Feed location

How do know which feed is creating

C:\Documents and Settings\*******\Local Settings\Temporary Internet
Files\Content.IE5\0A8M3JIT\feed[1].txt\00003970.js


My antivirus is constantly detecting JS/Psyme virus on this feed and I
cannot figure out which one to delete. I have hundreds of feeds in my IE and
cannot keep trying manually.

CrystalBall© sez...

AVG Free Forum
http://forums.avg.com/


SV wrote:
> How do know which feed is creating
>
> C:\Documents and Settings\*******\Local Settings\Temporary Internet
> Files\Content.IE5\0A8M3JIT\feed[1].txt\00003970.js
>
>
> My antivirus is constantly detecting JS/Psyme virus on this feed and I
> cannot figure out which one to delete. I have hundreds of feeds in my IE
> and
> cannot keep trying manually.

SV wrote:

> How do know which feed is creating
>
> C:\Documents and Settings\*******\Local Settings\Temporary Internet
> Files\Content.IE5\0A8M3JIT\feed[1].txt\00003970.js
>
> My antivirus is constantly detecting JS/Psyme virus on this feed and I
> cannot figure out which one to delete. I have hundreds of feeds in my IE and
> cannot keep trying manually.

I don't use RSS feeds in IE8. I have barely enough time to do my own stuff
without having "info" pushed at me. Does that .js file exist? If so, have
you looked inside it using a text editor, like Notepad? Are there other
files under that folder you can peek inside? You might find some text or
URL links inside that would indicate for what site it belongs. Is there an
..xml file (a text file) in that folder that defines the feed?

"SV" <> wrote in message news:B6E6F5BB-5D9C-4B6F-837C-...
> How do know which feed is creating
>
> C:\Documents and Settings\*******\Local Settings\Temporary Internet
> Files\Content.IE5\0A8M3JIT\feed[1].txt\00003970.js


I would say it's not a feed. Something created a new subdirectory
in a TIF subdirectory and that something has a Javascript file it wants
you to run somehow? If it is being done by something that isn't able
to cover its tracks you could try using the Properties of that subdirectory
to give you some context, e.g. creation date and timestamp and then
see if there is something else that was happening at that time.


>
>
> My antivirus is constantly detecting JS/Psyme virus on this feed and I
> cannot figure out which one to delete. I have hundreds of feeds in my IE and
> cannot keep trying manually.


Feeds are .rss files usually. If this is XP you could use the TIF Viewer
to see that. (On Vista and W7 the new Low subdirectory gets in the way.)

Cookies are .txt files. And supposedly cookies can contain scripts.
Again, if this was XP you could use the TIF Viewer to check on something
like that. Otherwise, still assuming it's something that won't be trying to
make itself obscure, you could use techniques such as using ProcMon
or listing file accesses sorted by timestamp as more specific clues.


Good luck

Robert Aldwinckle
---