JS:Packed-Z - What is this Please

Viruses and worms
1

My home edition of AVAST has just picked this up & I’ve moved it to the vault. I’ve tried a quick google & a search of this site.

In very simple terms please for a noob what is this & should I be worried

TIA

2

You will find little in google for a malware name as there is no common standard for naming malware, see below for a general explanation of the malware name. You have done the right thing, ‘first do no harm’ don’t delete, send virus to the chest and investigate.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

The JS = javascript and the Packed is that it is in a compressed/archived form and this is suspicious, the -Z just signifies a different variant.

JavaScript is what is termed a plain language script as it can easily be read and someone with a little knowledge could interpret what it is designed to do, there should be no reason to pack or obfuscate this code and to do so just waves flags as to what is it that they are trying to hide.

3

Many thanks for the advice

4

No problem, glad I could help.

Welcome to the forums.

5

taxboy, for your future reference, maybe you want to be sure you’re clean and the general cleaning procedure could guide you:

  1. Clean your temporary files.
  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  3. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
  4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
  6. Disable System Restore and then reenable it again.
  7. Immunize your system with SpywareBlaster.
  8. Check if you have insecure applications with Secunia Software Inspector.

Welcome to avast forums.

6

Just detection of some javascript obfuscator. There is no 100% guarantee, that the thing behind the obfuscation is a malware, but no sane person would do that anyway.