Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Culpeper on January 14, 2004, 02:52:34 AM

Title: Script blocking question
Post by: Culpeper on January 14, 2004, 02:52:34 AM
Does the script blocking function of Avast Pro block such things as these classloader trojans I keep getting on my system for some reason or another?
Title: Re:Script blocking question
Post by: Lisandro on January 15, 2004, 01:23:17 AM
Does the script blocking function of Avast Pro block such things as these classloader trojans I keep getting on my system for some reason or another?

Bad company you have...  ;D
Title: Re:Script blocking question
Post by: Culpeper on January 15, 2004, 05:02:17 PM
I don't know but I have had three alerts on these trojans in the Windows directory lately.  I don't know how they got there but I have had a bad problem with a lot of advertising spam with one of my ISP email accounts, which I'm dealing with.  I've installed Script Sentry as added protection.  I would go with the Avast Pro but their price lists shows an amount for 1 year.  Does this mean that it costs $40 per year for Avast Pro?  Anyway, I use W98 so the boot scan function for Avast Pro won't work so I use F-prot for DOS for that.
Title: Re:Script blocking question
Post by: techie101 on January 15, 2004, 06:44:56 PM
Culpeper,

Classloader trojans represent only the class of trojans not any specific kind.
Avast Script Blocker in the pro version should do a good job of protecting your system.

Users of Avast Home should install a blocker such as Script Sentry or Script Defender. Both are equally effective.

As for the $40 fee for Pro.  This is a program "upgrade" fee for 1 year for 1 license.  Yes, I know that sounds funny since the Home version has free upgrades, but because the Pro is directed towards commercial users, and is "feature" rich, the fee is appropriate.

Hope this answers your questions

techie
Title: Re:Script blocking question
Post by: Culpeper on January 15, 2004, 08:48:17 PM
Thanks techie101

I found the following just in the last week on my machine:

JS:Classloader-4
Win32: Clspring pkg
Win32: Clspring upx
JS:ByteVerify


I've since installed Script Sentry.
Title: Re:Script blocking question
Post by: techie101 on January 15, 2004, 09:23:25 PM
[quote I found the following just in the last week on my machine:
Quote

JS:Classloader-4
This is included in 0312-6 update

Win32: Clspring pkg
Win32: Clspring upx
JS:ByteVerify
These have been included in the database for awhile now.

Did you have Avast turned off at any time?
What is your current database version?

Even Avast Home should have alerted you to these infections since they are listed in my HOME version database.


techie

Title: Re:Script blocking question
Post by: Vlk on January 15, 2004, 09:49:11 PM
Quote
I found the following just in the last week on my machine:

In which files? Do you still have'em? Can you send them to my email?

Thanks
Vlk
Title: Re:Script blocking question
Post by: Culpeper on January 15, 2004, 10:50:09 PM
No, Avast has not been turned off.  I probably did a full thorough scan about one month ago before running scans the last week or so and finding the above files by Avast scanner.  I don't think they were false positives.  Unfortunately, I didn't save these files.  I will in the future though and send them.  Should I send them to the virus chest and email the file from the virus chest?

My database is current.

I'm assuming that these scripts can get stored on the HD without Avast resident shield intervention?  It's only when these scripts are actually run that Avast would give an alert?

I don't use MS VM so I don't think the above viruses would have done anything to the machine.
Title: Re:Script blocking question
Post by: Lisandro on January 15, 2004, 10:59:30 PM
No, Avast has not been turned off.  I probably did a full thorough scan about one month ago before running scans the last week or so and finding the above files by Avast scanner.  I don't think they were false positives.  Unfortunately, I didn't save these files.  I will in the future though and send them.  Should I send them to the virus chest and email the file from the virus chest?

My database is current.

I'm assuming that these scripts can get stored on the HD without Avast resident shield intervention?  It's only when these scripts are actually run that Avast would give an alert?

I don't use MS VM so I don't think the above viruses would have done anything to the machine.

Hey, Cul...
You can 'zip' the file(s) with a password and send them too (telling the password in the email) or, better, you can disable the scanning of the outbound mail and send them too.

Anyway, the best way is send the file by the Chest (but I thought this was a Pro version feature...). Take care, set the correct 'maximum size' for the sent files to Alwil.  ;)
Title: Re:Script blocking question
Post by: Culpeper on January 15, 2004, 11:09:19 PM
Technical

Okay, I'll do that.  Yeah, I have a virus chest with my Home Version of Avast :).

Could the bad files get on my HD because I have my standard shield set to normal or does that make any difference?

Title: Re:Script blocking question
Post by: Lisandro on January 16, 2004, 03:19:22 AM
Okay, I'll do that.  Yeah, I have a virus chest with my Home Version of Avast :).

I was not talking about the 'Chest' itself but the 'posibility' to send an infected file to Alwil and get help/support... I'm not sure as I have the Pro version. Just this.

Could the bad files get on my HD because I have my standard shield set to normal or does that make any difference?

Of course, I suggest you the 'Custom' level: you can set the options that will give you the best balance with protection and performance  ;D
Title: Re:Script blocking question
Post by: Culpeper on January 16, 2004, 04:45:45 AM
Oh, I see now.  The pro version has an option send the file to Alwil.

Update:  I checked the virus box Home Edition does have the ability to send email files to Alwil.

Well if I had been "paying attention", like my little saying below, I would have known that all along.

I'll start saving them and send them to Alwil from now on.
Title: Re:Script blocking question
Post by: Lisandro on January 16, 2004, 12:22:56 PM
Thanks Cul for your correction about my wrong information about Pro and Home version.  ;)
Title: Re:Script blocking question
Post by: Culpeper on January 16, 2004, 03:18:44 PM
Ah, you weren't wrong :)  You just don't have the latest home version to look at.
Title: Re:Script blocking question
Post by: Lisandro on January 17, 2004, 03:12:10 AM
Ah, you weren't wrong :)  You just don't have the latest home version to look at.

Hey!! I have both the Pro and Home last versions (4.1.319), maybe I don't have just the information: Home version allows the user to send a file to Alwil  ;D