Help to Remove JS:ScriptIP-inf [Trj] that Affects Browsers

 

JS:ScriptIP-inf [Trj] Symptoms

Most websites are blocked including reputable sites like Facebook. Attempts to access sites may very well trigger the following warning alert:

Avast! Filesystem has detected a threat.

Infection: JS:ScriptPE-inf [Trj]

File: Users/[computer name]/Library/Caches/com.apple.Safari/Cache.db-journal

Process: /System/Library/PrivateFrameWorks/Webkit2.framework/WebProcess.app/Contents/Mac OS/WebProcess

UID: 501

Or

URL: http://www.facebook.com/

Process: file://C:\Program Files\Google\Chrome.exe

Infection: js:ScriptIP-inf [Trj]

Victims can't either access any of the sites related to their own Facebook e-mail accounts (Youtube or Hotmail) because Avast pops the same message. Restarting modem would just relief the online surfing temporarily.

Other symptoms of JS:ScriptIP-inf [Trj] affection also include:

1. Slow PC performance.
2. Multiple processes running in the background to consume CPU.
3.  Browser redirect.
4. Additional applications/infections are detected soon after JS:ScriptIP-inf [Trj] affection.

JS:ScriptIP-inf [Trj] Definition

JS:ScriptIP-inf [Trj] is a Trojan horse that exploits the bug in JS language for infiltration and adopts Script technology to steal victims’ confidential information such as log-in credentials and bank card details.

JS:ScriptIP-inf [Trj] Capability

Dodge automatic removal – using Script technology, JS:ScriptIP-inf [Trj] manages to prevent from complete removal by anti-virus program as such technology is considered to be normal.

Allow unsolicited access - JS:ScriptIP-inf [Trj] is endowed with generic Trojan features, thus it is capable of opening up backdoor by taking advantage of ports that we seldom use for communication and information exchange.

Bring in additional infections/ programs – having the convenience (backdoor), the Trojan horse is able to help with additional infiltration for extra money.

Modify DNS settings – when the Trojan horse is exploiting the bug within JS language, the modification on JS language will result in DNS modification and thus JS:ScriptIP-inf [Trj] is enabled to block access or manipulate searching destination.

Weaken Security defense – once JS:ScriptIP-inf [Trj] is settled down on a machine, drivers concerning security service will be numerated and overwritten with vicious code partially, leading to malfunction and the virulent code injection into process; as a consequence, plenty of CPU will be taken away to deal with error and carry out more commands at a time, leaving little for security utilities to run for protection.

Now that we know JS:ScriptIP-inf [Trj] is horrible, let’s take the below removal thread against it and regain a healthy and perfectly functioning machine. Should you run into any unexpected problems in the middle of the removal due to additional infiltration, you are welcome to contact Global PC Support Center for exclusive help according to your concrete situation.

Steps Help to Remove JS:ScriptIP-inf [Trj] that Affects Browsers

Step1. Restart the computer and enter into Safe Mode to carry out the following steps.

Windows 7/Vista/XP

• Restart the system to keep tapping on F8 functional key when the system is restarting.
• Choose “Safe Mode” when “Windows Advanced Options Menu” occurs.
• Hit Enter key.

Windows 8

• Restart the system to hold down Shift key and keep tapping on F8 functional key when the system is restarting.
• Choose ‘See advanced repair options’ >‘Troubleshoot’ >‘Advanced Options’ >‘Windows Startup Settings’ > hit “Restart” button to enter into Safe Mode.

Step2. Remove cookies from browser settings

Internet Explorer

Tools icon > Safety > “Delete browsing history” option in > tick “Cookies” > “Delete” button.

Chrome

‘Customize and control’ menu > Tools > “Clear Browsing Data” option > tick “Delete cookies … “> “Clear browsing data”.
 

Firefox

Tools menu > “Cookie Manager” > “Manage Stored Cookies” > remove all cookies.
 

Opera

Open up Opera and make it as the current browser > Alt+P key combination > Privacy and Safety > “Cookie” > click on “all cookies and website data” button.
 

Step3. End vicious processes and service related to JS:ScriptIP-inf [Trj]

Access Task Manager > View >　select columns > tick "PID" and "Path name" > go to open up System Information > end the process with path name directing to JS:ScriptIP-inf [Trj]'s path or the path that doesn't belong to system.

tip: find the services directing to JS:ScriptIP-inf [Trj]'s path or the path that doesn't belong to system for step5.

Windows7/vista/XP 

• Hold Win key and R key at once to type “services.msc” in the pop-up text box.
• Hit Enter key to enable the services window.
• Remove/disable the service directing to JS:ScriptIP-inf [Trj]'s path.

Windows 8

• Open Windows Explorer on Start screen.
• Access Administrative tools.
• Double click on Services icon and remove/disable the service directing to JS:ScriptIP-inf [Trj]'s path.

Step4. Access Database to remove the items generated by JS:ScriptIP-inf [Trj].

• Press down Win key and R key together > type “regedit” > hit Enter key > remove the values under the following entries:

HKEY_CLASSES_ROOTWindowFiles\Check_Associations

HKEY_LOCAL_MACHINESOFTWAREClientsStartMenuInternetINTEXPLORE.pif\ToP

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun\[random numbers and letters]

HKEY_CLASSES_ROOTCLSID{random numbers} shellOpenHomePageCommand. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

• Next use Ctrl+F key combination to put in the suspicious service detected in step3 > hit Find button > end the services in Database.

JS:ScriptIP-inf [Trj]Removal Suggests

It is recommended to update passwords and remove all items/virus associated with JS:ScriptIP-inf [Trj] after a complete and through removal. Otherwise, vulnerability can exist to be exploited by the Trojan horse again for re-image. It needs certain level of virus knowledge and computer skills to carry out the above removal steps correctly and completely as mutex and items resembling system ones can be generated by JS:ScriptIP-inf [Trj] to dodge easy removal. Therefore it is impossible to list out all vicious items for all victims owning different version s of OS. But the removal thread is effective.

Reference: http://blog.vilmatech.com/remove-jsscriptip-inf-trj-get-rid-trojan-virus-safely/