js/Tivso.14a.gen trojan

What is this. Just popped up on my screen this morning. I had not been to any internet sites this morning. Just booted up sys and this came on screen.

Thanks for your help with this

 

Hi !

Well , this is a security threat (Java Script Trojan horse) , detected by NOD32 . It will be good idea to perform full scan of the computer . It is detected so don't worry - you are secure.

By the way , I noticed detection for JS/Tivso was updated todays so perhaps that's the reason you see it now , it was present for a while on your computer , detected today

 

I had this too while browsing on www.heise.de.
Seems it is a false positive. No i am blocking cookies from serving-sys.com and the "thread" seems to have disappeared.

 

My wife plays spades on Yahoo games and this has popped up twice.Time Module Object Name Threat Action User Information
6/30/2007 12:02:48 PM IMON archive http://yahoo.serving-sys.com//yahoo.eyeblaster.com/PL_yahoo/BigScripts/ebBannerMain_62_36.js JS/Tivso.14a.gen trojan Connection terminated

 

It is either a real threat or a false-positive but must first be checked .
Here is what I got from VT:

Complete scanning result of "ebBannerMain_62_36_1_.js", received in VirusTotal at 06.30.2007, 18:19:58 (CET).

EC edit: Removed virus total results. Please read our TOS.

(Sorry for the scan results , Mods , just for diagnostic )

 

Showing up (ebBannerMain_62_36_1_.js) on the At&T Yahoo! Mail home page as well. 5 hits since yesterday...

 

just got one at:

extremetech.com/article2/0,1697,2151961,00.asp

 

I just got it from the home page of PC world
ebBannerMain_62_36_1_.js, JS/Tivso.14a.gen trojan

 

I get no warning with v2365 on AT&T yahoo mail , nor on the other Yahoo mail . I also have no problems on PCWorld's web-page www.pcworld.com . No warning on http://www.extremetech.com/article2/0,1697,2151961,00.asp , too

Still warnings on http://yahoo.serving-sys.com//yahoo.eyeblaster.com/PL_yahoo/BigScripts/ebBannerMain_62_36.js . No warning on the main http://www.heise.de/ page ... Are we talking about the same thing ?

EDIT : After futher browsing within PC-world's site I started getting the alarms Sorry

 

This is coming up constantly for me. Based on all of the other posts, I have to believe this is some kind of false positive.

Bottom line - HOW do we get this nuisance to stop?

Thanks...

Andy

 

My inbox just got filled with loads of alerts from client PCs I'm monitoring about this false positive!!

 

It appears to be a FP, now fixed.

 

"Now fixed"? Who/how/where/when?

 

The bug was in virus signature database version 2365 (20070630). It was corrected in version 2366 (20070701).

A minute before updating to the new version, I received the NOD32 warning when visiting this page:

http://www.pcworld.com/product/specs/id,27915-c,monitors/specs.html

A minute later, after updating, no NOD32 warning appeared when I visited the same page.

 

Got it. Thanks!

 

Looks like signature version 2366 fixes it for me as well. Thanks Eset for the quick response.

 

Hi to all,

Actually, there is an explanation about this issue on eset blog on this link: http://www.eset.com/threat-center/blog/index.php

It's now fixed.

Best regards!

 

"It Looked Like a Duck. It Walked Like a Duck. It Quacked Like a Duck…"

Very nice and funny

 

Yes, great blog entry, and this issue is a message to always keep antivirus software updated.