Hello,
First of all thx for the great program CCleaner, works like a charm, but now i got some disturbing news :-(
i googled through some stuff, and one link was to this forums lo-fi version, google adwised not to enter, since it could contain Badware?
see this http://www.stopbadware.org/reports/contain...dex.php/f2.html and i though naa not true, i deside to enter anyway, and bam my kaspersky antivirus popups with an alert, Trojan-Downloader.Win32.VB.bip (file is EDITED AWAY FOR SECURITY REASON I GUESS)
this only happens on the lo-fi version of this forum? what is happening, im sure your not trying to kill my pc but??
Maybe you should fix this?

Edit:
Some additional info about the claimed trojan:
Click to view attachment

Hi Miracle, sorry I'm not qualified to answer your question, but when I changed to the lo-fi version just then, Avast immediately picked up the same thing.



I've no doubt one of the guys will be along soon. Thanks for the info.

This has already been mentioned here:
http://forum.piriform.com/index.php?showtopic=12142

Something tries to download from watch77.com named setup.exe, I'm going to notify MrG because the forums are probably being hacked which could explain why they're so goddamned slow all the time.

I sent MrG a PM about it, it's up to him now.

Edit:
The two sites that auto load are:
liveupdatesnet.com
watch77.com

I'm going to block them on my system via the HOSTS file. I feel sorry for anyone using IE.

What exactly is the lo-fi version? I clicked on it and a file started downloading?

Lo-Fi doesn't have images, etc. DO NOT allow that file to download it is infected with a Trojan horse.

Just to let everyone know until MrG fixes this that blocking those sites in Firefox's Adblock Plus add-on and in the Windows HOSTS file will completely block those sites. I'd recommend also blocking them in Internet Explorer.

Thanks for that tip.

Well when I clicked on lo fi and the download started AVG did not detect anything.

AVG Free on my system detected it immediately!
Edit: AVG Anti-Virus that is, not the anti-spyware.

It detected as soon as the the download began? Not me. File downloaded and asked what I wanted to do run or save. I canceled and did neither but no warning from AVG. I am running all my malware apps now to see if I got zapped. I did not run the exe so I should be fine but we will see.

Yea i notisched that, but it diden't mentioned any trojans , or some more details about what was making the bad call

Apologies for this, all fixed now!

It looks like this hack crept in at some point. I've checked the rest of the system and it's fine. All the admin and system passwords have been reset for safety.

MrG

Nice one MrG.

Good thing resetting the passwords, someone mentioned that was required on another forum that was also hacked with a Trojan.

Still wondering why AVG didn't detect anything here? I ran every scanner I have and I am clean.

Have you updated AVG Anti-virus today? My installation had three separate updates.

Every day it auto updates. In fact today it had a big program update as well as the definitions. Hmm this has me concerned. Let me get this straight. As soon as you click the link for lo-fi you immediately get an AVG alert? Or did you download the file and try to save or run it and than AVG alerted you?

As soon as that hack attempted to automatically have setup.exe download I was presented with the Firefox download window. I hadn't downloaded the file, and before I could close the download window to cancel the download dialog AVG detected the Trojan and quarantined it into the AVG Virus Vault. I did have to delete it from the Virus Vault to get it off my system, however doing an AVG Free, SuperAntiSpyware Free Edition, and A-Squared Free scan afterwords didn't turn up anything on my system, so in my case AVG Free totally protected my system.

You're much better off and safer only testing the functionality of AVG or other antimalware on your system using the test virus (it's not a real virus) called EICAR which won't infect your system.

I clicked the link for lo-fi and a download window opened in Firefox. It downloaded in seconds before I could cancel. Than there was an option to save or cancel, can't remember if there was an option to open. I canceled and that was it. No AVG warning for me. I ran all the scan you did and many more and I am clean.

I have never tried that test file you linked. What do I do just download it and see what happens? How do I get rid of the download after? I guess my anti virus will quarantine it and I have to delete from there?

Tried that test file and AVG got right away. Maybe I canceled the other before AVG could do anything?

Well very strange results here. When I run that test file on IE7 or Maxthon AVG alerts me immediately. When I use Firefox or Opera I get NO alert from AVG at all. It lest me download the file with no problem. Whats going on with that?

I don't know why it would immediately detect it on my system and no yours. I'm clean out of ideals, and suggestions.

I'm getting no alerts at all from AVG AV when Using Firefox with that test file. It gets stranger. AVG AV will alert me when using the test file if I download with IE7, Maxthon, and Opera 8.54. When I use Firefox or Opera 9 to download I get no alerts and I can download any where I want to without any kind of intervention from AVG AV. As of now Firefox is shelved until this is figured out. I could have very easily been infected today on this forum using Firefox because I did not get any warning about that trojan from the lo-fi link. The test file confirms it for me. I am currently posting on the AVG Forums and Firefox Forum about it. Going to try the Opera forum to. Oh by the way I have confirmed this on 3 machines here.

