Results 1 to 5 of 5

Thread: Virus or False Positive? Help

  1. #1
    imtheslaw Guest

    Default Virus or False Positive? Help

    I tried to view full episodes at Fox.com and has halted in both IE7 and Firefox by ZoneAlarm detection and quarantining of a file.

    The message in Firefox is:
    Trojan-Downloader.JS.Agent.dkt was found in C:\Documents and Settings\Steve\Local Settings\Application Data\Mozilla\Firefox\Profiles\ft39q93r.default\Cac he\066742AFd01 on 1/28/2009 19:45:28

    IN IE:
    C:\Documents and Settings\Steve\Local Settings\Temporary Internet Files\Content.IE5\YJ50SING\firebug(1).js

    When I click on More Info, ZoneAlarm says it doesn't have info.

    I can't find this file or the one in IE to zip and send to find out if it is a virus.

    What do I do?

    thanks

    Steve

    Operating System:Windows XP Pro
    Software Version:8.0
    Product Name:ZoneAlarm Internet Security Suite

  2. #2
    thoaar Guest

    Default Re: Virus or False Positive? Help

    I have the same issue with the exact same file from attempting to view full episodes from both ABC and Fox on my systems too. ABC and Fox both use movenetworks.com to stream the video.

    The file getting flagged, firebug(1).js, designed to provide firebug functionality into non-Firefox browsers. Look up firebug if you want to know more about what it does and how it is used.

    The firebug(1).js that is getting quarantined doesn't look anything like the firebug-lite touted as the release version (1.2.1 2008-09). The comments in the firebug(1).js indicate it might be a 2007/03/13 version or tweaked variant of the 2007/03/13 version, which based on the comments in the firebug(1).js it might be a partial-functionality version.

    I realize this doesn't resolve the problem, but it points a finger at what is involved. I'm guessing either something changed at movenetworks.com involved with the episode streaming, or a trojan definition recently added to or changed in the kaspersky engine's definitions is flagging this old firebug javascript file as a trojan or trojan-delivery vector.

  3. #3
    kmyelin Guest

    Default Re: Virus or False Positive? Help

    Same problem here. For anyone else anxious to watch, say, Lost before this gets fixed, and assuming, as I do, that this is a false positive: I was able to get into the video player by removing the file from quarantine, shutting down ZA for a few seconds to start the player, and then restarting ZA. Once the player's launched it continues just fine even with ZA active.

  4. #4
    thoaar Guest

    Default Re: Virus or False Positive? Help

    Good news -- I had my ZA update its antivirus/spyware definitions this morning, then took the Trojan-Downloader.JS.Agent.dkt out of quarantine. ZA did not put it back in quarantine when I tried to access the file (via open file in notepad) and the viewer at ABC loads up just fine now. I'm assuming Fox's viewer will too.
    So just update your definitions, release just this particular entry from quarantine, and all should be well.

    ZA/Kaspersky is on the ball

  5. #5
    Join Date
    Jun 2006
    Location
    The 3rd Coast - South Central Texas
    Posts
    10,465

    Default Re: Virus or False Positive? Help


    <BLOCKQUOTE><HR>thoaar wrote:
    Good news -- IZA/Kaspersky is on the ball
    <HR></BLOCKQUOTE>We now have a new method to report undetected and false possitives with viruses and spyware with Kaspersky.

    You can first scan your suspected file using the Kaspersky online file scanner. http://www.kaspersky.be/en/services/filescanner

    If you wish to email Kaspersky your suspected spyware/virus file please send to: virus@kaspersky.nl
    GeorgeV
    ZoneAlarm® Extreme Security


    Click here for ZA Support
    Monday-Saturday__ 6am to 10pm Central time
    Closed Sundays and Holidays

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •