 Zonealarm Iss2007 Flags Win32.trojan.ntrootkit.115 False Positive?, Only VBA32 on virustotal confirms (1:32 engines) |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.  |
| RiceoRony |
 Apr 30 2008, 08:15 AM
Post
#1
|
|
Guests  |
I sent this file in for inspection for ZA. C:\SWTOOLS\apps\NORTONIS\US\Stub.exe Size: Stub.exe (521.6 kilobyte) - 534.12 kB I used virustotal.com to inspect the file before quarantine, and it was only flagged by VBA32 Based on a half-dozen websites, the sizes of the file matches the above, and says it's apart of Norton IS 2007 and Norton 360 (where Norton IS2007 comes preloaded on the machine) Kind of strange because this folder ("SWTOOLS") is basically just programs and drivers that come pre-installed on the computer when I reformat using the system-restore CDs provided by the manufacturer. I just reformatted this new hard drive last week (04/19/2008), so it leads me to believe it's a false positive? This is the 3rd time in the past year that i've had some sort of program flagged from that folder (Maybe ZA hates norton install files?) |
 |
 
|
|
Apr 30 2008, 09:01 PM
Post
#2
|
|
|
Distinguished Member  Group: Members Posts: 956 Joined: 21-October 04 Member No.: 3,911 |
Every firewall and AV, or almost every, hates the others.
Not to spite you, but to be able to work properly. At issue is simply too many cooks in the kitchen trying to get at the same thing. Driver conflicts abound. To be good, these applications have to use their own drivers at a very low level. Have you used Norton removal tool before installing ZA? http://www.bleepingcomputer.com/forums/topic34671.html If you used the already spoiled and bloated restore CD from the manufacturer, as you seem to indicate, then likely Norton got pushed in already. (Yes it's criminal of them to put in software you don't ask for, and even more criminal to leave stuff behind when you get rid of it, but what can you do?). Restore CDs don't even offer a reformat, just the quick format  Some have claimed that the Norton stuff installed without your consent is actually a rootkit, in which case ZA's Kaspersky AV (within ZA-pro and suite) is doing a good job. Removal is very difficult. I don't know the details. What do you mean "it was flagged by VBA32" what is VBA32? |
|
|
|
| RiceoRony |
May 1 2008, 07:53 AM
Post
#3
|
|
Guests |
Thanks for the response!
VBA32 is another antivirus vendor (http://www.anti-virus.by/en/) virustotal.com uses definitions from 32 other vendors so that you can inspect each file individually to see whether the file is a FP or a real threat. You're right, I do kind of hate how there are SO many programs that come prepackaged in the system restore cd's (which are basically images of versions of your laptop if I learned correct). Doing a reformat using the system restore cd's --> takes up 1/4th of the HD Doing a reformat using vista OS cd --> takes up 1/10th of the HD AMAZING! |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 11th October 2008 - 01:03 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.