Strange.
I don't know if my two download managers make a difference or not DownThemAll, and Orbit Downloader which are both plugged into Firefox as an extension, I don't see how they could but I don't know for sure.

Well even though I get no alerts when downloading with Opera 9 or Firefox I do get them when trying to open the file. So it lets me download with no alerts but I can't open them so I am still protected but this is BS. I will dump AVG before I dump Firefox and Opera.

Well according to some of the people on the Firefox and AVG forum what I experienced is normal It has something to do with how FF handles downloads compared to IE. The mod on the AVG forum says that AVG doesn't scan the download from the internet. It detects the infection from files already on the machine. On the Firefox forum they say that they get the same results as me and that it supposed to be that way. In FF3 it will use your AV to scan downloads. Hmm

Maybe your download managers do change the way AVG detects the downloads?

I went through this exact same thing a while back Dennis. I found the solution was to go into AVG Control centre, right click the resident shield, select properties and tick the box for 'On close scanning'. (Apparently it's not enabled by default because it can be slightly resource hungry on some systems, no problem on two different computers here though)

The AVG resident shield on my system is in the factory default settings - I haven't changed anything after figuring out it was the reason all those big 41mb plus .AVG files were appearing in AVG's application data folder. I'm wondering if that Firefox tweaker FireTune had something to do with, I really have no ideal.

This is the AVG resident shield settings I'm using (I think they're the defaults):

The plot thickens with more utter strangeness, because when I go to download the EICAR test virus either as a .com, .txt, or .zip file AVG Free doesn't spring into action, and allows it to download.

Edit: Change that, when actually allowing the download to start AVG does detect it. But when I checked the lo-fi version of the forum yesterday when that .exe file tried to automatically download AVG sprang into action before I could click anything in Firefox at all. This is making my head hurt.

Those are the defaults. I have selected scan all files on my AVG installs.

I will link the thread I have going on AVG so you cans see what the Mod there is saying. According to him AVG is behaving as it should. He says all AV do it this way.
http://forum.grisoft.cz/freeforum/read.php...2,backpage=,sv=

Try downloading the test file in IE. AVG piratically jumps out of the screen when I do this.


I have tried all versions of that test file in Firefox and Opera 9 multiple times on 3 machines and not once do I get an alert during the download. I downloaded to desktop with no intervention from AVG. If I try to run or open the test file AVG alerts me instantly. With IE, Maxthon, and Opera 8.54 I get AVG alerts as soon as I attempt a download. It seems to me IE's behaviour is safer by allowing AVG to alert immediately.

Once I downloaded that test file to desktop I tried a few apps on it. I used the right click context scan of A-squared and it detected nothing. I did the same thing with SAS and it detected nothing. AVG AS right click context menu scan detected the bad file. I turned on the resident protection for Windows defender and downloaded the file again and Defender missed it.

I just used IE to attempt to download eicar.com, and immediately before I could click anything AVG sprang into action allowing me to deal with it before I even downloaded it.
1. First my download manager Orbit Downloader was going to fetch the file and AVG caught it before I could tell Orbit Downloader where to download the file, so I selected heal which moves it to the virus vault.
2. Then I canceled Orbit Downloader and exited the whole program which then sent the download to the normal IE download window and AVG caught it yet again, and yet again I was able to heal it without actually downloading anything.
In IE's case it had already downloaded eicar.com into Temporary Internet Files, according to the AVG Virus Vault.

With that Trojan yesterday Firefox had already gotten approximately 28 bytes of the file and AVG caught it, according to the AVG Virus Vault.

Edit: What that mod is stating on that forum makes no sense to me. If anti-virus can't detect what's in a web page then what the hell is the use of having real-time protection. Then again maybe I'm reading what he stated incorrectly.

Well I take what the mod said the same as you are. I asked him clearly in one of my posts as you probably read and he said AVG or any AV will not scan the download. It will only scan a file already on the system if you attempt to run or open it. If you want active scanning of downloads you use a AS program.

It would seem to me IE7 is safer as far as this issue is concerned. I would prefer to be notified immediately of a bad download not after I download and try to open it.

I am curious what others are experiencing with Firefox, AVG AV and that test file. Also how do other AV programs deal with that test file using Firefox to download. I would like to see what happens using Avast AV if you download that test file with Firefox.

Well my Kaspersky internet security 2007 caught all attempt to download any of the test viruses, both in Ie and firefox, its the web antivirus module that will catch the virus, guess AVG dont have such a module, and im happy to see this working flawlessly :-) . The major reason i use KIS is because of its incredible speeds, if keeps a database over what it has scanned in the past, and dont make a full scan of files in the database that seem to be unchanged, making the scanning verry fast, think thats the only program that has that feature, and so far no viruses :-)

Read the link I provided to the AVG forum and the thread I started. The mod says all AV work like I have said mine is. I find that hard to believe and you just confirmed it for me. It seems I am safer using IE7 than Firefox as long as I am using AVG AV as perverted as that sounds. May be time to switch. I would like to hear from Avast and Antvir users how there AV handles that test file when Downloaded with Firefox.

