Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Zonealarm Iss2007 Flags Win32.trojan.ntrootkit.115 False Positive?


  • Please log in to reply
2 replies to this topic

#1 Guest_RiceoRony_*

Guest_RiceoRony_*

  • Guests
  • OFFLINE
  •  

Posted 30 April 2008 - 08:15 AM

Hello all.

I sent this file in for inspection for ZA.

C:\SWTOOLS\apps\NORTONIS\US\Stub.exe

Size:
Stub.exe (521.6 kilobyte) - 534.12 kB


I used virustotal.com to inspect the file before quarantine, and it was only flagged by VBA32

Based on a half-dozen websites, the sizes of the file matches the above, and says it's apart of Norton IS 2007 and Norton 360 (where Norton IS2007 comes preloaded on the machine)

Kind of strange because this folder ("SWTOOLS") is basically just programs and drivers that come pre-installed on the computer when I reformat using the system-restore CDs provided by the manufacturer.

I just reformatted this new hard drive last week (04/19/2008), so it leads me to believe it's a false positive?

This is the 3rd time in the past year that i've had some sort of program flagged from that folder (Maybe ZA hates norton install files?)

BC AdBot (Login to Remove)

 


#2 tos226

tos226

    BleepIN--BleepOUT


  • Members
  • 1,574 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:LocalHost

Posted 30 April 2008 - 09:01 PM

Every firewall and AV, or almost every, hates the others.
Not to spite you, but to be able to work properly.
At issue is simply too many cooks in the kitchen trying to get at the same thing.
Driver conflicts abound. To be good, these applications have to use their own drivers at a very low level.

Have you used Norton removal tool before installing ZA?
http://www.bleepingcomputer.com/forums/t/34671/how-to-remove-your-norton-products/
If you used the already spoiled and bloated restore CD from the manufacturer, as you seem to indicate, then likely Norton got pushed in already. (Yes it's criminal of them to put in software you don't ask for, and even more criminal to leave stuff behind when you get rid of it, but what can you do?). Restore CDs don't even offer a reformat, just the quick format :thumbsup:

Some have claimed that the Norton stuff installed without your consent is actually a rootkit, in which case ZA's Kaspersky AV (within ZA-pro and suite) is doing a good job.
Removal is very difficult. I don't know the details.

What do you mean "it was flagged by VBA32" what is VBA32?

#3 Guest_RiceoRony_*

Guest_RiceoRony_*

  • Guests
  • OFFLINE
  •  

Posted 01 May 2008 - 07:53 AM

Thanks for the response!

VBA32 is another antivirus vendor (http://www.anti-virus.by/en/)

virustotal.com uses definitions from 32 other vendors so that you can inspect each file individually to see whether the file is a FP or a real threat.

You're right, I do kind of hate how there are SO many programs that come prepackaged in the system restore cd's (which are basically images of versions of your laptop if I learned correct).

Doing a reformat using the system restore cd's --> takes up 1/4th of the HD
Doing a reformat using vista OS cd --> takes up 1/10th of the HD

AMAZING!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users