Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Today, I was infected with the "AV Security Suite" malware. I believe it was this evening after viewing some links on digg.com (news aggregation site) using internet explorer. On one particular site, I noticed a Java 6 splash screen come up. I have Java 6 EE installed on my computer, but the app server (Glassfish) was not running.

About one minute after the splash screen, I noticed the "AV Security Suite" notification in my taskbar, attempting me to click a link in the tool. It also hijacked my IE proxy settings. The file msvcr71.dll under my Glassfish directory was compromised and had to be deleted.

I have successfully cleared the malware, but my question is this:

How did I become infected in the first place?

I am running Windows 7 64 bit, Windows Firewall (and behind a personal firewall), Windows Defender, Ad-Aware, and AVast, all were up to date. I did not install any application in the past week, I am very careful as to what I download and run. It is not from attachments from any of my emails (I believe), and my IE security settings are fairly high, with a few settings that I had to make for Citrix to work (I can't recall exactly which settings).

My inclination is that this is due to an incorrect browser setting which I am hoping to fix to prevent this from happening again.

For most of my browsing, I do use Firefox with Ad-Block Plus and other add-ons. Occasionally, I do need to use IE for business sites that only work under IE, and this time I was unfortunate to use it to do other browsing.

share|improve this question
1  
Install Microsoft Security Essentials, it is surprisingly well written and doesn't try to take over your machine. I'd never thought I'd praise a Microsoft product, let alone a free one but it has cleared more crap from desperate friends and relations machines than anything else I'd seen. –  msw Jun 30 '10 at 4:48

1 Answer 1

up vote 1 down vote accepted

Its called a drive by infection, by visiting a compromised or malicious website using javascript to infect your PC.

I use Chrome browser with javascript disabled, or use Firefox with no script add on.

Java and Javascript are two completely different things, from different companies.

You can set IE7 or 8 to prompt you when javascript wants to load, then you can decide if you want to let it run or not, some features in webpages will not work if javascript is not allowed to run.

To cause IE7 or 8 to prompt, go to Internet Options>Security Tab>Click the "Internet" icon, then click the "custom level" button, when a window opens scroll down to "Scripting" section, under "Active Scripting" set it to "Prompt", hit Ok, then Ok again.

.

share|improve this answer
    
I updated my question with some more detail. I typically use Firefox. I am surprised that a Javascript attack can run a Java program and install software on my computer, all undetected by my security measures. –  RussellW Jun 30 '10 at 3:27
    
It was only an educated guess how you were infected, but there is always someone out there finding vulnerabilities in web browsers and exploiting them to infect PCs, its a constant battle to keep browsers protected with updates. –  Moab Jun 30 '10 at 4:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.