Author Topic: JS/Noclose.gen trojan  (Read 3806 times)

0 Members and 1 Guest are viewing this topic.

noddy

  • Guest
JS/Noclose.gen trojan
« on: May 06, 2004, 10:36:20 PM »
WinXP HE with Service Pack 1 notebook PC started freezing IExplorer 6.0.2800 screens, mouse locked, system disk spinning endlessly, locked out.

Instinct said something had gotten past ZoneAlarm 4.5.594.000 firewall and avast! Home Edition 4.1  Re-booted only to discover 30GB C: system root drive was eating up gigs by the minute so pulled wall plug. Re-booted and went to McAfee Free Scan online (http://us.mcafee.com) to scan all 110000 files on C: McAfee found ONE infected virus file... JS/NoClose.gen

McAfee virus library reveals this trojan known for years, added to their DAT 4173 12/6/2001, so I'm puzzled how avast! missed it.

I deleted the culprit file mc-dubs3[1].htm which was in the C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files, put there by spam porn mail without any attachment. I hadn't opened the e-mail in Microsoft Office Pro 2003 Outlook preview pane prior to deleting it. After deleting trojan file I ran a full system scan and found nothing more amiss except 2 gigs of space on the C: drive have "disappeared" mysteriously (unable to explain why) as a result of this temporary invasion.

Does anybody have any similar experience as I'd felt very secure with avast! HE 4.1 up until now, especially as avast! frequently runs automatic multi-updates in a single day to my always-on broadband connection?

The Hurricane

  • Guest
Re:JS/Noclose.gen trojan
« Reply #1 on: May 07, 2004, 12:16:58 AM »
Quote
Does anybody have any similar experience as I'd felt very secure with avast! HE 4.1 up until now, especially as avast! frequently runs automatic multi-updates in a single day to my always-on broadband connection?

Its a known fact Avast is not the best at detecting trojans. But with every update it gets better at it. If you wouls like this trojan added to the database send it in to them virus@avast.com
« Last Edit: May 07, 2004, 12:19:23 AM by The Hurricane »