This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Contentfiltering/Virusprotection/Trojan.Dropper

Hi there,

we've some reports from UBB users about SurfProtection blocking some pages (esp. in this forum) because of a so called 'Trojan.Dropper.VBS' script. We're still unable to reproduce this behaviour correctly, but it seems to be a false positive by the Kaspersky scanner. (There is one userreport telling the Trojan.Dropper is getting displayed when surfing without SurfProtection, but with Kaspersky desktop scanner, too)

We're in touch with Kaspersky, but they also need to reproduce the behaviour, to provide a fix.

There are good reports from fobe and eldorado (UBB members) - in case anyone else encounters this problem and can provide some additional information (howto reproduce), please post here.

Thank you very much!

cheers
Marcel

This thread was automatically locked due to age.

0 Taharqa over 21 years ago

While browsing the UBB, I toppled over this issue. Here's the dump of the page.

The item you have requested is infected by a virus. It will not be downloaded.
     Virus detected: -TrojanDropper.VBS.Inor.ap /

Scanner variables
http-url https://community.sophos.com/products/unified-threat-management/astaroorg/f/68/t/60972
path /showflat.php?Cat=&Number=43597&page=0&view=collapsed&sb=5&o=&fpart=1
content-type text/html; charset=iso-8859-1
protocol http
facility response
src_address 192.168.69.4
http-status-code 200
http-status-protocol 1.1
http-status-reason OK
status OK
last-scanner /usr/lib/libkav.so
virus-transport-status -Received 43866 bytes, MD5 signature validated
virus-name -TrojanDropper.VBS.Inor.ap /
virus-scan-status 201 91 4 1 26052004 89760 5.0.0.0/OEM 310 Receiving 43866 bytes 311 -Received 43866 bytes, MD5 signature validated 327 -TrojanDropper.VBS.Inor.ap / 233 File has warnings
virus-infected yes

Protocol variables
Date Wed, 26 May 2004 17:38:09 GMT
Server Apache/2.0.40 (Red Hat Linux)
Accept-Ranges bytes
X-Powered-By PHP/4.2.2
Content-Type text/html; charset=iso-8859-1
Cache-control private
Connection close
Proxy-connection close
Content-length 43866
Cancel
Vote Up 0 Vote Down

Cancel
0 Uwe over 21 years ago in reply to Taharqa

Here is some information: http://de.trendmicro-europe.com/enterprise/security_info/ve_search_result.php?hidChoice=1&VName=TrojanDropper.VBS.Inor&ddmVPayload=&ddmVType=&radVDayCritSel=1&ddmVWkday=&ddmVMonth=&ddmVDay=&ddmVYear=

I've installed TrendMicro Desktop with the lates pattern.

No alert.
Cancel
Vote Up 0 Vote Down

Cancel