Virus found in downloadfile

[SteveV]

Ontrack System Suite reports the virus JS_LOOP.A is found in the file "Six Buttons from Hell.IZS"

This is version 2.0 in a download I took a month or so ago. I had the same experience with a version of 2.0 downloaded over a year ago.

[pascal]

Heey, man

If you would take a look in the threads is this forum about bugs, you would find thousands of topics about this bug.
It is not a virus!
It is just an annoying JavaScript-file.
Just remove the file, or don't, it doesn't even mather.


This piece of JavaScript contains, as the title suggests, 6 buttons.
Those 6 buttons all have an irritating function, like opening a few hundred pop-ups, wich make your computer crash (or something like that).

If you just remove the file, nothing bad will happen.




Pascal

[svanslyck]

Damn. Check me off in the "idiots" column. But why haven't "they" addressed this in the download file or in the readme (which I have not read since a year or so ago)?

[pascal]

yes, I know, it's pretty stupid.
Almost everybody is shocked the first time he downloads 1st page, I think.

[thawebman]

no duh jij bent echt een kneus he

[thawebman]

virussen mot je gewoon scannen

[azlatin2000]

thaweb man y do you try to get more posts

[azlatin2000]

by posting one thing on multiple posts like i am doing right now withinn 1 minute

[pascal]

Originally posted by thawebman
no duh jij bent echt een kneus he

Originally posted by thawebman
virussen mot je gewoon scannen
duhhhh, ik ben niet helemaal stom!
even verder in het engels.


It is pretty irritating and dumb if you're downloading a editor like his one, lalalalala, "downloading complete".
Installing the file......


"ping" --> virusscanner says: 1 virus found during the install of 1stpage. AHHHHHHHH, I downloaded a virus!!!!
****ing hell!

no, just kiddin' but it isn't something you like, when you install a programm, right?

[gflaig]

Virus still there :


Norton Antivir informs the following :


Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Js.Trojan.WindowBomb
File: C:\Programme\Evrsoft\1st Page 2000\IScripts\Buttons\Six buttons from hell.izs
Location: Quarantine

[jawaldron]

As a software developer myself, I have to take note about a developer that leaves a known, and reported, bug in their installation program. Granted... 1st Page is free, but wouldn't any developer want to have as professional a product as they can? It makes a very misleading statement to the end user about the EvrSoft company I think.

[DCElliott]

The virus company establishment decided to inapproriately label this as a virus loooong after thousands of copies of the program made their way around the internet. Even if the developer released a fix, there would still be this problem of all the old versions.

Let us all just hope that we see a new version soon and all this goes away.

thewebman - this is your LAST WARNING - any further spamming of this board will result in your being banned. IS THAT CLEAR!!

DE

[jawaldron]

Originally posted by DCElliott
The virus company establishment decided to inapproriately label this as a virus...Yes they sure did. But although it is certainly NOT a virus, it is pretty much useless as a script isn't it? I mean, who wants to put that script in their webcode so that it causes the visitor to their site to have tons of windows open on them?

No developer is going to use that bit of script and no user is going to want to run into it. Forget the virus stuff, it isn't a virus. Okay. Fine. But what is it then? It's a useless bit of fluff that is taking up space, and because of a dumb decision by the virus companies, is being reported incorrectly.

Now just take a look at all the entries this has caused to the board here. Pretty big waste of time isn't it? Each new user who downloads 1st Page is going to wind up reporting this before they realize how much it has already been reported. More waste of time. More taking up useless space.

Now forget about old copies of the product, (like mine now), I'm aware of the stupid script and I know it's not a virus, and it's a done deal.

But what about the next Jill Q. Public? If that stupid script was removed from the installation... she wouldn't start posting about this "virus" she found and that would be the end of that. No more future grief. And the rest of us... well we already KNOW! So it dies out. It's done. Problem solved.

My question still stands... Why wouldn't a professional company want to see this happen? Frankly I just don't see it.

