Help Class-Loader-7

[VAME8873]

Anyone know how to remove JS:ClassLoader-7



Sys info:
win2000
Version: 5.0.2195 Service Pack 4 Build 2195

IE: 6.0.2800.1106, SP1

Java Run Times:
Version 1.5.0 (build 1.5.0_04-b05)

Cache IE& Java clean.

standard shield - Avast set to high with scan all created/modified files.


Avast detected the following virus (Malware):

JS:ClassLoader-7


Log file:
21.8.2005 11:29:59   SYSTEM   584   Sign of "JS:ClassLoader-7" has been found in "http://195.95.218.83/users/sex/web/classload.jar\GetAccess.class" file. 
21.8.2005 11:30:15   SYSTEM   584   Sign of "JS:ClassLoader-7" has been found in "http://195.95.218.83/users/sex/web/GetAccess.class" file. 


I have
HijackThis log & Adaware log:



Adaware log (part of them)


Ad-Aware SE Build 1.05
Logfile Created on:21. avgust 2005 13:44:46
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R62 17.08.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
CoolWebSearch(TAC index:10):2 total references
MRU List(TAC index:0):34 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»




Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

 CoolWebSearch Object Recognized!
    Type               : RegValue
    Data               :
    Category           : Malware
    Comment            : "{06ABAA2D-34AB-4902-A326-409BD9B9A7A5}"
    Rootkey            : HKEY_LOCAL_MACHINE
    Object             : software\microsoft\internet explorer\toolbar
    Value              : {06ABAA2D-34AB-4902-A326-409BD9B9A7A5}


Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

 CoolWebSearch Object Recognized!
    Type               : RegValue
    Data               :
    Category           : Malware
    Comment            :
    Rootkey            : HKEY_CURRENT_USER
    Object             : software\microsoft\internet explorer\main
    Value              : Search Page

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 36

13:45:31 Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:00:44.985
Objects scanned:41980
Objects identified:2
Objects ignored:0
New critical objects:2

[Eddy]

Just stop visiting those malicious websites.

[VAME8873]

The problem is that i'am visiting normal pages and then redirecting...

[Lisandro]

The problem is that i'am visiting normal pages and then redirecting...

Are you infected right now or clean?
The redirection is what you get at sex sites, it's the way they work... 
You're looking for fun but you'll find virus troubles 

[VAME8873]

From 10.7.2005.
After cleaning with Adaware, Syw C&D, Avast..

[Eddy]

If you get redirected:

1) your system is infected
or
2) you are not visiting normal pages

Make sure your system is clean.
Follow ALL instructions on THIS PAGE

[VAME8873]

Disable system restore  windows2k?
How?

[Eddy]

2k doesn't have system restore.

[Lisandro]

Disable system restore  windows2k? How?

You can't... this feature is only on XP and Me systems.   :'(

[VAME8873]

Scan the system with a online scanner?
How?

[DavidR]

Visit one of the on-line scanner and initiate a scan, you may have to pause Standard Shield so the two scanners don't conflict.

RejZoR's Website - Security Ops
On-line Virus Scanners and other useful Links Security-Ops.eu.tt