Hi all, Yesterday I got a popup window from Norton AV 2002 that said a file was infected with the Js.Trojan.WindowBomb virus and that access to the file was denied and it couldn't repair it. I got two of these pop up windows saying this. I ran a full system scan and Norton didn't find anything. Here's what the activity log says:
Date: 6/16/2003, Time: 13:15:22, server admin on SERVER
The file
C:\Program Files\Evrsoft\1st Page 2000\IScripts\Buttons\Six buttons from hell.izs
is infected with the Js.Trojan.WindowBomb virus.
Unable to repair this file.


Date: 6/16/2003, Time: 13:15:22, server admin on SERVER
The file
C:\Program Files\Evrsoft\1st Page 2000\IScripts\Buttons\Six buttons from hell.izs
is infected with the Js.Trojan.WindowBomb virus.
Access to the file was denied.

I just ran live update. OS is XP pro, also have Norton Personal Firewall. Is the virus still on my computer? Norton didn't say it deleted it.
Thanks,
Jim

I would say yes, being that Norton touched it. Try a freeware virus like F-Prot or a trojan cleaner.

I don't trust Norton any longer, freeware works as well and is free.

Under Construction

edited

Casca, you are entitled to your opinion, but you are very wrong. I hope some newbie visiting here is not misled. Not running full time protection, and relying on periodic scans is foolish and dangerous. By the time you learn you were infected it's too late. Full time protection like NAV autoprotect will stop an infection before it ever damages your data or hardware, or sends itself to your address book friends. All you have to do is keep your virus definitions up to date, which NAV can also do for you automatically.

Shelly

Have you checked your Quarentined items? Go to reports and look. If it is in there you can delete them or send a report to
symantec, whatever it wants. That is where all my stuff ends up.

First off run Spybot Search and Destroy and see what that does or tells you. About a month ago I had something similar. Tried different trojan softwares to no effect. Spybot detected it but could not remove it. My antivirus (QuickHeal) informed me on every boot of the trojans attempt to edit and write to the registry.
So upon narrowing down what changes the trojan was attempting- it was a dialer or keylog program- I killed it in running processes so that it could be deleted from the system 32 folder, Restored registry, but it still was not completely gone. After 3 days I wound up reformatting and restoring a backup. All in all a pretty nasty one.
Yours may not be as bad. Good luck.
Go over to www.broadbandreports.com in their security forum and ask around there. Some folks there are knowledgeable about such stuff.

Jim, see details, recommendations and removal instructions at Symantec's JS.Trojan.WindowBomb security reponse for that trojan. Most of it boils down to:
"1. Update the virus definitions. 2. Run a full system scan, and delete all files that are detected as Js.Trojan.WindowBomb."

There sure is a lot of viruses and other crap out there recently. Norton has stopped 4 viruses trying to get into my system in the last 9 days or so. The worst thing is the infected emails are coking from people I don't know. As long as norton recognizes them and I delete them I think I'm pretty much safe. Viruses are such an unneeded headache. It amazes me that there are pinheads out there with nothing better to do.

Thanks for all the help. I ran Spybot Search & Destroy as well as a Trojan remover and they didn't detect anything. There is no evidence in the activity log that Norton deleted this virus. It isn't in Quarantined items in Norton AV. Anything else to try?
Thanks,
Jim

Bring up windows task manager-ctrl,alt,delete- and under running processes try to determine if there is anything there that shouldn`t be. If you can temporarily disable the trojan from running there then you can likely delete that `six buttons from hell` file mentioned in your original post. I`m guessing that is some kind of add-on you downloaded for that software.

www.webattack.com/help/six_buttons_from_hell.html


Hope this helps. Doesn`t appear to be malicious.

Interesting link/webattack article,
Whenever I re-install this html editor, my Av program, pccillin, always finds a button js script it calls a virus. I always just deleted it, but always wondered how it got there. It had some other button name, but I can't remember exactly what.
That article explains it. Interesting.



My websites - www.blueroseweb.com
www.blueroseweb.com/~quiltingb

Everyone, thanks for your help. That link was very helpful, I have 1st Page 2000, according to the link that was an extra in 1st Page. So nothing to worry about.
Thanks,
Jim

It's about time everyone learned about how a virus program works. If Norton tells you that you received a virus, you are safe. the virus was blocked. Detected viruses fall into two categories, those that can be repaired and rendered safe, and those that can not be repaired. If Norton detects a repairable virus, that virus will be striped of its dangerous code and the file that ir infected will be returned to safe use. If the virus is not fixable, the viruses will be quarantined, and is then no longer a threat. If you go to the Quarantine folder you will find it under a coded non-executable name where it can be deleted. At no time in either case is your computer in any danger. The only virus, worm, or trojan you need to be concerned about are those that were not detected, in which case you would not have ever received a warning from Norton. I have used NAV since it first came on the market many years ago. I have been sent hundreds of viruses, not one has ever gotten past Norton and infected my computer.

Shelly

Thanks for that Shelly. I trust both my compass *and* my NAV.

Remember to breathe..