Text 161, 103 rader
Skriven 2006-10-05 22:33:24 av Janis Kracht (1:261/38)
    Kommentar till text 160 av Mark Lewis (1:3634/12.0)
Ärende: NETF096.ZIP
===================
Hi Mark,

>> This file has two suspicious files in it, so it's been removed from
>> distribution (thanks for the report, Vince :) )  I've contacted the
>> author and asked him to check his system, and send me another copy
>> :)

>the author uploads his netfossil releases directly to my system... i've not ha
> any false positives indicated... as a double check, i just extracted his
> uploaded version of netf096.zip across my lan and my up to date avast scanner
>didn't fuss... i ran a scan on that specific test folder and still turned up a
> clean set...

That's the same report that the author gave me concerning the two files I
showed him.. we both knew that false positives happen on occaison.

>> Normally I wouldn't be so concerned with a 'suspicious' file as I
>> know various checkers can get false positives, but two files
>> bothered me a bit :)

> which two files?

====== vince's report, same here on my system ==========

Virus scanning report  -  4 October 2006 @ 18:51

F-PROT ANTIVIRUS
Program version: 4.6.6
Engine version: 3.16.14

VIRUS SIGNATURE FILES
SIGN.DEF created 2 October 2006
SIGN2.DEF created 3 October 2006
MACRO.DEF created 3 October 2006

Search: FILE_ID.DIZ FOSSIL.CHT FOSSIL.TXT NET2BBS.EXE NET2BBS.INI NETCOM.EXE
NETFOSS.COM NETFOSS.DLL NETFOSS.TXT NF.BAT NFELEBBS.TXT UPGRADE.TXT Action:
Report only
Files: "Dumb" scan of all files
Switches: -ARCHIVE -PACKED -SERVER

/opt/mbse/var/badtic/a/NET2BBS.EXE->(UPX)  Infection: Possibly a new variant
of W32/Threat-HLLSI-based!Maximus
/opt/mbse/var/badtic/a/NETCOM.EXE->(UPX)  Infection: Possibly a new variant of
W32/Threat-HLLSI-based!Maximus

Results of virus scanning:

Files: 12
MBRs: 0
Boot sectors: 0
Objects scanned: 12
Infected: 0
Suspicious: 2
Disinfected: 0
Deleted: 0
Renamed: 0

Time: 0:00
=== Cut ===

When I emailed Mike about it, here's what he said:

> Hi Janis,

> I installed F-Prot here, and I see the same results, not only with  NetFoss
> 0.9.6 but also with every previous version it flags the NETCOM.EXE as
> suspicious. (NET2BBS.EXE is new to 0.9.6)

>Note that it's simply saying the files are suspicious, and could be a possible
>new variant of an existing threat.  I suspect it sees that both files are doin
> Winsock communications using ASM which is why it flags them.

> NETCOM.EXE is a telnet communication engine.
> NET2BBS.EXE is a telnet server.

>I can assure you 100% that neither file contains any spyware/adware/trojans or
> backdoors of any sort.

> While I have never used F-Prot before, I scanned the same files using the
> following
> Virus and adware scanners:

> Norton Antivirus
> NOD32 Antivirus
> AVG Antivirus
> Avast Antivirus
> Ewido Antivirus
> Housecall Antivirus/AntiSpyware
> SpyBot Anti-Spyware
> AdAware Anti-Adware

> NETF096.ZIP gets a clean result using all of the above.


I've got another version now from Mike's system so I'll be sending that out
most likely tomorrow to replace the replacement file :)

Take care,
Janis

--- BBBS/LiI v4.01 Flag-5
 * Origin: Prism bbs (1:261/38)