Repeatedly receiving alert

[Former Member]

Event description: JavaScript or VBScript security violation detected and blocked

Threat type: Trojan

Threat name: JS/Miner.ay

 Received on ePO server: 10/31/18 13:21:09 UTC

 Target file name(s):

Script executed by scrcons.exe

IP address: 10.192.XXXXX

 This message has been created by ePO server XXXXXXXXX

I have scanned the machine still receiving these alerts, please help to fix the issue.

[Hawkmoon]

Hi Ammit,

As a general rule if you are receiving alerts about Malware or any other matter of worth, it is true to say the condition/Malware is still active and needs attention.

I'd suggest a review of the scanner (VSE or ENS) configuration & logs to see if the named device is activity detecting/reporting the matter and action as needed with the help of the ENS/VSE team.

[Former Member]

Please guide with the steps, i have updated VSE, DAT, agent.

Scanner the machine, still no go.

[Hawkmoon]

Hi Ammit,

I'd suggest you call the VSE/ENS support team to speak with one of the enginers so thay can work with you and that point product.

[Former Member]

How can i contact the ENS team, I have the console access i am managing ePO.

[Former Member]

Hi @Former Member

Those events indicate that  you are seeing a JS/Miner Malware. JS/Miner is a malware family that utilizes JavaScript (JS) either in a browser or via a standalone process (wscript.exe/cscript.exe) to mine crypto-currencies on a target user’s endpoint system. They are normally embedded within websites.

Please review the following threat advisory on this topic - it provides you with some further information on the detection and also mitigation steps: 

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27447/en_US/McAfee_Labs_Threat_Advisory-JS_Coinminer.pdf

[Former Member]

How can i fix this issue with the help of ePO console or by accessing the machine.

[Former Member]

Please see my response from earlier, this should help.

[Former Member]

I am from the ENS team, i have the access to console, please help with the steps which i need to perform to fix this issue, its a big pain for recving alerts every now and then.

[vnaidu]

Hi Ammit,

You may refer the KB article KB81095 and create access protection user defined rules, as this is a java script which can be embedded in most of the websites where is the endusers are not aware. The Access Protection user defined rules could be of much help in your scenario.