And that remains... my 2 cents.

[Terminator1138]

I agree with the above statements of DCElliot, and JaWaldron,

A new thread about the same virus is not needed if you just scan the forums. Anyone with a good virus scanner does not have to worry about anything (so long the def-file is updated). Do the research, move on and use this great editor.

Said my peace..........

[bitechu]

If you open the file in question in notepad you'll see that all it is is an infinite loop programmed in javascript....quite harmless.

[Karin]

Ontrack System Suite reports the virus JS_LOOP.A is found in the file "Six Buttons from Hell.IZS"

This is version 2.0 in a download I took a month or so ago. I had the same experience with a version of 2.0 downloaded over a year ago.

My virusscanner found also JS Loop while he's was scanning in the 1st page files. It was easy to delete the virus.

[quaecumque]

Yes they sure did. But although it is certainly NOT a virus, it is pretty much useless as a script isn't it? I mean, who wants to put that script in their webcode so that it causes the visitor to their site to have tons of windows open on them?

No developer is going to use that bit of script and no user is going to want to run into it. Forget the virus stuff, it isn't a virus. Okay. Fine. But what is it then? It's a useless bit of fluff that is taking up space, and because of a dumb decision by the virus companies, is being reported incorrectly.

Now just take a look at all the entries this has caused to the board here. Pretty big waste of time isn't it? Each new user who downloads 1st Page is going to wind up reporting this before they realize how much it has already been reported. More waste of time. More taking up useless space.

Now forget about old copies of the product, (like mine now), I'm aware of the stupid script and I know it's not a virus, and it's a done deal.

But what about the next Jill Q. Public? If that stupid script was removed from the installation... she wouldn't start posting about this "virus" she found and that would be the end of that. No more future grief. And the rest of us... well we already KNOW! So it dies out. It's done. Problem solved.

My question still stands... Why wouldn't a professional company want to see this happen? Frankly I just don't see it.

And that remains... my 2 cents.

If you have not yet read this post, please do. I don't see why it's so hard to understand that most (at least those posting here) end-users have no desire to download something with this type of function. The "virus company establishment" may have incorrectly labeled it a virus, but they did well not to omit it from their definitions: it's malicious at worst, extremely aggravating at best.

[ingrid]

[QUOTE=jawaldron]Yes they sure did. But although it is certainly NOT a virus, it is pretty much useless as a script isn't it? I mean, who wants to put that script in their webcode so that it causes the visitor to their site to have tons of windows open on them?

No developer is going to use that bit of script and no user is going to want to run into it. Forget the virus stuff, it isn't a virus. Okay. Fine. But what is it then? It's a useless bit of fluff that is taking up space, and because of a dumb decision by the virus companies, is being reported incorrectly.

:hellother
I downloaded and installed this editor many times, and never got a virus report. That silly script, yes I found that and it was usefull to me. Just to have an example of a looping script. But also to understand what those advertising pages are doing. Don't like the script? Don't like the editor? Discard it. It is free, nothing's lost.

It would be good to mention it somewhere before the download though, if some virus scanners report the script as being a virus. Just installed it again on a pc, and yes! I got the virus warning. Bit of a shock!

Anyway, this board does mention it. Another problem after installing the editor: I get the message I have no diskspace....

I actually do have several gigabyte empty space. Anyone else had the same experience?
:hmmmm:

[saxonmann]

When I first started coding, I tried all the free editors, Stones Webwriter, FirstPage 2000, and a host of others, even cracked dreamweaver, Homesite and just about every other program out there, eventually settling for HTMLkit which I continue to use to this day. Still the best free editor for HTML/ XHTML/CSS and Programming languages like PHP, Javascript etc., that is if you really want to learn to code, however there is a snippet function that allows you to write or hunt down any script you want and save to insert when needed. This means, no unwanted code like the pop up windows script, just script you want to use.

