Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm using the latest version of Firefox and Windows is up to date. When I was browsing a webpage and clicked a link the browser displayed "connection has been reset" and AVAST poped-up saying "Alert!"

Infection Details
URL: http://downloadsave.info/?e
Process: C:\Program Files (x86)\Mozilla Firefox\f...
Infection: JS:MultiPlug-B [Adw]

I mean how can a JavaScript file by itself by malicious? EDIT: if malware arives at a system by exploiting a vulnerability, if a system has the patch for the vulnerability would the AV alaram still go off?

share|improve this question
2  
Yes, most anti virus and personal firewall tools show alerts about exploit attempts that are not applicable. – Hendrik Brummermann♦ Aug 12 '12 at 8:11
@HendrikBrummermann so could it also be some old vbs for ie in the js file? – mic Aug 12 '12 at 14:39
The reason you are gettings these warnings is because you visit websites infected with malicious content. Furthermore "I mean how can a JavaScript file by itself by malicious" very easily, it is all client side, while it does have limitations everything it does is clientside including running and installing an external application – Ramhound Aug 14 '12 at 11:29

2 Answers

up vote 6 down vote accepted

The AV blocked the script because it was malicious. JavaScript can be used to exploit browser vulnerabilities, or plugin vulnerabilities (e.g. Flash / PDF) and can result in native shellcode being executed on your machine.

However, this doesn't mean it should always alert you to such an issue. A lot of AV software will silently block the script if you already have a patch for it, or if it's not particularly dangerous.

In this case, though, there is a very good reason for the AV to alert you: it is informing you that the site you're visiting may be unsafe. If you think you're actually browsing your bank's website, and your AV pops up warning you about some JavaScript exploit, you're likely to double-check that you are indeed on your bank's website, and not a phishing site.

share|improve this answer
up vote 1 down vote

Java Script is interpreted by the browser... ergo the script could exploit weaknesses in the java script engine and can therefore be considered malicious.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.