Symantec hasn't been very helpful so far. They keep telling me to "run
a full system scan to remove the trojan."
Gerald Combs wrote:
> Oleg wrote:
>> Just wanted to inform that newest SAVC 10.1 definitions (07.01) are
>> claiming there is a Trojan.Zlob in windows installer (from sf.net). I
>> know it's a false (a lot of problems with SAVC defs lately), just
>> wanted to inform.
>
> Anyone with 0.99.1pre1 installed is advised to check their system
> against the list of actions in the "Technical Details" section at
>
> http://securityresponse.symantec.com/avcenter/venc/data/trojan.zlob.html
>
> I checked the machine that built the 0.99.1pre1 Windows installer, and
> items 1 through 5 are NOT present. I'm not sure how to verify item 6,
> and a capture hasn't turned up any of the HTTP connections in item 7
> (although it's only been running a few minutes).
>
> So far it looks like a false positive.
>