Hello

I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
scan engine 4.3.20

Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
can be other files too (in temporary intenet files) for the
Exploit-URLSpoof.gen which is deleted.

Getting a virus warning EVERY time I open software is not exactly
reassuring - any ideas how i can find the root cause & get rid of the
software that is causing this?

Thank you
Callum

"ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> Hello
>
> I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> scan engine 4.3.20
>
> Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> can be other files too (in temporary intenet files) for the
> Exploit-URLSpoof.gen which is deleted.
>
> Getting a virus warning EVERY time I open software is not exactly
> reassuring - any ideas how i can find the root cause & get rid of the
> software that is causing this?
>
> Thank you
> Callum

This has to be a McAfee issue. I'm seeing the same message on
wsasc.xml but a scan shows nothing and I can never find this file.

I'm getting this everytime I open IE on 2 different machines and 2
different OSes using the 4376 update (dated 7/14/200).

Scott

Same thing here, just started yesterday. Over and over, when I try to
actually find the file it refers to it isn't there, I've cleared the
cache, nuked the temp folder (for the most part), updated virus defs
(mine is actually the "home" version of the Enterprise edition, and
when I do google searches on the name of the .xml file this is all I
find.

"ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> Hello
>
> I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> scan engine 4.3.20
>
> Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> can be other files too (in temporary intenet files) for the
> Exploit-URLSpoof.gen which is deleted.
>
> Getting a virus warning EVERY time I open software is not exactly
> reassuring - any ideas how i can find the root cause & get rid of the
> software that is causing this?
>
> Thank you
> Callum

Are you running Ebay Toolbar by any chance, I was fine until I installed
that.

Uninstalled it and it's stopped doing it
Steve


"turls" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Same thing here, just started yesterday. Over and over, when I try to
> actually find the file it refers to it isn't there, I've cleared the
> cache, nuked the temp folder (for the most part), updated virus defs
> (mine is actually the "home" version of the Enterprise edition, and
> when I do google searches on the name of the .xml file this is all I
> find.
>
> "ice" <(E-Mail Removed)> wrote in message
news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> > Hello
> >
> > I am running the mcafee virus scan enterprise 7.0, virus definitions
4376,
> > scan engine 4.3.20
> >
> > Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp
sp
> > 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but
it
> > can be other files too (in temporary intenet files) for the
> > Exploit-URLSpoof.gen which is deleted.
> >
> > Getting a virus warning EVERY time I open software is not exactly
> > reassuring - any ideas how i can find the root cause & get rid of the
> > software that is causing this?
> >
> > Thank you
> > Callum

I use Virus Scan Asap 2.7.2.199, virus definitions 4.0.4377 created
on 15.7.04 and scan engine 4.3.20 and noticed the same problem (i.e.
Exploit-urlspoof.gen being detected on opening IE 6.0.2800.xpsp2) on
two separate computers ever since the update after the 15th July. One
of the computers btw had been running for a couple of days and did not
display this problem until it was rebooted this morning and the virus
definition files were updated. This is looking more and more like a
McAfee update related issue. Might be worth asking McAfee for some
steer on this.
WL


"ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> Hello
>
> I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> scan engine 4.3.20
>
> Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> can be other files too (in temporary intenet files) for the
> Exploit-URLSpoof.gen which is deleted.
>
> Getting a virus warning EVERY time I open software is not exactly
> reassuring - any ideas how i can find the root cause & get rid of the
> software that is causing this?
>
> Thank you
> Callum

I?m getting the same thing. A search for wsasc.xml on my drives turned
up nothing. This is the only reference I can find anywhere online.
I?ve noticed IE being really flakey as well (more then usual) It seems
to hang when I click on certain links and I cant get to
windowsupdate.microsoft.com.

Luckily I got opera and firefox installed, but id like to get this
fixed..

