Virus

[Sargol]

I have win 98 and have PcCillin .
when I ran PcCillin it told me I had a virus . It said it was in windows favorites imported bookmarks messages ......
The name of it is JS_LOGO.A
It said it was unable to clean it and I could not make it delete it . When I tried to click on the X in the PcCillin window nothing happened . So I went to "start" and shut down . Then I looked in my "favorites" > imported bookmarks but I could not find .
How do I try and get rid of it ???

Thanks Dave

[Ranger Bob]

Are you able to go to C:\Windows\Favorites and delete the files? From what I read about this virus it creates a few urls in your Favorites the next time you reboot and then removes itself so you should be able to manually delete the urls. You could also run an online scan at either HouseCall or Panda to see if they will clean it up if you keep getting the alert.

http://housecall.trendmicro.com/

http://www.pandasoftware.com/activescan/com/

[Sargol]

Bob I went to favorites > imported files but cant find it . If I could find it I know how to delete it . I will try what you said .
I dont get any warnings about it --- PcCillin just tells me its there when I run a scan --- its the first one they have ever picked up - always before it said they found none

[Amie]

Dave

How about doing an online virus scan at either or both of these sites:

Panda (http://www.pandasoftware.com/activescan/)

Trendmicro (http://housecall.trendmicro.com/)

Amie :amie:

[Amie]

Me again

found this post in Google groups;

Virus Encyclopedia

JS_LOGO.A
Risk rating:
Virus type: JavaScript
Destructive: N

Aliases:
LOGO.A, JS/Logo

Description:
This JavaScript virus executes its payload on the next boot up after infection.
At this time, the virus adds some entries in the Favorites folder.

Solution:
Trend customers

Keep your pattern file and scan engine updated. Trend Micro antivirus software
can clean or remove most types of viruses. Certain viruses, such as Trojans,
scripts, overwriting viruses and joke programs which are identified as
"uncleanable", should simply be deleted.

All Internet users
For a quick check-up of your PC, use HouseCall - Trend Micro's free on-line
virus scanner. This will check for viruses which may already be on your PC.
To keep your computer healthy by catching viruses before they have a chance to
infect your PC or network, get the best antivirus solution available today.
Trend Micro offers antivirus and content security solutions for home users,
corporate users and ISPs.

Technical details...
(continued from profile page)

In the wild: No
Trigger condition 1: Next boot up after infection
Payload 1: Others (creates entries in the favorites folder)
Detected by pattern file#: 794
Detected by scan engine#: 5.17
Language:
English
Platform: Windows
Encrypted: No
Size of virus: 4.44 Kilobytes

Details:
This JavaScript virus when executed, creates a file, LOGO.HTA in the Windows
startup directory. When the computer is rebooted, it adds the following entries
in the Favorites folder:

`INSTANT FREE Submission to 612729 Directories!",
"http://www.links2u.com/?628252"

"The River Belle Casino, where Lady Luck smiles on you!",
"http://www.riverbelle.com/stats/index.asp?sourcesite=aff24449"

"Send free cards to your friends at nicecards!",
"http://nicecards.com/partner.cgi?p13734"

"Real money in your pocket!",
"http://www.referect.com/cash/?id=ak0000"

"Welcome to Adult Friend Finder!",
"http://adultfriendfinder.com/go/p29214c"

After dropping these URL files, the virus uses COMMAND.COM to delete itself
from the startup directory.

Amie :amie:

[Ranger Bob]

Originally posted by Sargol@Oct 24 2003, 11:35 PM
Bob I went to favorites > imported files but cant find it . If I could find it I know how to delete it . I will try what you said .
I dont get any warnings about it --- PcCillin just tells me its there when I run a scan --- its the first one they have ever picked up - always before it said they found none
I don't understand why you keep talking about importing the Favorites. You should be able to go into Windows Explorer and browser to the location of your Favorites folder and delete the urls that have been placed in the folder. You also should be able to display your Favorites from IE and delete any that you don't want from there.

[linc]

I had a similiar problem a couple of weeks ago with one called I think ta/js.needy or something like it, in the end because it couldn't be deleted, i went into safe mode, clicked start, find, when it was found i deleted and rebooted, no problems since. hope this helps