JS downloader

[silentrunner]

On my brother's computer he kept getting a message from his anti-virus software about something called JS downloader agent. He kept moving it to his virus vault but never did anything about it 'slughead'. He eventually asked me about it. I had never seen it before so I looked it up on a virus encyclopedia. It showed that it was a trojan. So I deleated it. He has not seen it again. I still do not know just what it was. Was this a trojan that could actually do harm to his computer, or was it nothing?

[Blacklight]

I've had a couple encounters with this trojan.
What it does is when you boot the computer or start your internet browser, it tries to connect to a site and download a virus or some other kind of malware into your system and then it activates it. There are a LOT of different versions of it out there.
A good updated virus scanner with a firewall should prevent it from working.
Just to be on the safe side, boot the computer into safe mode and then do a FULL scan of ALL FILES including archive files just to make sure you killed it.
Also, Keeping your windows updated is a good way to prevent some versions of this program from working as well.

http://vil.nai.com/vil/content/v_139961.htm

http://vil.nai.com/vil/content/v_142604.htm

http://vil.nai.com/vil/content/v_143623.htm

These are just some of the versions. It depends on what version he had in there.

[silentrunner]

Originally Posted by Blacklight

I've had a couple encounters with this trojan.
What it does is when you boot the computer or start your internet browser, it tries to connect to a site and download a virus or some other kind of malware into your system and then it activates it. There are a LOT of different versions of it out there.
A good updated virus scanner with a firewall should prevent it from working.
Just to be on the safe side, boot the computer into safe mode and then do a FULL scan of ALL FILES including archive files just to make sure you killed it.
Also, Keeping your windows updated is a good way to prevent some versions of this program from working as well.

http://vil.nai.com/vil/content/v_139961.htm

http://vil.nai.com/vil/content/v_142604.htm

http://vil.nai.com/vil/content/v_143623.htm

These are just some of the versions. It depends on what version he had in there.

Yeah I did a scan after I deleted it. If it comes back he can get rid of it himself. It wasn't even on my computer, and it was his fault for not worrying about viruses.

[Blacklight]

One time I got hit with it was when I was playing an Alternate Reality Game "You know those games that make it seem that you stumbled upon some real conspiracy and you get caught up in it, and you go to real fake websites, crack codes, solve mysteries, etc..", anyway, I got an instant message from someone who I thought was a character in the game (And he acted all cryptic like so it really felt like it was part of the game). If I hadn't been playing the game, I would have KNOWN it was a spammer, but his answers were JUST cryptic enough that I thought it was a game character and I clicked the link he sent me before he logged off... BIG mistake.

It went to a site that was some kind of hacked looking website (Which of course is common in Alternate Reality Games). Anyway, next thing I know, my firewall is going off that a program nammed JSDownloader something is trying to download files from some site. Even booted in safe mode with all processes turned off, it made no difference. The virus scanner would find the file, delete it, only to have it come right back when I rebooted. The firewall kept it from functioning though, so it sat there for quite a while, then, I updated my Windows XP to Service Pack 2. And no more JSDownloader. It must have overwritten it when it installed.

Another version I got of it and I don't know how I got it since I don't go to fishy or sketchy sites at all, was a little nastier. The firewall kept it from working and no virus scanner could get rid of it(And I tried SEVERAL). They kept seeing it and claiming they got rid of it, but I'd reboot and it would be right back.
What I had to do was physically go into the windows folder and delete some files there and then delete a whole bunch of registry entries to get rid of it.

Tell him to look up the version of it that he has online on the virus scanner website of whatever virus software you have. There should be instructions there to remove it manually if it keeps coming back on him like it did with me.