Author Topic: Script blocking question  (Read 8880 times)

0 Members and 1 Guest are viewing this topic.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Script blocking question
« on: January 14, 2004, 02:52:34 AM »
Does the script blocking function of Avast Pro block such things as these classloader trojans I keep getting on my system for some reason or another?
« Last Edit: January 14, 2004, 02:52:57 AM by Culpeper »
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Script blocking question
« Reply #1 on: January 15, 2004, 01:23:17 AM »
Does the script blocking function of Avast Pro block such things as these classloader trojans I keep getting on my system for some reason or another?

Bad company you have...  ;D
The best things in life are free.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #2 on: January 15, 2004, 05:02:17 PM »
I don't know but I have had three alerts on these trojans in the Windows directory lately.  I don't know how they got there but I have had a bad problem with a lot of advertising spam with one of my ISP email accounts, which I'm dealing with.  I've installed Script Sentry as added protection.  I would go with the Avast Pro but their price lists shows an amount for 1 year.  Does this mean that it costs $40 per year for Avast Pro?  Anyway, I use W98 so the boot scan function for Avast Pro won't work so I use F-prot for DOS for that.
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline techie101returns

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1900
Re:Script blocking question
« Reply #3 on: January 15, 2004, 06:44:56 PM »
Culpeper,

Classloader trojans represent only the class of trojans not any specific kind.
Avast Script Blocker in the pro version should do a good job of protecting your system.

Users of Avast Home should install a blocker such as Script Sentry or Script Defender. Both are equally effective.

As for the $40 fee for Pro.  This is a program "upgrade" fee for 1 year for 1 license.  Yes, I know that sounds funny since the Home version has free upgrades, but because the Pro is directed towards commercial users, and is "feature" rich, the fee is appropriate.

Hope this answers your questions

techie

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #4 on: January 15, 2004, 08:48:17 PM »
Thanks techie101

I found the following just in the last week on my machine:

JS:Classloader-4
Win32: Clspring pkg
Win32: Clspring upx
JS:ByteVerify


I've since installed Script Sentry.
« Last Edit: January 15, 2004, 08:55:44 PM by Culpeper »
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline techie101returns

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1900
Re:Script blocking question
« Reply #5 on: January 15, 2004, 09:23:25 PM »
[quote I found the following just in the last week on my machine:
Quote

JS:Classloader-4
This is included in 0312-6 update

Win32: Clspring pkg
Win32: Clspring upx
JS:ByteVerify
These have been included in the database for awhile now.

Did you have Avast turned off at any time?
What is your current database version?

Even Avast Home should have alerted you to these infections since they are listed in my HOME version database.


techie


Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Script blocking question
« Reply #6 on: January 15, 2004, 09:49:11 PM »
Quote
I found the following just in the last week on my machine:

In which files? Do you still have'em? Can you send them to my email?

Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #7 on: January 15, 2004, 10:50:09 PM »
No, Avast has not been turned off.  I probably did a full thorough scan about one month ago before running scans the last week or so and finding the above files by Avast scanner.  I don't think they were false positives.  Unfortunately, I didn't save these files.  I will in the future though and send them.  Should I send them to the virus chest and email the file from the virus chest?

My database is current.

I'm assuming that these scripts can get stored on the HD without Avast resident shield intervention?  It's only when these scripts are actually run that Avast would give an alert?

I don't use MS VM so I don't think the above viruses would have done anything to the machine.
« Last Edit: January 15, 2004, 10:54:56 PM by Culpeper »
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Script blocking question
« Reply #8 on: January 15, 2004, 10:59:30 PM »
No, Avast has not been turned off.  I probably did a full thorough scan about one month ago before running scans the last week or so and finding the above files by Avast scanner.  I don't think they were false positives.  Unfortunately, I didn't save these files.  I will in the future though and send them.  Should I send them to the virus chest and email the file from the virus chest?

My database is current.

I'm assuming that these scripts can get stored on the HD without Avast resident shield intervention?  It's only when these scripts are actually run that Avast would give an alert?

I don't use MS VM so I don't think the above viruses would have done anything to the machine.

Hey, Cul...
You can 'zip' the file(s) with a password and send them too (telling the password in the email) or, better, you can disable the scanning of the outbound mail and send them too.

Anyway, the best way is send the file by the Chest (but I thought this was a Pro version feature...). Take care, set the correct 'maximum size' for the sent files to Alwil.  ;)
The best things in life are free.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #9 on: January 15, 2004, 11:09:19 PM »
Technical

Okay, I'll do that.  Yeah, I have a virus chest with my Home Version of Avast :).

Could the bad files get on my HD because I have my standard shield set to normal or does that make any difference?

« Last Edit: January 16, 2004, 02:47:36 AM by Culpeper »
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Script blocking question
« Reply #10 on: January 16, 2004, 03:19:22 AM »
Okay, I'll do that.  Yeah, I have a virus chest with my Home Version of Avast :).

I was not talking about the 'Chest' itself but the 'posibility' to send an infected file to Alwil and get help/support... I'm not sure as I have the Pro version. Just this.

Could the bad files get on my HD because I have my standard shield set to normal or does that make any difference?

Of course, I suggest you the 'Custom' level: you can set the options that will give you the best balance with protection and performance  ;D
The best things in life are free.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #11 on: January 16, 2004, 04:45:45 AM »
Oh, I see now.  The pro version has an option send the file to Alwil.

Update:  I checked the virus box Home Edition does have the ability to send email files to Alwil.

Well if I had been "paying attention", like my little saying below, I would have known that all along.

I'll start saving them and send them to Alwil from now on.
« Last Edit: January 16, 2004, 05:12:04 AM by Culpeper »
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Script blocking question
« Reply #12 on: January 16, 2004, 12:22:56 PM »
Thanks Cul for your correction about my wrong information about Pro and Home version.  ;)
The best things in life are free.

Offline Culpeper

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1187
Re:Script blocking question
« Reply #13 on: January 16, 2004, 03:18:44 PM »
Ah, you weren't wrong :)  You just don't have the latest home version to look at.
The wind in the wires made a tattletale sound
And a wave broke over the railing
And every man knew, as the Captain did, too,
T'was the witch of November come stealing.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re:Script blocking question
« Reply #14 on: January 17, 2004, 03:12:10 AM »
Ah, you weren't wrong :)  You just don't have the latest home version to look at.

Hey!! I have both the Pro and Home last versions (4.1.319), maybe I don't have just the information: Home version allows the user to send a file to Alwil  ;D
The best things in life are free.