how do i get rid of exploit-urlspoof.gen?

[ice]

Hello

I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
scan engine 4.3.20

Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
can be other files too (in temporary intenet files) for the
Exploit-URLSpoof.gen which is deleted.

Getting a virus warning EVERY time I open software is not exactly
reassuring - any ideas how i can find the root cause & get rid of the
software that is causing this?

Thank you
Callum

 

[Scott Jeslis]

Hello

I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
scan engine 4.3.20

Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
can be other files too (in temporary intenet files) for the
Exploit-URLSpoof.gen which is deleted.

Getting a virus warning EVERY time I open software is not exactly
reassuring - any ideas how i can find the root cause & get rid of the
software that is causing this?

Thank you
Callum

This has to be a McAfee issue. I'm seeing the same message on
wsasc.xml but a scan shows nothing and I can never find this file.

I'm getting this everytime I open IE on 2 different machines and 2
different OSes using the 4376 update (dated 7/14/200).

Scott

 

[turls]

Same thing here, just started yesterday. Over and over, when I try to
actually find the file it refers to it isn't there, I've cleared the
cache, nuked the temp folder (for the most part), updated virus defs
(mine is actually the "home" version of the Enterprise edition, and
when I do google searches on the name of the .xml file this is all I
find.

 

[Steve Rees]

Are you running Ebay Toolbar by any chance, I was fine until I installed
that.

Uninstalled it and it's stopped doing it
Steve

 

[wlawal]

I use Virus Scan Asap 2.7.2.199, virus definitions 4.0.4377 created
on 15.7.04 and scan engine 4.3.20 and noticed the same problem (i.e.
Exploit-urlspoof.gen being detected on opening IE 6.0.2800.xpsp2) on
two separate computers ever since the update after the 15th July. One
of the computers btw had been running for a couple of days and did not
display this problem until it was rebooted this morning and the virus
definition files were updated. This is looking more and more like a
McAfee update related issue. Might be worth asking McAfee for some
steer on this.
WL

 

[Miguel Gonzalez]

I?m getting the same thing. A search for wsasc.xml on my drives turned
up nothing. This is the only reference I can find anywhere online.
I?ve noticed IE being really flakey as well (more then usual) It seems
to hang when I click on certain links and I cant get to
windowsupdate.microsoft.com.

Luckily I got opera and firefox installed, but id like to get this
fixed..

Miguel

 

[Miguel Gonzalez]

I was able to finally get to http://v4.windowsupdate.microsoft.com and
updated everything. I'm going to reboot and see if it fixes the
problem. I found 2 references to Exploit-URLSpoof.Gen on Mcafee's
site:

http://vil.nai.com/vil/content/v_103166.htm
http://vil.nai.com/vil/content/v_100927.htm

I see no mention of the Wsasc.xml file though.

Miguel

 

[Scott Jeslis]

Same thing here, just started yesterday. Over and over, when I try to
actually find the file it refers to it isn't there, I've cleared the
cache, nuked the temp folder (for the most part), updated virus defs
(mine is actually the "home" version of the Enterprise edition, and
when I do google searches on the name of the .xml file this is all I
find.

I'm running the Home version as well under Windows XP.

 

[Joe Mamma]

Same thing here, just started yesterday. Over and over, when I try to
actually find the file it refers to it isn't there, I've cleared the
cache, nuked the temp folder (for the most part), updated virus defs
(mine is actually the "home" version of the Enterprise edition, and
when I do google searches on the name of the .xml file this is all I
find.

I had this issue with one of my end users this morning. I searched
the registry for this file, did a full system scan with recently
updated McAfee, Spybot s&d, and ad-aware. Found nothing.

In my particular case, the user had the eBay toolbar installed. When
I was playing around I disabled the toolbar, and this warning stopped
popping up. After verifying that this was infact the source of the
problem I uninstalled the eBay toolbar. The funny thing is that this
user has had that toolbar installed for weeks. Why would it start
causing trouble now? Did the toolbar somehow become infected, or did
the updated DATs from McAfee (incorrectly?) tag this .xml file as an
Exploit?

 

[Scott Jeslis]

I just updated to the new 4377 DAT file and the issue is still happening.

 

[Scott Jeslis]

I just updated to the new 4377 DAT file and the issue is still happening.

 

[Stephen Wireman]

Open Windows explorer and locate the following folder or search for
the following two files

"C:\Program Files\eBay\eBay Toolbar\lib"

or

wsasc.dll & wsasc.zip


Make sure internet explorer is closed and delete those two files.

Steve

 

[Alan F.]

Hello

I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
scan engine 4.3.20

Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
can be other files too (in temporary intenet files) for the
Exploit-URLSpoof.gen which is deleted.

Getting a virus warning EVERY time I open software is not exactly
reassuring - any ideas how i can find the root cause & get rid of the
software that is causing this?

Thank you
Callum

Me as well :-( - I contacted Mcafee, and their reply was to send me to
the Exploit virus page, and follow instructions. Waste of time as this
just says run Virusscan - which of course does not find anything!!
However I have since found that the files wsasc.dll & wsasc.zip are
part of thge latest version of the Ebay toolbar - so perhaps that is
the cause.

I have added the file wsasc.xml to the "exclude" settings in Virusscan
and now I no longer get the virus popup for it.

Hope this helps.

Alan F.

 

[Scott Jeslis]

Are you running Ebay Toolbar by any chance, I was fine until I installed
that.

Uninstalled it and it's stopped doing it
Steve

Yes I use the Ebay Toolbar!!!! On both machines actually

I tried to e-mail McAfee Support last night but their "queue" was too full LOL

Scott

 

[Scott Jeslis]

Are you running Ebay Toolbar by any chance, I was fine until I installed
that.

Uninstalled it and it's stopped doing it
Steve

Yep I just uninstalled Ebay Toolbar and the alert stops.

I also did a live chat with McAfee Tech Support and alerted them of
the issue!!!

Over and out for now... Ebay Toolbar or McAfee??? hmmm... which do I prefer

 

[Mal]

Hello

I am running the mcafee virus scan enterprise 7.0, virus definitions 4376,
scan engine 4.3.20

Everytime i open Internet Explorer version 6.0.2800.1106 on windows xp sp
1a, I get a warning, mainly for wsasc.xml (in local settings\temp), but it
can be other files too (in temporary intenet files) for the
Exploit-URLSpoof.gen which is deleted.

Getting a virus warning EVERY time I open software is not exactly
reassuring - any ideas how i can find the root cause & get rid of the
software that is causing this?

Thank you
Callum

See http://vil.nai.com/vil/content/v_100927.htm for more details....

 

[wlawal]

Ok panic over. As Joe M suspected, McAfee have incorrectly identified
wsasc.xml, which is assocoated with the eBay toolbar, as an exploit
and have released an extra.dat files to correct this.

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100927

Both my systems have been updated and problem now resolved D
WL

 

[Scott Jeslis]

I also got an Ebay toolbar update tonight (the toolbar alerted me to
the update) and that seems to fix it as well.