I would have to rate FirstPage as LastPlace among editors like Stones Webwriter and Chami's HTMLkit, both free, both Stable, both user friendly, about all I could say for FrontPage? its an old Homesite program in disguise with some useless and very outdated code examples.

[Terminator1138]

You mentioned FirstPage and Frontpage, two way different products. You also posted in a thread about a virus. On a side note, post in themost correct thread that regards your post. See FAQ's and Forum rules. Okay now for the use of programs. I think everyone here can agree that there are many programs and I think most have tried them all. Just use what you like and be happy.

[wildbill2u]

If you open the file in question in notepad you'll see that all it is is an infinite loop programmed in javascript....quite harmless.

I'm just learning about web design and HTML. When my McAfee program said I'd downloaded a trojan (with a name 6 buttons from hellz) you think that didn't scare the pants off me?

You think anyone with little experience is gonna try opening up something with that name and a trojan label and experiment to see if its "quite harmless?"

If it's a known "scare" item, why keep it in the program?

[Mr Stilts]

If it's a known "scare" item, why keep it in the program?

Ok I'm sorry if this is rude but my god people... Do you just like to read what you have written in the same vein where you like to speak only to hear yourselves talk??

Did you not notice the EXTENSIVE amount of posts and explanations in this thread??

Did you not discover that the script was included BEFORE everyone and their grandmother cried wolf to the AV companies ultimately having the damned thing included in their definition lists??

Did you not yet realize that this program is almost FIVE YEARS OLD??

So again I pose this question to everyone who thinks it is just a very simple matter to remove the program. How would you go about removing the program from THE INTERNET which can be virtually larger than our universe to ensure that newb's on the net don't piss thier pants because they haven't yet realized that their AV isn't AI??

Let it go! The program is four years old about to turn five most likely. The script was included before it was defined as a trojan and NO you cannot just simply remove thousands or even tens of thousands of the readily available for download copies of it that are circulating through the internet...

You found a virus warning, you came to the forum of the site where the program is offered. You found explanations, instructions and in some cases maybe even an apology by people who didn't have to give one..

Grow up! The developer did not place a trojan or trojan-like or even joke script in the program. It is a looping script which can actually be useful to people who know how to edit and use those types of things for certain programming...

Damn I shouldn't post when I've been drinking...

[dabbler]

What he said!

[Terminator1138]

I second that. The script was third party and the developer did not make it a part of the core program. Secondly, why don't you blame the virus companies who, in the first place, mislabeled it!!!!

[ddmaiz]

Okay, I've downloaded the program and read all of the posts about JS/Winbom and, no, it's not a virus. It is correctly defined as a "trojan".

Why it's even in the program is beyond me! All of the people who wrote that it's just harmless and should be deleted are right. However, not everyone has the ability, know-how, or anti-virus software to delete the thing.

No amount of describing it as "harmless" can justify it's presence. Perhaps if an administrator reads this message they could take a suggestion to the powers that be...

How about including a read-me file with the download dedicated exclusively to explaining this problem or even posting a warning/explanation on the download page before some unsuspecting person downloads this trojan? Just a thought.

Best Regards,
DMA

[Mr Stilts]

Did you not yet realize that this program is almost FIVE YEARS OLD??

So again I pose this question to everyone who thinks it is just a very simple matter to remove the program. How would you go about removing the program from THE INTERNET which can be virtually larger than our universe to ensure that newb's on the net don't piss thier pants because they haven't yet realized that their AV isn't AI??


By the way... definitions aside. It's not a trojan. NOT A TROJAN... If I had a nickel for every piece of crap file that my AV told me was a trojan actually was a trojan, I would be a very rich man...

Well not really. Exaggerated to prove a point...

I think it would be infinitely easier to convince the virii definition writers to remove this from thier lists than to actually "fix" the current files available for download... And though the former might be a bit more probable than the latter, they both remain ridiculously difficult and ultimately fruitless...

Boy I wish someone would create a forum where people with questions about this could go to find the answers...

