JS/Downloader Agent

spud17

Yesterday while Googling for info about a hard drive, I clicked a link and immediately AVG detected the above virus.

It was moved to the vault.

Currently PC is being scanned in safe mode, and the only thing detected is a change to C:\WINDOWS\system32\shell32.dll (is this linked to a memory upgrade a couple of days ago)

I've Googled the name and to my novice eye it seems to be linked to Java, in particular the cache.

Smitfraudfix and trendmicro-sysclean are mentioned as cures.

Is it really necessary to run these if the PC appears clean after scanning?

xJonny

It may be worth running anti-spyware programs such as Spybot, or AdAware.

http://www.safer-networking.org/
http://lavasoftusa.com/

AVG isn't as good as paid anti-virus software so it may not have picked up what it was but just a modification to that file. It could have been a false-positive, mind.

spud17

AVG isn't as good as paid anti-virus software

Not exactly true, especially if you read threads on this forum.

The AVG resident shield detected and isolated it the instant I clicked the link, it is now in the virus vault.

Although I am running my various spyware/malware programs as a precaution this a Virus, and AVG is showing my PC as clear.

Red_Rose_Exile

I would suggest that you run them in safe mode, thus eliminating any chance of not being able to remove any offending item

Personally, I would turn off system restore before doing any scan, thus removing the possibility of having had a nasty being backed up, and turning it back on once scans give you the all clear

spud17

Red Rose Exile

I would suggest that you run them in safe mode, thus eliminating any chance of not being able to remove any offending item

Are you referring to the smitfraudfix?

In safe mode have now run AVG, SuperAntiSpyware, Spyware Terminator, Spybot and Adaware. All with latest updates.

For some reason AVG Antispy is stalling.

All scans show nothing, not even a tracking cookie.

Browntoa

It's been quarantined and is not a problem now, hence the clean scans

Red_Rose_Exile

smitfraudfix should be run in safe mode anyway for best chance of success as should any virus removal tool

spud17

Browntoa and Red Rose Exile

Thanks for the replies, everything up and running again.

All seems OK and thanks for the reassurance.

Thanks also to AVG Free.