Author Topic: Possible Conflict with Spyware Terminator Update?  (Read 8960 times)

0 Members and 1 Guest are viewing this topic.

Kyuzo

  • Guest
Possible Conflict with Spyware Terminator Update?
« on: May 12, 2009, 07:47:22 PM »
I have been using Avast! along with Spyware Terminator (integrated with ClamAV) for years without problem. However, this morning -after both program's updates-I turned the computer off. Later, when I restarted the computer I received the following warning from Avast!:

"File C:\Windows\Temp\clamav-5b396513da04bb1cd6447b4417ffca   contains a sample of script JS:ScriptSH-inf[trj] "

I reasoned that this was perhaps a conflict between the two programs and therefore deleted the file. Upon restart, the same message returned albeit with the file number changed. I moved this file to the Avast! quarantine chest. Upon restart the message returned this time with another file number (i.e. the file address remains the same until after the words "clamav-" and after that the file number changes). The script "JS:ScriptSH-inf[trj]" remains the same in each Avast! warning. I deleted my computer's temporary files to no avail. The warning returns on each startup.

I was wondering if someone could offer an opinion as to what my next action should be. I'm almost certain that this is merely a case of two security software programs interacting. However the Avast! virus warning popping up on each restart is a bit aggravating.

My thanks, Kyuzo.
« Last Edit: May 12, 2009, 07:48:57 PM by Kyuzo »

rdmaloyjr

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #1 on: May 12, 2009, 07:53:53 PM »
ClamWin (without Spyware Terminator) keeps reporting a sign of JS:ScriptSH-inf[trj].

Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #2 on: May 12, 2009, 07:57:07 PM »
I replied to your post regarding this as well! ;D My Avast! keeps flagging my ClamAV update upon each restart.

Perhaps the people at Avast! can remedy this issue now that we have pointed it out.

Regards, Kyuzo.

Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #3 on: May 12, 2009, 07:58:53 PM »
By the way, do you mean that your Avast! program is finding this script in your Clamwin program, or vice versa?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Possible Conflict with Spyware Terminator Update?
« Reply #4 on: May 12, 2009, 08:03:12 PM »
Maybe another classic example of two antivirus conflicting.
I think ClamWin has *merely nothing* do add to avast detection.
It's a sensation of security and not security itself.
Even SpywareTerminator, nowadays, will add very very little. They are useful as a second opinion, non-resident.
The best things in life are free.

Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #5 on: May 12, 2009, 08:12:55 PM »
I must respectfully disagree. While I realize that Spyware Terminator is looked down on a bit as somewhat outdated, I recently had an experience which proved its usefulness. My niece was using my computer to access her MySpace page. One of her friends provided a link to an associated site (I know little of MySpace). When she clicked on the link, there was an attempt by that site to install a MyWebSearch toolbar, some sort of autodialer and several other pieces of malware. Unfortunately, Avast! did not flag a single piece of malware. Surprisingly, Spyware Terminator/ClamAV alerted regarding the toolbar, autodialer and one other piece of malware. When I scanned with Avast! there was no sign of detection, but SuperAntiSpyware subsequently found 22 issues and Malwarebytes found 6 registry entries related to the attempted install.

This is not to disparage Avast! as it has been my AV for years. It is to point out that having a backup is not such a bad idea.

Regards, Kyuzo.
« Last Edit: May 12, 2009, 08:15:52 PM by Kyuzo »

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: Possible Conflict with Spyware Terminator Update?
« Reply #6 on: May 12, 2009, 10:46:35 PM »
Surprisingly, Spyware Terminator/ClamAV alerted regarding the toolbar, autodialer and one other piece of malware. SuperAntiSpyware subsequently found 22 issues and Malwarebytes found 6 registry entries related to the attempted install.

If you still have the files in Quarantine, can you send a copy to AWLIL?
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Possible Conflict with Spyware Terminator Update?
« Reply #7 on: May 13, 2009, 12:08:54 AM »
Thanks Kyuzo for your experience. Not a software is perfect, of course avast is not an exception. Glad ST was useful for you.
The best things in life are free.

Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #8 on: May 13, 2009, 04:03:07 AM »
Thank you for your posts. Unfortunately I did not quarantine but rather deleted the files. There were around 30 or so total and I quite frankly did not want them on my machine, especially the autodialer.  Also, to be quite honest, it never occurred to me that Avast would want them, although in hindsight it would have made Avast stronger having their definitions. I will try to be more vigilant next time (though I hope there will be no next time! ;D) I've warned my niece not to simply click on a pretty bauble dangled before her, but she's 11 and still impressionable.

