Adware.Adsponsor

[Hex13]

Here is my History

8/7/2009 10:11:37 PM:721
IntelliGuard: System Event Blocked
Threat Name - Adware.Adsponsor
Details - Spyware Doctor has blocked an application attempting to access a file.
Risk Level - Low
Infection - C:\WINDOWS\TEMP\_AVAST4_\UNP212023029.TMP
8/7/2009 10:11:37 PM:724
IntelliGuard: System Event Blocked
Threat Name - Adware.Adsponsor
Details - Spyware Doctor has blocked an application attempting to access a file.
Risk Level - Low
Infection - C:\WINDOWS\TEMP\_AVAST4_\UNP212023029.TMP
8/7/2009 10:12:16 PM:113
IntelliGuard: System Event Blocked
Threat Name - Adware.Adsponsor
Details - Spyware Doctor has blocked an application attempting to access a file.
Risk Level - Low
Infection - C:\WINDOWS\TEMP\_AVAST4_\UNP80904531.TMP
8/7/2009 10:12:16 PM:116
IntelliGuard: System Event Blocked
Threat Name - Adware.Adsponsor
Details - Spyware Doctor has blocked an application attempting to access a file.
Risk Level - Low
Infection - C:\WINDOWS\TEMP\_AVAST4_\UNP80904531.TMP

-----

I have already uninstalled and reinstalled avast and this still happens. Any idea why is this happening? It pops up a lot.

[haapy]

Is it possible the you have files in the Avast quarantine?

Try purging the Avast quarantine and see if this helps.

[Hex13]

I have checked the avast virus chest and it's empty. Since the warning pops up a lot does that mean the file is trying to go online?

[haapy]

Hard to say.

You say you uninstalled Avast and it still happens. After you uninstalled Avast, did you delete the C:\WINDOWS\TEMP\_AVAST4_ folder?

Since the files are .tmp files in the temp directory, I would think that the files are not needed. If I remember correctly, when I used Avast, the C:\WINDOWS\TEMP\_AVAST4_ folder was always empty.

You could try moving those files to make sure everything works OK and then delete them.

[Hex13]

I have checked the folder and all I see is "Webshlock" it's a text document. It's been 20 mins now and no pop up from intelliguard.

[haapy]

Have you run a Spyware Doctor scan?

[Hex13]

I have ran a scan and nothing came up.

Here is what avast had to say

http://forum.avast.com/index.php?topic=47446.0

[haapy]

It will be difficult to report a false positive since they are temp files and are gone. For the same reason, you can't put them in the GAL.

Since all you have in that _Avast_ folder is Webshlock (and from research, this seems to be a normal Avast thing), I assume that no more pop-ups are occurring.

It is too bad Avast can't shed some more light on what those temp files were.

Have you thought of dumping Avast and using Spyware Doctor with Anti-virus? A comvenient package.

If you are really concerned about AV, you can always get Avira free as a backup standalone scanner as long as you disable the Avira scheduler service and remove it from your start up. When you do a backup scan you need to start up the scheduler service to get the updates.

[AChen]

Hi Hex13,

The developers are currently looking into this issue. In the meantime try setting File Guard to Processes only and see if the problem is still occurring.

[Seffrid]

I have also had this problem (over the last 3 months or so), always affecting the _AVAST4_ temporary files, and whenever accessing massively.com and also attempting to login or post here. It can also crop up elsewhere but those are guaranteed to produce the false positive report.

Thanks AChen for your suggestion, I confirm that it has worked for me although I must confess I'm not savvy enough to know how serious any potential downside could be from excluding scripts from the SD procedures. Am I compromising safety in doing this? I hope the devs come up with a better solution soon. Thanks also for activating my forum account manually, btw.

[silvertones]

I reported this issue a long time ago and finally gave up. Avast has a new version 5 coming out in Oct.

[silvertones]

New version of Avast today. Let's see if SD still eats it up.

[silvertones]

Yes it does!

[Hex13]

I've been busy but thanks to everyone who posted. I decided to turn off the Web Shield (Avast) to kill the problem.

[silvertones]

There are only a couple of times( web Sites) were this happens. Oddly enough this web site, the Avast web site and a couple others. Instead of turning the web shield completely off open the on access protection control, click on web shield, customize,Exceptions and add the websites that are a problem. That way you're still protected on other sites.