Author Topic: DSL connection fail  (Read 6556 times)

0 Members and 1 Guest are viewing this topic.

Al

  • Guest
DSL connection fail
« on: May 03, 2004, 06:43:48 PM »
Hi, friends.

When i update my avast home, DSL connection works fine, but programs can't access to Internet (navigators, e-mail, avast update,...
Problem is the avserver module or program (I suppose it is part of avast). When it's active, it block Internet access. Someone can help me???

Summoner Yuna

  • Guest
Re:DSL connection fail
« Reply #1 on: May 03, 2004, 09:47:50 PM »
Quote
Problem is the avserver module or program (I suppose it is part of avast).
Yes that is part of avast.

I do not have this problem so the alwil team or a more experienced user will have to awnser this one

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:DSL connection fail
« Reply #2 on: May 03, 2004, 10:04:33 PM »
avserver? Is it really called exactly like this?? What version of avast do you have?
If at first you don't succeed, then skydiving's not for you.

Al

  • Guest
Re:DSL connection fail
« Reply #3 on: May 03, 2004, 10:32:48 PM »
I have 4.1.357. When i uninstall Avast, Problem dissapear. It Is only when i update the program (not definitions) when i have the problem.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:DSL connection fail
« Reply #4 on: May 03, 2004, 11:05:53 PM »
avserver is certainly not part of avast 4.x. Isn't it avserve -- in this case, that would be the new Sasser worm!
If at first you don't succeed, then skydiving's not for you.

CoJo

  • Guest
Re:DSL connection fail
« Reply #5 on: May 04, 2004, 01:57:23 AM »
avserver is certainly not part of avast 4.x. Isn't it avserve -- in this case, that would be the new Sasser worm!

FYI from one of my newsletters...and I apologise for the the length of the post!


Threat Level: Serious
Threat Name: W32/Sasser.worm.a
Threat Type:  Virus/ Internet Worm
NOTE: Systems which are regularly updated with the latest updates from Microsoft are not vulnerable to this Worm. It is critical that you keep your Windows system updated by checking http://windowsupdate.microsoft.com/ and keeping your Anti-Virus program updated several times per week. If you don't have Anti-Virus software get AVAST (free for home use) at http://www.avast.com/ .

This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)]

The worm spreads with the file name: avserve.exe . Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code.


If you think that you may be infected with this threat, and are unsure how to check your system, you may download the Stinger tool to scan your system and remove the virus if present.  

Note: Infected systems should install the Microsoft update to be protected from the exploit used by this worm. See:
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

In order to secure you system from potential new variants of this worm which may be introduced in the near future make sure you have your Windows updated with the latest security patches and fixes from http://windowsupdate.microsoft.com/

How It Spread and Works:

This worm spreads by exploiting a recent Microsoft vulnerability, spreading from machine to machine with no user intervention required.

This worm scans random IP addresses for exploitable systems.  When one is found, the worm exploits the vulnerable system, by overflowing a buffer in LSASS.EXE.  It creates a remote shell on TCP port 9996.  Next it creates an FTP script named cmd.ftp on the remote host and executes it.  This FTP script instructs the target victim to download and execute the worm (with the filename #_up.exe as aforementioned) from the infected host.  The infected host accepts this FTP traffic on TCP port 5554.

The worm spawns multiple threads, some of which scan the local class A subnet, others the class B subnet, and others completely random subnets.   The destination port is TCP 445

The virus copies itself to the Windows directory as avserve.exe and creates a registry run key to load itself at startup

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "avserve.exe" = C:\WINDOWS\avserve.exe
As the worm scans random ip addresses it listens on successive TCP ports starting at 1068.  It also acts as an FTP server on TCP port 5554, and creates a remote shell on TCP port 9996.

A file named win.log is created on the root of the C: drive.  This file contains the IP address of the localhost.

Copies of the worm are created in the Windows System directory as #_up.exe.

Examples

c:\WINDOWS\system32\11583_up.exe
c:\WINDOWS\system32\16913_up.exe
c:\WINDOWS\system32\29739_up.exe
A side-effect of the worm is for LSASS.EXE to crash, by default such system will reboot after the crash occurs.

 If you think you may be infected, download the McAfee Stinger tool to remove it:

Manual Removal Instructions
To remove this virus manually, follow these steps:

Reboot the system into Safe Mode (hit the F8 key as soon as the Starting Windows text is displayed, choose Safe Mode.
Delete the file AVSERVE.EXE  from your WINDOWS directory (typically c:\windows or c:\winnt)
Edit the registry
Delete the "avserve" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Reboot the system into Default Mode

I did have my system scanned and was not infected :)
also, got another patch from Windows today...

HTH,
cojo




 

Al

  • Guest
Re:DSL connection fail
« Reply #6 on: May 04, 2004, 11:32:46 PM »
Thanks, is true, it was sasser virus. Infection was produced when i update Avast, and it confuse to me. Sorry by my English, it's not my native language. Thanks to all and by the fast answer.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48523
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re:DSL connection fail
« Reply #7 on: May 05, 2004, 12:07:59 AM »
All right CoJo:
You hit the nail right on the head with the sasser worm.
and you call yourself a novice   ha ha ;D
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

CoJo

  • Guest
Re:DSL connection fail
« Reply #8 on: May 05, 2004, 01:42:08 AM »
Thanks, is true, it was sasser virus. Infection was produced when i update Avast, and it confuse to me. Sorry by my English, it's not my native language. Thanks to all and by the fast answer.

Al, your English is fine!!
I hope you got your system rid of this nasty virus...

cojo

CoJo

  • Guest
Re:DSL connection fail
« Reply #9 on: May 05, 2004, 01:47:09 AM »
All right CoJo:
You hit the nail right on the head with the sasser worm.
and you call yourself a novice   ha ha ;D

thanks, Bob, but Vlk mentioned it right after I read the newsletter and I just took a chance on posting it!
oh, yeah...I am still learning ;)

cojo

shgoh

  • Guest
Re:DSL connection fail
« Reply #10 on: May 05, 2004, 04:46:21 AM »
this sasser worm is really bad...my uni network is down for a while due to this worm 2-3 days back... :'(

and my uni uses norton!!...maybe that's why!!
 ;D