JS Exception or Exploit virus?

Discussion in 'malware problems & news' started by Digiti, Apr 15, 2002.

Thread Status:
Not open for further replies.
  1. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    I got this little bugger today when my son was surfing warez sites. Norton picked it up right away .I  now have three files in quarantine[I could not repair or delete]. One of these is listed as Windows\local settings\temp internet files\content IE5\CTE3CXE3\STARTNOW[1]. js. I did a complete virus scan with no viruses found.
    Am I in the clear now, or it there something else I can do?The computer is working normally. Pop-ups were the trigger for the infection..no file was downloaded or opened other than a webpage. I am using Win95b I.E 5.0 SP2. Thanks
     
  2. snowman

    snowman Guest

            the following is just a suggestion.....not making any promise that it will definitely work.

           there is a program here at the wilders freetools section  named "spider"....that will clean you idex-dat files.....urls....cookies...temp internet files..history...it works well with win95...............

             did you clean your temp folder?   an then run your anti virus program again....

              there are other programs that will also do the job spider does.....fe: internet sweeper......but I am not really sure of their setting so mention spider......which I've used in the past.

              so as to prevent this from happening again have you considered using a proxy that stops java script....pop-ups..etc?    an if not a proxy then just a simple program that will stop pop-ups.......you may also consider using a script detector...

             imo java and activeX should be disable...in internet explorer...........used only at the most trusted websites.........those you have put in the "trusted zone"

            you can try cleaning your temp folder then deleting those virus files.....may work.....

                          snowman
           
     
  3. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    Thanks for the reply snowman. I forgot to mention I used a program called DiskCleaner to delete temp internet files, Windows temp files, documents list, but not cookies. Unfortunately, I need some of those cookies. I also have Scriptsentry and the latest NAV definitions.
     
  4. Mr.Blaze

    Mr.Blaze The Newbie Welcome Wagon

    Joined:
    Feb 3, 2003
    Posts:
    2,842
    Location:
    on the sofa
    :DTHAT FUNNY I GET THOSE ALL THE TIME BUT THERE NOT FROM WAREZ SITES LOL

    PORN LOL :D

    Warez deals in more nastyer stuff usealy hiden with in a dowenload program

    i get mass of those js exploits and nav 2002 has wiped them out for me.

    i get hit by more nasty thinghys that i almost know what i get hit with befor i even look at quarintien.

    you sure it was a warez site lol and how old son most kids dont know about warez til there about 16.

    usealy adults go to warez lol.
     
  5. snowman

    snowman Guest

            Digiti

            you are most welcome......sorry I could not offer more help......my thoughts were that perhaps the files were re-installing themselfs by way of the index.dat file.

            wishing you the best


                     snowman





                   MRBLASE

                       hope you are doing well
     
  6. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
  7. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    Dear MRBLAZE,
    FYI my son is 21yrs. old so you can imagine I have little control over what he does, He was looking, he said, for a "free" version of a game. I tried to warn him about the seamy side of the internet to no avail.
     
  8. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    Dear Paul,
    Thanks for the informative link.
    Digiti
     
  9. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    My pleasure, Digiti.

    regards.

    paul
     
  10. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Digiti - You're going to delete them from quarantine, right? Pete
     
  11. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    Dear Spy1,
    What is the best way to delete the virus infected files from quarantine in NAV 2001 PRO? Will selecting delete in the quarantine gui restore the file to its original location, or will it indeed delete it from the hard disk? Thanks for your help. AS you  can see I very wary about these viruses.
     
  12. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    http://securityresponse.symantec.com/avcenter/venc/data/remove.from.quarantine.html .

    Might want to read that and go from there. HTH Pete
     
  13. Digiti

    Digiti Registered Member

    Joined:
    Feb 14, 2002
    Posts:
    39
    Dear Pete,
    Thanks. They are gone!
    Regards,
    Digiti
     
  14. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Digiti - You're quite welcome. Pete
     
  15. crkit1

    crkit1 Registered Member

    Joined:
    Aug 31, 2002
    Posts:
    93
    Location:
    Florida
    Does deleting JS_Exception from temporary Internet files get rid of it? I have run virus checker over the whole system again and it says there is nothing there, is that good enough?
     
  16. Technodrome

    Technodrome Security Expert

    Joined:
    Feb 13, 2002
    Posts:
    2,140
    Location:
    New York
    Yes! You are alright. ;)


    Technodrome
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.