Help with Trojan Removal

[Hairy]

McAfee keeps finding and removing the js/noclose.gen trojan, but it still
comes back with nearly every page I open. I've run Adaware and Spybot
numerous times, even in safe mode, but still have the trojan. How can I get
rid of it?
Thanks, Dave

 

[David H. Lipman]

From: "Hairy" <[email protected]>

| McAfee keeps finding and removing the js/noclose.gen trojan, but it still
| comes back with nearly every page I open. I've run Adaware and Spybot
| numerous times, even in safe mode, but still have the trojan. How can I get
| rid of it?
| Thanks, Dave
|

1) Dump the contents of your IE cache -
Start --> settings --> control panel --> Internet options --> delete files

2) Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools --> Options --> Privacy --> Cache --> Clear

3) Dump the contents of your Sun Java cache -
Start --> settings --> control panel --> Java applet --> cache --> clear
or
Start --> settings --> control panel --> Java applet --> general --> settings -->
delete files

4) Rscan the system using McAfee

 

[Gabriele Neukam]

On that special day, Hairy, ([email protected]) said...

McAfee keeps finding and removing the js/noclose.gen trojan, but it still
comes back with nearly every page I open.

If it is inside the HTML code of "nearly every page you open", you
should consider visiting other sites. Removing is moot, as the code
will be downloaded again, with every refresh of that page, to displace
it in the browser. It is the browser which puts the content of sites
into the

Temporary Internet Folder, or short TIF

I suppose it is in there, where McAfee keeps finding the "Generic
JScript don't close my page" trojan. Did you already consider
deactivating JScript, at least when you are planning to visit such
sites?


Gabriele Neukam

(e-mail address removed)

 

[Hairy]

From: "Hairy" <[email protected]>

| McAfee keeps finding and removing the js/noclose.gen trojan, but it still
| comes back with nearly every page I open. I've run Adaware and Spybot
| numerous times, even in safe mode, but still have the trojan. How can I get
| rid of it?
| Thanks, Dave
|

1) Dump the contents of your IE cache -
Start --> settings --> control panel --> Internet options --> delete files

2) Dump the contents of the Mozilla FireFox Cache { if you use FireFox }
Tools --> Options --> Privacy --> Cache --> Clear

3) Dump the contents of your Sun Java cache -
Start --> settings --> control panel --> Java applet --> cache --> clear
or
Start --> settings --> control panel --> Java applet --> general --> settings -->
delete files

4) Rscan the system using McAfee

Thanks...
I followed your suggestions. Virusscan didn't find anything. It didn't find
anything on previous scans, either. I'm still getting the same pop-ups, but
McAfee is no longer warning about the trojan, so far. Any other suggestions?
H

 

[Hairy]

On that special day, Hairy, ([email protected]) said...


If it is inside the HTML code of "nearly every page you open", you
should consider visiting other sites. Removing is moot, as the code
will be downloaded again, with every refresh of that page, to displace
it in the browser. It is the browser which puts the content of sites
into the

Temporary Internet Folder, or short TIF

I suppose it is in there, where McAfee keeps finding the "Generic
JScript don't close my page" trojan. Did you already consider
deactivating JScript, at least when you are planning to visit such
sites?

I don't visit the "such sites" that you allude to. Unless you are referring
to QVC and Food Network and just about anything that comes up in a Google
search.
I don't know what JScript is. What would happen if I deactivated it,
permanently?
H

 

[David H. Lipman]

From: "Hairy" <[email protected]>


| Thanks...
| I followed your suggestions. Virusscan didn't find anything. It didn't find
| anything on previous scans, either. I'm still getting the same pop-ups, but
| McAfee is no longer warning about the trojan, so far. Any other suggestions?
| H
|

Well that helped you with a Java Script Trojan (JS/NoClose).

Now follow the directions on the below Claymania URL.