Trojans??

[wtf]

Are these valid?
virustotal.com
SHA256: 0ce272426a52a250714b666f9955410b73a86249e1dbe14c4471ba76445310ea
File name: tumblrimagedownloader_setup_v1.006.exe
Detection ratio: 3 / 48
Analysis date: 2014-01-05 02:01:24 UTC
AntiVir PCK/MSIL.Confuser 20140104
Jiangmin Trojan/Blocker.ndx 20140104
Symantec WS.Reputation.1 20140104

[martin@rootjazz]

No

I did a quick search

Symantec WS.Reputation.1 20140104 - is nothing
http://www.symantec.com/security_respon ... 08-1854-99

The others I couldn't find anything out about them apart from fake sites offering to fix it without being able to explain what it is.

[Trevor]

Hi Martin.

My Windows Security Essentials just removed Tumbling Jazz .exe from my computer, saying it's a Trojan. It wouldn't let me reinstall. I've emailed you the details (amongst other things).

Could the bot have been compromised?

The detected item is:

http://www.microsoft.com/security/porta ... 0362#tab=2

Thanks

[bardend21]

I am having the same problem as Trevor.

[martin@rootjazz]

They are false positives.

All AV programs work using heuristics, basically looking for patterns in the code that *MIGHT* be a virus. It is like saying a man who goes and buys a cooking knife is going to murder someone because they bought a knife, although the fact is they are going to chop some onions.


I will contact the AV vendors, please let me know the products you are using. Then it is up to them to fix their mistakes, some are quick / some are not.

Or you can just whitelist the program through your AV

[bardend21]

Thanks, I am using Microsoft Security Essentials.

[Trevor]

Yeah - Microsoft Security Essentials as well.

I just bypassed it by going to 'Microsoft Security Essentials' and clicking on 'History' then finding the detected item (Tojan:Win32/Gheugent.A!plock) and checking the check box then clicking the 'restore' button.

It's working now.

[martin@rootjazz]

Still nothing back from MS (not surprising). Not much can be done apart from wait (or whitelist as mentioned above).

Sometimes I wish I could treat support in such contempt when my errors effect the running of others' businesses. But alas, I am not a multi billion company.......