As I said I still highly value Avast! and that's why I was concerned when it began flagging this script in Spyware Terminator's ClamAV update.

Regards, Kyuzo.


Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #9 on: May 13, 2009, 04:34:46 PM »
This morning (5/13/09) my Avast! once again showed a warning concerning a trojan horse and flagged the same script "JS:ScriptSH-inf[trj]". I checked the false positive option on the warning pop-up and sent the notice to Avast!. Hopefully this may help.

Kyuzo.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Possible Conflict with Spyware Terminator Update?
« Reply #10 on: May 13, 2009, 05:12:10 PM »
Seems you're running ClamWin (as a part of SpywareTerminator) side-by-side as avast.
http://forum.avast.com/index.php?topic=45231
The best things in life are free.

Kyuzo

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #11 on: May 13, 2009, 05:59:38 PM »
Yes. Spyware Terminator offers the option of integrating ClamAV's signatures into the Spyware Terminator's Real-Time Shield signatures. According to what one of the Spyware Terminator techs told me a while ago, integrating ClamAV's signatures with Spyware Terminator's increases the effectiveness of the program's Real-Time Shield. In fact, during the fore-mentioned episode with MySpace, it was the Clam element of ST which caught the malware.  I realize the potential for conflicts between two antivirus programs, but my Avast and my Spyware Terminator have existed peacefully for quite a while with not one problem.

I am by no means a software expert, but I intimate from two other posts currently on this forum that the Avast! program seems to be detecting the antivirus signature "JS:ScriptSH-inf[trj]" in other programs, Spybot and ClamWin (I believe ClamWin and ClamAV are different programs, but am not quite sure). This is the first signature that my Avast! has ever detected inside another program, and over the years I've used it with Avorax, Threatfire, Windows Defender, Spyware Terminator, SuperAntiSpyware, Spybot, Malwarebytes,  AdAware, among others. I have had more luck (and fewer conflicts) with Avast! than with any other antivirus program I've ever used and it is my favorite AV software. That's why I was hoping that perhaps the people at Avast! might be able to rectify the conflict.

Actually, if not, it's a relatively minor niggle, and a simple matter of checking "No Action" on the warning box.
« Last Edit: May 13, 2009, 06:04:42 PM by Kyuzo »

WakRather

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #12 on: May 27, 2009, 09:42:19 PM »
JS:ScriptSH-inf[trj]

This is a NEW finding that avast keeps noticing upon updating of the clamwin database.

Clamwin is superior to any other anti-virus program possble.  It has no active scanning abilities though, so it is useless for more users.  However, it has found a trojan that avast did not find.  (you probably are infected with it).  Avast has a very good web scanner though and has caught a lot real crap from even Opera browser.

Clamwin should be used daily as a scanner in the early morning/sleeping hours on all windows machines no matter what the virus program is.  Clamwin has been and still is routinely sued by antivirus companies as it is a superior scanner and takes away business.  None of the lawsuits stick of course.  the latest was by trendmicro.

Anyways, this is a very disconcerting find "JS:ScriptSH-inf[trj]"

Has someone hacked clamwin?  I think it would be rather something attacking clamwin that is never cleaned out, if it is actually a virus (trojan, whatever)

Any reply from Avast?  I am going to email clamwin as well. 

spg SCOTT

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #13 on: May 27, 2009, 09:49:20 PM »
Hi WakRather,

Please search the forum first, before posting and then if nothing is found create a new topic.
For now though see:

http://forum.avast.com/index.php?topic=45231.0

This has been discussed extensively, and is a result of Clamwin not encrypting their virus signatures

Thanks,

-Scott-

chefjohn

  • Guest
Re: Possible Conflict with Spyware Terminator Update?
« Reply #14 on: April 03, 2012, 07:21:46 AM »
Just wanted to give a heads-up on having a back up or redundant malware byte-type  defense.

noticed my computer had a virus by the slow-down,etc...I downloaded Spyware terminator because it has ALWAYS seem to catch any virus that all the "best" such as Avast, AVG, etc miss.
It actually found 4 middle of the road threats, a bout 7 tracking  cookie-low threats and one TROJAN...marked as critical

Dont know how avast let them by, but "Iobit has a great free malware scan out there....I use all 3