I doubt you're safer using IE7 due to how hooked it is into the system. Perhaps reinstall AVG over what you have now to essentially do a "repair install." I know Kaspersky works as mentioned by Miracle as should any other antivirus without really giving something a "gimmicky/tech name" like web shield or whatever as all executable files (all .htm, scripts, etc. in web pages) will be scanned by any run of the mill antivirus with a resident shield.

Repair install? Why? Three machines here do it. I don't think I have three corrupt installs. The mod on the AVG forum says that what it's supposed to do. The guys on the Firefox forum say it does that to with AVG when they run the test file. Seems that is how AVG works and there is nothing to repair. The only option is to use another AV app.

Didn't you say that AVG gave no alerts on the download of that test file when using Firefox? You were alerted when you tried to open/run the file?

Maybe I will try the on close scanning option in AVG and see what happens.

Ok, I seem to have forgotten that part already. So I too highly doubt you have any "corruptions" in AVG.

I never tried to run the file. AVG detected the eicar.com file immediately, probably because it's an executable file. It didn't detect the eicar.txt or eicar.zip file.

Edit: Correction with a better explanation:
It didn't detect the eicar.txt or eicar.zip file. I would've had to download them and actually scan them.

Update. When using the on close scanning option AVG did detect the test file immediately on downloading. It did not detect the zip test file though until you try to open it.

Andavari, where did you say that the big files were created in AVG when using the onclose option? I want to keep on eye on this.

AVG 7.5 has an updated cleaning routine that's currently in winapp2.ini that I submitted to TwistedMetal. MrG hasn't got around to putting it in the default winapp.ini yet.

They're located here, on Windows XP at least:
C:\Documents and Settings\All Users\Application Data\Grisoft\*.AVG
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\*.AVG

Thank You.

Are you using the onclose option in AVG if so that will explain why you get some alerts on download. In one of your previous posts you said AVG alerted you when you downloaded the eicar executable file but not the zip files. That's what is happening with me now with the on close option selected.

Yep, i read it, and he is both right and wrong :-) , since kasperskys web antivirus, is only scanning incomming traffic on a port u choose(default 80) , and i guess its working by making a little buffer before it writes the data to the disc, and therefore can catch any unwanted code in a file, before its written to the disc(depend on the buffer you set(Edit:With Buffer i mean, you can choose how long time is allowed for scanning of data,default is 1 sec)), but it wont scan a whole webpage and all its files(Edit: it will scan the current webpage, but not links), only when you choose to get the file, it will analyze the fragments it will get, so if the virus was big enough i guess it could be transfered to the disc without any warning, though now im examinig how its working, im not sure if its worth the (little) slowdown of internet browsing, since if the file was downloaded, and i try to open it, kaspersky would scan the whole file anyway :-). But im not into all of the algorithme it uses for scanning, and even dont know if i would be more unsafe if kaspersky would first warn me when i try to open the file. But hey i feel pretty safe with all the blocking stuff hehe

For all new commers, that goes straight to the last page, i must add, LO-FI Version of this forum is now clean, thx MrG

Quote Post 13:

Apologies for this, all fixed now!

It looks like this hack crept in at some point. I've checked the rest of the system and it's fine. All the admin and system passwords have been reset for safety.

MrG

Quote End

I'm not using On Close, because I had figured out that messing with the resident shield settings is what caused all those .AVG files that were appearing far too often.

I don't however know what exact setting in the resident shield causes those .AVG files to be created, which is why I've left the resident shield at the default setting and didn't mess with it when I reinstalled AVG Free on August 2, 2007.

Meaning, maybe you 2 should start a new thread about why freeware Antiviruses, ain't filled with more options? hehe, let this thread be done, its big enough allready, and its fixed :-)

That's what I was thinking earlier myself.

Another forum I visit would have split this thread in a nano second and moved our av discussion into a unique thread all its own, and locked this very thread since MrG fixed the issue with the forums.

However if you haven't noticed this forum goes off topic allot. It's unavoidable, and many of us are guilty of doing it on a regular basis which is probably why many people have stayed on this forum for so long as it isn't uptight for the most part.

i understand, but as longer you continue the longer away you go from the main topic, it would be better in a anoter thread, also it would be much easier for newcommers to search for their simmilar fault ect. :-) EDIT: i been on such forums, and i hate it, its so difficult to get an answer to ur fault, since u have to read about 100+ post to get the answer :-( , so plz try to understand this, its for everyones good :-) I know ur a bright man, reading almost all ur post, i see you know ur stuff, so, i almost know as much in he pc world as you, even more in some areas :-), but try to keep the forum clean, of info you can gather in a day :- Since most ppl, wont be able to comprehend it :-)

I'm on a role of not being comprehended lately!
Either I'm unlearning English, or I'm typing in Klingon.