Author Topic: Trojano-169 in .xpi-File  (Read 2592 times)

0 Members and 1 Guest are viewing this topic.

Offline Sgt.Schumann

  • Jr. Member
  • **
  • Posts: 72
  • Men of the '303'
Trojano-169 in .xpi-File
« on: June 23, 2004, 07:56:38 PM »
Surfing in the Web with Mozilla (1.7, software installation disabled) a download-dialog appeared when entering a web page:
"sbc_netscape.xpi"

I knew this is propably a bad guy, downloaded it on my hard-disk --> no alarm.  Scanning the file with right-click and "scan with avast" said, that this guy is a "Trojano-169".

Of course no alarm with on-access-scanner, i thought, because ".xpi" is not an extension listed in the standard shield. So I added XPI as additional extension, but no effect. I can download the guy again and again ... no alarm.

Kaspersky-Online-Scanner says:

* Zu ├╝berpr├╝fende Datei:   sbc_netscape.xpi
* sbc_netscape.xpi Archive: ZIP
* sbc_netscape.xpi/install.js Ok
* sbc_netscape.xpi/sbc_netscape.exe Infiziert: TrojanSpy.Win32.Briss.h

How could I make AVAST! detecting this guy upon download?

I am using AVAST! Home (4.1.418, VDB 0426-0, WinXP)
 ???
« Last Edit: June 23, 2004, 09:00:55 PM by Sgt.Schumann »

Offline Stephan123

  • Full Member
  • ***
  • Posts: 179
  • I am the virus reporter
Re:Trojano-169 in .xpi-File
« Reply #1 on: June 23, 2004, 07:59:50 PM »
set it into the chest of Avast and email it to Alwil software ;)

Offline Sgt.Schumann

  • Jr. Member
  • **
  • Posts: 72
  • Men of the '303'
Re:Trojano-169 in .xpi-File
« Reply #2 on: June 23, 2004, 08:08:59 PM »
Sorry, I had a mistake in my post.

The "on-demand"-Scanner of AVAST! found it, but not the "on-access". I modified it now in the original post.
« Last Edit: June 23, 2004, 09:01:29 PM by Sgt.Schumann »

Offline Sgt.Schumann

  • Jr. Member
  • **
  • Posts: 72
  • Men of the '303'
Re:Trojano-169 in .xpi-File
« Reply #3 on: June 23, 2004, 08:26:47 PM »
I have send this file in a password-protected zip to the avast!-Team ...