.

I'm not sure why it is not in the logs

[DavidR]

Example detection with on-access scanner.

Which as you can see is different to the Ignore/Delete that you mentioned, unfortunately I don't have an image to show this anti-rootkit alert, which is why I gave the file locations.

Check the data file directly, C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log, this is where the on-access scanners would place info on detections, so if it was an on-access detection it should be there