Wireshark-users: Re: [Wireshark-users] Symantec claims there is a trojan

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Mon, 03 Jul 2006 11:16:31 -0500

Symantec hasn't been very helpful so far.  They keep telling me to "run
a full system scan to remove the trojan."

Gerald Combs wrote:
> Oleg wrote:
>> Just wanted to inform that newest SAVC 10.1 definitions (07.01) are 
>> claiming there is a Trojan.Zlob in windows installer (from sf.net). I 
>> know it's a false (a lot of problems with SAVC defs lately), just 
>> wanted to inform.
> 
> Anyone with 0.99.1pre1 installed is advised to check their system
> against the list of actions in the "Technical Details" section at
> 
> http://securityresponse.symantec.com/avcenter/venc/data/trojan.zlob.html
> 
> I checked the machine that built the 0.99.1pre1 Windows installer, and
> items 1 through 5 are NOT present.  I'm not sure how to verify item 6,
> and a capture hasn't turned up any of the HTTP connections in item 7
> (although it's only been running a few minutes).
> 
> So far it looks like a false positive.
>