Infected, but not notified

[dacovale]

As the title says, I was infected by a virus called JS:Classloader -4 (+ another one, that I can't find the name of right now)
Now, The only reason I got to know this, was because I walked by the computer while the screensaver whas on, and I saw that the scanner-box was red instead of blue.
Sat there, looking at the screen for a few minutes, wondering what to do, and finally moved the mouse, and started a thorough, complete scan with avast.
Now, in this scan avast yelled at me a couple of times, telling me I was infected. Gee..... didn't know that....

Why, oh why didn't avast notify me when it found the virus during screen-saver scan?
I thought the purpose of that scan was to keep me safe.

EDIT: forgot to mention, might be important...
I'm using the home edition (fully patched)

[Lisandro]

I walked by the computer while the screensaver whas on, and I saw that the scanner-box was red instead of blue.

What do you mean with 'scanner-box' red?
Is it the icon on the system tray? Maybe this virus disable avast!  :'(

[dacovale]

No, with the red box, I mean the (normally blue) box that you should see if you use the avast screen-saver.
The two viruses were both found in Suns java-engine (or atleast in that folder) kind of like if I had caught them while viewing a Java-applet. No virus-files were found even close to the avast-folder.

What I'm wondering, is why Avast didn't holler at me, even though the viruses clearly were in the virus database.

btw, the name of the other virus was JS:ByteVerify-Dummy [trj]
I moved the all in all 6 files to the chest, since I knew I wanted an explanation before I removed them completely.
I also have a .xml log from the scan.

[Lisandro]

No, with the red box, I mean the (normally blue) box that you should see if you use the avast screen-saver.
The two viruses were both found in Suns java-engine (or atleast in that folder) kind of like if I had caught them while viewing a Java-applet. No virus-files were found even close to the avast-folder.

What I'm wondering, is why Avast didn't holler at me, even though the viruses clearly were in the virus database.

btw, the name of the other virus was JS:ByteVerify-Dummy [trj]
I moved the all in all 6 files to the chest, since I knew I wanted an explanation before I removed them completely.
I also have a .xml log from the scan.

I see... I have never caught a virus by the screen saver module. I cannot imagine its behavior unless you are using the Pro version. In the settings of the task you will see the options of handling it (page 'Virus').

But now, are you infected or not? Did you run a scanning?  

[dacovale]

I had 6 infected files on my PC (did a full thorough search, including archives).
Now, they are in the chest, until I have sorted out why I wasn't warned about them. None of the files were important. At most, I'll have to re-install Java.
I usually leave my computer on for day, and that means many hours with the screensaver.
If I hadn't seen the screensaver, I wouldn't have known I was infected.
That troubles me. A lot.

[Lisandro]

I had 6 infected files on my PC (did a full thorough search, including archives).
Now, they are in the chest, until I have sorted out why I wasn't warned about them. None of the files were important. At most, I'll have to re-install Java.
I usually leave my computer on for day, and that means many hours with the screensaver.
If I hadn't seen the screensaver, I wouldn't have known I was infected.
That troubles me. A lot.

Dacovale, the resident providers should do their work... you do not need the screen saver module like it was the only solution. You said that the files are 'now' in Chest, but who did put them there?, the Screen Saver module or you with the full thorough search?  

[dacovale]

I did.
And I know about the resident providers. but, apparently those providers did no good either, this time.
The screen-saver... well, any extra protection is good protection.

(now I'm going to bed. It's 4:20 AM here, and I'm constantly dozing off, instead of doing what I ought to do, which is to work).
I'll be back in say eight hours to check if any one has a clue.
I'd really appreciate any help in finding out why I wasn't warned in any proper way.

[Vlk]

JS.Classloader is not really a 'virus' so you don't have to worry... But, I'd like to know the names of files that were reported as infected?

Also, please keep in mind that the ScreenSaver STOPS after it finds first virus. That is, after ScreenSaver finds a virus, it is recommended to start avast and do a full scan.

Vlk

[dacovale]

I'll attach the logfile.
I've renamed the file so that your fourm accepts it.

Where can I find info about these viruses?
I couldn't possibly know that these viruses weren't harmful.

and still ,why didn't avast announce that it had found the viruses?
(I don't think of a red box on a screen-saver as announcing the precence of a virus)

[Vlk]

The log file is incomplete. XML reports are broken into sevetal parts. I need the file called "Simple user interface_20040222_1930_main.xml"

Thanks
Vlk

[dacovale]

sorry...
here's the right file

[Vlk]

First, it's inside ZIP archives. That's why it wasn't reported by the Standard Shield (which does not unpack ZIPs by default).

Second, it's in the Java packages. ClassLoader means it's a (possibly malicious) code that's trying to do some stuff with Java classes - and these probably contain such code.


In other words - Much Ado About Nothing, as Shakespeare would've said.

Vlk

[dacovale]

ok. Thanks.