Author Topic: VBS:Zulu at MicroSoft.Com??  (Read 15013 times)

0 Members and 1 Guest are viewing this topic.

SteveO29

  • Guest
VBS:Zulu at MicroSoft.Com??
« on: October 08, 2006, 05:29:38 AM »
Hello,

Today I was browsing the net for some themes for Windows XP. I went to Google and did a search for " "windows xp" skins ".

One of the results was "Windows XP Themes, Skins, and Screensavers" and the URL was:

"http://www.microsoft.com/windowsxp/downloads/desktop/default.mspx"

As soon as I clicked on the link.. my webshield went off. I was really surprised since I do a ~lot~ of surfing and this was the FIRST time it's gone off. The alert said:

Sign of "VBS:Zulu" has been found in "http://rad.microsoft.com/ADSAdClient31.dll?GetAd=&PG=CMSDLO&SC=F3&AP=1164"

So.. I clicked "Abort Connection", which I ~assume~ is what I'm supposed to do. So, I guess no harm done.. correct?

But I just find it strange that out of all the websites I visit daily.. I encounter something like this on a ~MicroSoft~ site.

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you
Re: VBS:Zulu at MicroSoft.Com??
« Reply #1 on: October 08, 2006, 06:02:40 AM »
If you aborted connection, nothing should have been downloaded.

Interesting that there is another thread with reporting this detection. I don't know how you would check it on an online scanner as it shouldn't be on your computor( no file to submit ). There was a new vps today, so maybe it is pcking it up as a false positve.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86796
  • No support PMs thanks
Re: VBS:Zulu at MicroSoft.Com??
« Reply #2 on: October 08, 2006, 03:16:36 PM »
Also see this link http://forum.avast.com/index.php?topic=24059.0 same problem with MS pages and very likely to be a false positive. It would appear to be importing ads into the original page (see images on the above link) and that might be what avast is getting hot and bothered about.

You might want to break the links so they aren't active in the same way as the other topic.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

hlecter

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #3 on: October 08, 2006, 03:28:05 PM »
Posted by me and others 5 days ago.  :'(

http://forum.avast.com/index.php?topic=23939.0

Regards
hlecter

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: VBS:Zulu at MicroSoft.Com??
« Reply #4 on: October 08, 2006, 05:21:48 PM »
I've got the same message with the last VPS.
But Dr. Web says the site is clean and, in fact, I think it is...
The best things in life are free.

Jarmo P

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #5 on: October 09, 2006, 04:31:25 PM »
Avast still finds it in this web page:
http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx

Might need a few refreshes, but there you get an 'Abort Connection' with that nice fire brigade alarm, hehe.

Jarmo

EDIT
We should maybe use this web page instead eicar.org to know our antivirus is protecting us :P
« Last Edit: October 09, 2006, 04:49:16 PM by Jarmo P »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: VBS:Zulu at MicroSoft.Com??
« Reply #6 on: October 09, 2006, 05:03:37 PM »
Might need a few refreshes
This is very strange and annoying in my point of view.
Abort connection is not woking at the first time as it should.
Clicking the buttom, the connection seems not being aborted as the whole webpage is being loaded.
What's happening with WebShield? Seems not working as it should  :P :P
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 86796
  • No support PMs thanks
Re: VBS:Zulu at MicroSoft.Com??
« Reply #7 on: October 09, 2006, 05:18:30 PM »
Web shield only blocks the insertion of the script that imports the advert not the whole page. There is a script on the pages for webtrends.com and this is what is being blocked. See the images I have posted in the other topic http://forum.avast.com/index.php?topic=24059.0.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

DaveD

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #8 on: October 09, 2006, 05:23:25 PM »
Over the last week or so I have been reading so much about this false positive on Microsoft pages. There are at least 3 different threads here, possibly 4. I saw a few threads on this over at DSL Reports forum as well.

What I'm wondering is...
...why no comment from Alwil team?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: VBS:Zulu at MicroSoft.Com??
« Reply #9 on: October 09, 2006, 05:37:48 PM »
What I'm wondering is... ...why no comment from Alwil team?
Me too  :'(
The best things in life are free.

hlecter

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #10 on: October 09, 2006, 08:51:13 PM »
Me too.  :)

Many users get upset, and perhaps not even understand what happened.

We cant expect users to come here to find out about this.


Offline XMAS

  • Avast translator
  • Super Poster
  • ***
  • Posts: 1211
  • Santa is watching you ;)
    • avast! in Bulgarian
Re: VBS:Zulu at MicroSoft.Com??
« Reply #11 on: October 09, 2006, 10:30:28 PM »
hello to all :)
A few hours ago I was receiving the same warning, now all the pages are loading correctly without any warning ???
any comments   ::)
there was no VPS update recently, so then MS fixed something  ::)
You've Got To Get Close To The Flame To See What It's Made Of...

hlecter

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #12 on: October 09, 2006, 10:54:35 PM »
hello to all :)
A few hours ago I was receiving the same warning, now all the pages are loading correctly without any warning ???
any comments   ::)
there was no VPS update recently, so then MS fixed something  ::)

I went there now with Opera 9.02.... NO warnings after several reloads :)

I went there with IE6....  WARNING without reloading at all :(

Indeed funny with "zulu" come and go.  ;D

testy

  • Guest
Re: VBS:Zulu at MicroSoft.Com??
« Reply #13 on: October 09, 2006, 11:51:55 PM »
I had a Zulu warning at a Microsoft website two days ago.  I was a little surprised.