Jump to content
User2

JS/Spy.Agent.Z Trojan got blocked. But where?

Recommended Posts

Posted (edited)

Hello,

my Eset Internet Security shows an alert when i had entered a apparently bad maintained website. It identified a "JS/Spy.Agent.Z Trojan" and blocked the internetaccess for my browser. My Question is if Eset blocked the trojan before it got access to my pc or blocked the trojan's trial to communicate from my PC to outside.

I don't have a english Eset version but i tried to translate what is displayed in the Eset Log:

Time: ...
Scanner: JavaScript-Scanner
Objecttyp: File
Object: https://...net
Detection: JS/Spy.Agent.Z Trojaner
Action: blocked
User: ...
Information: "A event occurred as the following application tried to access to the internet: \Program Files\Mozilla Firefox\firefox.exe"
Hash: ...
First seen here: this line was blank

The entry at the "Information" line seems that the trojan can be on my PC but a full scan with Eset can't find anything.  
Malwarebytes can't finde anything too. Booth were up to date before i started the scans.

My Browser is FF (up to date) and I use the extensions Ghostery and Adblock Plus.
In the past i used NoScript too. Maybe it could have helpful/assist to prevent the trojan.

regards

Edited by User2

Share this post


Link to post
Share on other sites

The trojan was not executed; it was scanned by the javascript scanner when you opened the compromised website and the connection was blocked.

Share this post


Link to post
Share on other sites

Ok then was my first thought right but in the second though i was a bit unsure.
Thank you for your very fast answer.

Regards

 

Share this post


Link to post
Share on other sites
23 hours ago, User2 said:

Ok then was my first thought right but in the second though i was a bit unsure.
Thank you for your very fast answer.

Regards

 

NoScript can assist with preventing malicious JS scripts from running , replace Adblock Plus with uBlock origin since it's lighter and better and then if you'd like something that is close to NoScript then go ahead for uMatrix , most of these scripts will be denied and won't be able to work , when you use the uMatrix , most of the websites will look broken untill you allow it's scripts to run , you will get used to it but it's so much helpful.

Share this post


Link to post
Share on other sites
Posted (edited)
Quote

NoScript can assist with preventing malicious JS scripts from running , replace Adblock Plus with uBlock origin since it's lighter and better and then if you'd like something that is close to NoScript then go ahead for uMatrix , most of these scripts will be denied and won't be able to work , when you use the uMatrix , most of the websites will look broken untill you allow it's scripts to run , you will get used to it but it's so much helpful.

Hello Nightowl,

excuse me for my late answer! I didnt expected a second reply.
Thank you for your adivce. I even considered to change Adblock Plus to uBlock. I will change it shortly.
And i didn't know uMatrix but i will have a look to it. It sounds like it is from the same developer how uBlock is. I think i will try this too also when websites will look broken.

Edited by User2

Share this post


Link to post
Share on other sites
On 7/4/2020 at 12:43 PM, User2 said:

Hello Nightowl,

excuse me for my late answer! I didnt expected a second reply.
Thank you for your adivce. I even considered to change Adblock Plus to uBlock. I will change it shortly.
And i didn't know uMatrix but i will have a look to it. It sounds like it is from the same developer how uBlock is. I think i will try this too also when websites will look broken.

uMatrix is useful when there are too much scripts that will load , it will deny all of them , even good ones , and let you choose what to run and what not to run , but sometimes websites get broken because of it , I disable it sometimes if the website is having troubles to run it

uBlock has never given me any troubles , it runs very fine.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...