Possible Virus? Help!

[BKR]

I believe I have a virus on my system. I have NAV 2002 installed on my system with current virus defenitions. I received a message that there was a trojan horse on my sytem specifically labeled JS.Exception.Exploit. The message stated there was nothing that could be done to remove the trojan horse because the file is not accesible. I promptly did a full system scan and it doesn't appear, says there aren't any viruses on the machine. I'm stumped as to whether or not I have a trojan horse, and if so then how would I go about getting rid of it if it doesn't come up. I would like to avoid re-formating the hard drive...any help would be appreciated.

 

[minendo]

Go to Microsoft.com and do critical updates.

 

[Maggotry]

Norton probably caught the virus on its way in to your system and quarantined it. You're most likely not infected. Open Norton and look thru the reports.

 

[minendo]

<< Norton probably caught the virus on its way in to your system and quarantined it. You're most likely not infected. Open Norton and look thru the reports. >>


The reason it detected it is probably because someone/some program was trying to connect via an exploit in Microsoft VM.

Details can be found here.

 

[BKR]

Ok sorry, yes I had already done the Microsoft Critical Updates prior to this happening. Here is the message from the log in NAV:

The file
C:\Documents and Settings\Whoop Ass\Local Settings\Temporary Internet Files\Content.IE5\QIATU4W6\startnow[1].js
is infected with the JS.Exception.Exploit virus.
Access to the file was denied.

I'm wondering since it says that the file is infected but Norton doesn't catch it in a system scan is it there or not. There isn't anything quarantined in NAV.

 

[BKR]

minendo, would that patch have been included in the critical updates for IE 6 or not?

 

[minendo]

<< minendo, would that patch have been included in the critical updates for IE 6 or not? >>


Honestly I don't know. Have you followed the path given by NAV to the location of the file to see if it is actually there? If it is there, just delete it.

 

[Maggotry]

Here you go!

It even tells you exactly how to detect and remove it. Step #2 is probably why you can't find it.

 

[BKR]

Maggotry I can't get the link to work can you post the url?

 

[Maggotry]

Works fine when I click it, but here's the url: http://securityresponse.symantec.com/avcenter/venc/data/js.exception.exploit.html.

 

[BKR]

I believe NAV is configured to scan all files, I checked the location of the file according to the report and don't see anything there. The temporary internet folder only has four cookies in it that I can see. I cleared the folder, does this mean it's deleted now? I also ran AVG antivirus and it didn't come up with anything either. Is the problem solved? Is there any way that I can be sure it's gone since NAV never detected it in a scan and I didn't delete anything through NAV?

 

[minendo]

<< I believe NAV is configured to scan all files, I checked the location of the file according to the report and don't see anything there. The temporary internet folder only has four cookies in it that I can see. I cleared the folder, does this mean it's deleted now? I also ran AVG antivirus and it didn't come up with anything either. Is the problem solved? Is there any way that I can be sure it's gone since NAV never detected it in a scan and I didn't delete anything through NAV? >>


Make sure there are no hidden files.

 

[BKR]

In folder options show hidden folders and files is checked is that sufficient?

 

[ThaGrandCow]

try clearing your internet cache. Thats usually where java bugs are.

 

[BKR]

Cleared my cache, just wondering if there is any way to be absolutely sure that it is gone?