Wireshark-users: Re: [Wireshark-users] Symantec claims there is a trojan

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Mon, 03 Jul 2006 10:08:13 -0500

Oleg wrote:
> Just wanted to inform that newest SAVC 10.1 definitions (07.01) are 
> claiming there is a Trojan.Zlob in windows installer (from sf.net). I 
> know it's a false (a lot of problems with SAVC defs lately), just 
> wanted to inform.

Anyone with 0.99.1pre1 installed is advised to check their system
against the list of actions in the "Technical Details" section at

http://securityresponse.symantec.com/avcenter/venc/data/trojan.zlob.html

I checked the machine that built the 0.99.1pre1 Windows installer, and
items 1 through 5 are NOT present.  I'm not sure how to verify item 6,
and a capture hasn't turned up any of the HTTP connections in item 7
(although it's only been running a few minutes).

So far it looks like a false positive.