TrojanDownloader.Shadraem.Atrojon

[avsoft]

Hello,
I have a weird one. This weekend, I was unable to launch a course from our web server - Nod32 quarantined several files and flagged them as Trojans. Here's a log entry:

4/26/2010 6:51:11 PM HTTP filter file ~Link removed~ JS/TrojanDownloader.Shadraem.A trojan connection terminated - quarantined AVSOFT3\k_halat Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

I tried the same site using a computer that has a current subscription to Nod32 and the problem was the same. So, I went into the server and ran a malware detection program - the trojan was found and removed from the web server.

Now, the problem I have is on my laptop. Every time I go to the site, ESET Smart Security 4 keeps telling me that several files are being quanrantined. The problem is that I can't duplicate this on other computers that have Nod32 installed - it's only doing this on my machine. I went into the web server, and the problem is that the files that are being quarantined don't exist - they're mentioned in the .css file for the web site (~Link removed~ or .net), but they don't physically exist.

ESET Smart Security also flagged an swf file as being infected. We replaced it with the copy from the local server, and yet, Eset Smart Security keeps saying that the file is infected.

I cleared the internet cache. I've run a complete scan on my workstation and three suspicious files were removed, but they didn't have anything to do with this problem....

I'm stumped on this one - I'm not sure why ESET is flagging non-existent files as being Trojans... Any ideas?

Thanks,

Kim

[BFG]

Hi avsoft,

How about if you empty the cache or rebooting?

BFG

[avsoft]

Hi BFG,

well, did all that unless there's some sort of ESET cache that I don't know about. Installed the latest security updates on the workstation; ESET is brand new with a current definition....

I just rebooted and I'm still having the same problem...

Kim