Miguel



(E-Mail Removed) (turls) wrote in message news:<(E-Mail Removed)>...
> Same thing here, just started yesterday. Over and over, when I try to
> actually find the file it refers to it isn't there, I've cleared the
> cache, nuked the temp folder (for the most part), updated virus defs
> (mine is actually the "home" version of the Enterprise edition, and
> when I do google searches on the name of the .xml file this is all I
> find.
>
> "ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> > Hello
> >
> > I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> > scan engine 4.3.20
> >
> > Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> > 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> > can be other files too (in temporary intenet files) for the
> > Exploit-URLSpoof.gen which is deleted.
> >
> > Getting a virus warning EVERY time I open software is not exactly
> > reassuring - any ideas how i can find the root cause & get rid of the
> > software that is causing this?
> >
> > Thank you
> > Callum

I was able to finally get to http://v4.windowsupdate.microsoft.com and
updated everything. I'm going to reboot and see if it fixes the
problem. I found 2 references to Exploit-URLSpoof.Gen on Mcafee's
site:

http://vil.nai.com/vil/content/v_103166.htm
http://vil.nai.com/vil/content/v_100927.htm

I see no mention of the Wsasc.xml file though.

Miguel

(E-Mail Removed) (turls) wrote in message news:<(E-Mail Removed)>...
> Same thing here, just started yesterday. Over and over, when I try to
> actually find the file it refers to it isn't there, I've cleared the
> cache, nuked the temp folder (for the most part), updated virus defs
> (mine is actually the "home" version of the Enterprise edition, and
> when I do google searches on the name of the .xml file this is all I
> find.
>
> "ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> > Hello
> >
> > I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> > scan engine 4.3.20
> >
> > Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> > 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> > can be other files too (in temporary intenet files) for the
> > Exploit-URLSpoof.gen which is deleted.
> >
> > Getting a virus warning EVERY time I open software is not exactly
> > reassuring - any ideas how i can find the root cause & get rid of the
> > software that is causing this?
> >
> > Thank you
> > Callum

(E-Mail Removed) (turls) wrote in message news:<(E-Mail Removed)>...
> Same thing here, just started yesterday. Over and over, when I try to
> actually find the file it refers to it isn't there, I've cleared the
> cache, nuked the temp folder (for the most part), updated virus defs
> (mine is actually the "home" version of the Enterprise edition, and
> when I do google searches on the name of the .xml file this is all I
> find.
>
I'm running the Home version as well under Windows XP.

(E-Mail Removed) (turls) wrote in message news:<(E-Mail Removed)>...
> Same thing here, just started yesterday. Over and over, when I try to
> actually find the file it refers to it isn't there, I've cleared the
> cache, nuked the temp folder (for the most part), updated virus defs
> (mine is actually the "home" version of the Enterprise edition, and
> when I do google searches on the name of the .xml file this is all I
> find.
>
> "ice" <(E-Mail Removed)> wrote in message news:<40f6ae5f$0$39756$(E-Mail Removed)>...
> > Hello
> >
> > I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
> > scan engine 4.3.20
> >
> > Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
> > 1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
> > can be other files too (in temporary intenet files) for the
> > Exploit-URLSpoof.gen which is deleted.
> >
> > Getting a virus warning EVERY time I open software is not exactly
> > reassuring - any ideas how i can find the root cause & get rid of the
> > software that is causing this?
> >
> > Thank you
> > Callum

I had this issue with one of my end users this morning. I searched
the registry for this file, did a full system scan with recently
updated McAfee, Spybot s&d, and ad-aware. Found nothing.

In my particular case, the user had the eBay toolbar installed. When
I was playing around I disabled the toolbar, and this warning stopped
popping up. After verifying that this was infact the source of the
problem I uninstalled the eBay toolbar. The funny thing is that this
user has had that toolbar installed for weeks. Why would it start
causing trouble now? Did the toolbar somehow become infected, or did
the updated DATs from McAfee (incorrectly?) tag this .xml file as an
Exploit?

I just updated to the new 4377 DAT file and the issue is still happening.