Oh wait! They did! You found it!!
stop ignoring the answers.. and please cease the senseless regurgitation of actions to be taken when you know damned well it's never as simple as you would liek to force "admin" or anyone else to believe...

EDIT::
I am apologizing for being such an obnoxious american ass but one day i'll post a reply with a link to every single discussion about this and then you can all relate to the level of annoyance that is achieved...

[Terminator1138]

I want to re-interate to read all post about virus........if you read the virus threads and history you would know the rest of the story......

It was not admin who put it in there, cuz it was third party integration. Why don't you blame the person that submitted it to Symantec, McAfee, etc and thus mislabeled it. Installation is super easy, just delete that file. Most AV's will delete the file automatically now anyways so you don't have to have expert knowhow to do it. Heed the words of Mr. Stilts and others that have replies and posted.

[johnq]

My virus report:
Virus:Trj/JS.Loop Disinfected C:\Program Files\Evrsoft\1st Page 2000\IScripts\Buttons\Six buttons from hell.izs

My action: uninstall 1st page, try something else.

In this case, you get what you pay for. Virus or no virus, it's pretty weak if this same issue has been around for a year or so. To me this says that this company did not intend on fixing this glitch. Does not reflect well to me as a potential consumer of Eversoft products. I have no plans to use or purchase any software products this company produces.

[dabbler]

RESPONSE A:

Fine.

If you can't find the well-signposted Read First section,
OR, if you found it but decided not to read it,
OR if you found it and decided you were above reading stickies,
OR if you found it, read it, and decided to post the above anyway........

we don't care! We are heartily sick of posts like this one! Use something else - so what? Most of us do too!

RESPONSE B.

Yawn!!!!!!


RESPONSE C

(the response suggested in the "Posting and You" video when someone doesn't read the stickies) Ha ha ha ha ha ha!

--------------------------------------

Oh! am I in a cynical mood this morning!
someone post something interesting,please!

[chance57]

For what it's worth, my version of 1st Page 2000 came in a CD Business Suit of bundled software. I installed and have been using it since 9/2/02. I have had none of the problems that have been mentioned in this post. So, do I have a newer version, or did I just get lucky ?

[dabbler]

Go for the lottery while you're on a roll!

There is no newer version!

[DCElliott]

Just by way of providing intermittent clarification of the six-buttons-from-hell non-problem. The code in question, known to virus scanners as JS/Windowbomb, is a script - that is, it is a series of javascript commands. It sits quietly in a directory on your computer. It has to be actively incorporated into a webpage by a malicious coder in order to cause difficulties. It has no ability to run or to be executed by accident - it must be included in the html of a webpage.

If you create a webpage with the script (I have done this on my own harddrive for purposes of experimentation to assess the harmful potential of this script.) and execute it, it will start looping, rapidly creating new browser windows. A simple Ctrl+Alt+Del will stop it in its tracks. However, left unchecked, it will gradually eat up your computer resources until your system becomes unresponsive or locks up. If you had unsaved files open, you will lose your work. If you have to do a power off with earlier versions of Windows (FAT file system), you will probably have to endure a checkdisk sequence on restart. That is the sum total of what BAD THINGS will happen. There will be no passwords stolen, compromised credit card numbers, or unauthorized access to your secret porn collection.

Other forum members have discussed, and expressed their considerable frustration with the continued posts regarding this script. I only ask them to keep the discussion elevated and never make it personal, or question the intelligence, eyesight, mental health, or sexual preference of someone posting regarding the Virus|Trojan|Worm|CyberBooger or whatever you want to call it. (That's in the Guidelines and FAQ, too)

DE

[Tarmithius]

How did you know I have a secret pr0n collection passworded with my credit card number? ;)

Sorry thought I might interject a little humor where it might not belong.

[Terminator1138]

And lets not forget, the faithful post that THIS IS NOT A VIRUS, !! why not post to your scanner company and yell at them for falsely adding it!! Its not the companies fault, its third party scripts, do your homework.