Avast WEBforum

Other => Viruses and worms => Topic started by: mihail on September 13, 2003, 04:06:01 PM

Title: irc trojan
Post by: mihail on September 13, 2003, 04:06:01 PM

A certain file my friend gave me is identified as IRC Trojan by Norton AV on my friends computer. That same file according to my avast home edition  is clean. The same result gives F-prot and NOD32. How can I check if this file really contains a virus.  ???

Title: Re:irc trojan
Post by: raman on September 13, 2003, 04:20:22 PM

Try this link: http://www.kaspersky.com/remoteviruschk.html
and say what it reports.

Title: Re:irc trojan
Post by: mihail on September 13, 2003, 05:09:59 PM

I could not load the file install.exe to kaspersky.
Norton on-line scan found this:
C:\Documents and Settings\Mile\Local Settings\Temporary Internet Files\Content.IE5\O1EFOXMB\Count[1].class is infected with Trojan.ByteVerify  
C:\Documents and Settings\Mile\Local Settings\Temporary Internet Files\Content.IE5\O1EFOXMB\Count[1].htm is infected with Java.Nocheat  
C:\Documents and Settings\Mile\Local Settings\Temporary Internet Files\Content.IE5\AQJNYUG2\easydates[1].exe is infected with Downloader.Trojan  
D:\Kompilacija 9-snimeni\Razno\eicar.com is infected with EICAR Test String  
D:\My Downloads\install.exe\install.exe is infected with IRC Trojan  

My avast! home did not foun any of this but did found this:
Win32:Trojan-gen. {Other}  for C:\Recycled\Dc1.dll (istbar[1].dll)

Title: Re:irc trojan
Post by: raman on September 13, 2003, 07:46:03 PM

One thing you can do is to send it to virus@asw.cz and ask if it is a Virus or not. I do not mention an Email of Kaspersky, because we are here at  the Avast Forum and they will be able to tell you too! ;)

(Duck und weg) or (run and cover) LOL

Title: Re:irc trojan
Post by: mihail on September 15, 2003, 06:05:43 PM

Kaspersky's on-line virus scanner said it is not a virus. So did Trend's on-line scan. Why does only Nortron finds a virus inside? Is it something wrong with their antivirus program or what.
I've send the sample to the e-mail mentioned above. Waiting for answer. Thank you.

P.S I really want to know to whom should I trust!

Title: Re:irc trojan
Post by: raman on September 15, 2003, 06:42:49 PM

Please  say us what the Avast guy answer you!

BTW: You can delete all folders and files inside the Content.IE5 folder.

Title: Re:irc trojan
Post by: igor on September 15, 2003, 08:34:09 PM

mihail: Any antivirus program can give you a false alarm sometimes... (I'm not saying it is one, maybe it's just a rare file the other AV companies don't have or don't consider dangerous... but it's possible).

Title: Re:irc trojan
Post by: YaBB on September 16, 2003, 05:14:19 PM

So you have scanned it with trendmicro, kaspersky and avast and found nothing? Have you noticed an abnormal behaviour from your computer? Sounds like a false alarm but good job sending it in.

Title: Re:irc trojan
Post by: mihail on September 18, 2003, 03:28:25 PM

Thank you everybody for your help.
I've sent the file to Kaspersky's lab and they answered me that it is far from being a virus.
I think this file is mistakenly taken as a virus by the Norton's AV. Since no other AV scanner did  recognized it as a virus I would suggest everyone to use additional check like the on-line scanners from kaspersky and trend to be certain that something is a virus if nothing weird is happening on your computer.
Thanks again.

Title: Re:irc trojan
Post by: whocares on September 18, 2003, 03:59:28 PM

then you should send it in to norton with an explanation of the false alarm hypothesis