Windows Forum

Ask something
Discussion Locked

Virus Problem - JS.Exception.Exploit

0 helpful
12 replies

by xfloaterx

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Js.Exception.exploit virus plus W32.Myparty plus Backdoor.Myparty plus W32Nimda.enc viruses all detected on a new client's PC. Windows NT 4.0
I was able to remove all the viruses after installing NAV. Applied MS patches for JS.Exception.Exploit Applied Service Pack 2 for IE 5.5
Problem remaining is everytime the system is rebooted - the Home page is reset - and the C: Drive and the WinNT4 folder is shared for a remote admin. The "new" home page launches about 7-10 porn sites when IE is opened - the search feature in IE is affected by this. If you open search, all you get is links to these porn sites and then the other windows pop up.
I blocked those sites for now but I'm assuming the the JS.Exception.exploit ran a JavaScript that modified something......question is what??????? I can't find it. NAV now scans that the system is clean.

12 replies

by xfloaterx

Been there - done that. Removed the msstask.exe as per NAV - also found and removed two copies of Javascript files which apparently are created when the script runs. They both had differnet file names.

by bohicam1

It is in the master boot record. I am surprised you could install Norton after being infected as these newer viruses usually block you from installing any type of anti virus protection. This has come up here alot lately and a simple format will not do. You must wipe the drive clean with a low level formatting utility. I use clearhdd.exe which you can find on most hdd manufacturers sites if you do a search on the net. This will render a drive as clean as it was shipped.
Good luck!

Mike

by xfloaterx

This is the exact step I am hoping to avoid. Can the Master Boot Record be edited?? If so, how?

by xfloaterx

Thanks but if you re-read the question - I state that I HAVE applied the patches. Also the W32.Nimda had the .enc which means that only the virus header was attached to the e-mail recieved - the executable was not there. The problem here is that a Java Script has been run due to the JS.Exception.exploit
I have applied the patch to close up that hole - but the Java Script could have done almost anything - I am trying to avoid complete re-format of the drive.

by hazzard_005

If you made an ERU disk I beleive that you can replace or repair the master boot record of the Disk if that is where the problem lies. I'm sorry I can't be more help but I've never had to use my ERU disk. Hopefully someone else here will be able to pick this up where I left off.

Good Luck.

by xfloaterx

No Emergency Recover Disk was made prior to the virus. Un-fortuately this client had no Virus scanner, no backups, no recovery disks etc.

by g-spin

I don't know if this will help you very much, but it could be a problem in the registry. I came across that JS.Exception not too long ago and I got some full directions at housecall.antivrus.com and looked up the virus in their encyclopedia. It gives full instructions on what registry entries to change. Sorry I can't remember them off the top of my head, but it's been a few weeks. Give that a shot anyway, it might help you out. I hope.

This discussion is closed to new replies.