Trojan.Zlob in Filezilla 2_2_25_setup.exe

Message

Haijin · #1 Post by **Haijin** » 2006-07-01 15:11

Norton virus detected that virus in the uninstall.exe of Filezilla 2.2.25.
I run antivirus on install file and it was find here too.
Anybody have same trouble?
I downloaded my version on the Japanese mirror (Ishikawa, Japan) from sourceforge.

#2 Post by **botg** » 2006-07-01 21:43

All files get scanned for viruses before uploading. This is likely a false alarm. Please check the results using a scanner from a different vendor.

TheAngryPenguin · #3 Post by **TheAngryPenguin** » 2006-07-01 23:36

VirusTotal is a very good resource.

Haijin · #4 Post by **Haijin** » 2006-07-02 02:24

I scan the file with VirusTotal,
And only Symantec find a Trojan.
But that doesn't mean there is no Trojan.
It can be new one...
Anyway, on Filezilla 2.2.24a, Norton Antivirus didn't find any trojan or virus.
So I guess something has changed in uninstall file... And I wonder why.

Also the trouble is, I'm using Norton Internet Security 2006 and it removes the file as soon as it finds a virus without prompts me before.
So I had to deactivate it for download the file again.

Antivirus Version Update Result
AntiVir 6.35.0.19 07.01.2006 no virus found
Authentium 4.93.8 06.30.2006 no virus found
Avast 4.7.844.0 06.29.2006 no virus found
AVG 386 06.30.2006 no virus found
BitDefender 7.2 07.02.2006 no virus found
CAT-QuickHeal 8.00 07.01.2006 no virus found
ClamAV devel-20060426 07.01.2006 no virus found
DrWeb 4.33 07.01.2006 no virus found
eTrust-InoculateIT 23.72.55 07.01.2006 no virus found
eTrust-Vet 12.6.2283 06.30.2006 no virus found
Ewido 3.5 07.01.2006 no virus found
Fortinet 2.77.0.0 07.01.2006 no virus found
F-Prot 3.16f 06.30.2006 no virus found
Ikarus 0.2.65.0 06.30.2006 no virus found
Kaspersky 4.0.2.24 07.02.2006 no virus found
McAfee 4797 06.30.2006 no virus found
Microsoft 1.1481 07.01.2006 no virus found
NOD32v2 1.1636 07.01.2006 no virus found
Norman 5.90.21 06.30.2006 no virus found
Panda 9.0.0.4 07.01.2006 no virus found
Sophos 4.07.0 06.30.2006 no virus found
Symantec 8.0 07.02.2006 Trojan.Zlob
TheHacker 5.9.8.167 06.30.2006 no virus found
UNA 1.83 06.30.2006 no virus found
VBA32 3.11.0 06.30.2006 no virus found
VirusBuster 4.3.7:9 07.01.2006 no virus found

Aditional Information
File size: 3489238 bytes
MD5: b651e0ab520ab381ff57a79427f07a44
SHA1: abea02276b05a3f8c957fb3a4698bd65fe2f5f6f

jetwhiz · #5 Post by **jetwhiz** » 2006-07-03 06:42

I'm having the same problem ... I want to update to .25 but I can't even download the file before Norton trashes it. I'm not sure if I even want to download it until I'm sure that it's completely safe to do so ... Why does the new version get caught by norton and all other versions worked fine?

tijgetje · #6 Post by **tijgetje** » 2006-07-03 08:16

Same here,

Seems only to happen with the .exe file though.

The zip download is clean according to Symantec.

Maybe something in the uninstaller?

TheAngryPenguin · #7 Post by **TheAngryPenguin** » 2006-07-05 03:32

FYI, the ISC has confirmed that this is a false positive with Symantec's virus definitions -- they seem to be wrongly accusing NSIS of the infection. To add insult to injury, they've also recently tagged cmdow as malicious.

Also, this seems to be a really good resource regarding false positives and NSIS.