False Positive: www.americamagazine.org

Discussion in 'NOD32 version 2 Forum' started by markspiteri, May 11, 2005.

Thread Status:
Not open for further replies.
  1. markspiteri

    markspiteri Registered Member

    Joined:
    May 10, 2005
    Posts:
    6

    Attached Files:

  2. Stephanos G.

    Stephanos G. Registered Member

    Joined:
    Mar 29, 2005
    Posts:
    720
    Location:
    Cyprus
    Possible, but smt is trying to download. Strange case but possible false positive.
     
  3. DonKid

    DonKid Registered Member

    Joined:
    Jun 27, 2004
    Posts:
    566
    Location:
    S?o Paulo, Brazil
    Hi,

    I have tested this site and get the same alert.
    Let's wait for Eset's support.

    Best Regards,

    DonKid.
     
  4. yea

    yea Guest

    yep, same with <snip>, hope they fix this soon.


    edited to remove porn link as per our TOS - Detox
     
  5. i960

    i960 Guest

    I checked it out as well, and it does the same thing for me. At the top of the parasite.js file, it has this:

    // purpose: IE parasite detector (http://www.doxdesk.com/parasite/)
    // author: Andrew Clover (mailto:and@doxdesk.com)
    // version: release 2.8 (24-Jul-2004)
    // licence: use freely

    I checked out the code and that site. It looks legit, although stupid and completely unnessecary. I build websites for a living, and I would never put something like that on my website. Someone needs to let them know they are doing nothing to help their visitors, and causing problems for those with NOD32.
     
  6. rothko

    rothko Registered Member

    Joined:
    Jan 12, 2005
    Posts:
    579
    Location:
    UK
    i reported this to eset about 2-3 weeks ago, i was replied to asking for the file to be sent zipped up, which i did, but i havent heard back yet and the file is still recognised as above...i'm guessing they've just been very busy with the new release!
     
  7. RejZoR

    RejZoR Registered Member

    Joined:
    May 31, 2004
    Posts:
    6,426
    I just wonder why it's named parasite.js
    It's just screaming: "I'm malware,pick me!!!!"
    Although its probably a false positive...
     
  8. Gauthreau

    Gauthreau Guest

    Eset better get on the fp thing or they're going to lose their title with VB.

    Neil
     
  9. Jaska

    Jaska Registered Member

    Joined:
    May 7, 2004
    Posts:
    98
  10. Detox

    Detox Retired Moderator

    Joined:
    Feb 9, 2002
    Posts:
    8,507
    Location:
    Texas, USA
    LMAO that link showed me this


    muah hahahaha :ninja:

    On a more serious note, I really wouldn't touch a thing on that site.
     
  11. Happy Bytes

    Happy Bytes Guest

    We'll see... I take a look at it at work...
     
  12. duncantuna

    duncantuna Guest

    Funny, my college roommate works for that magazine, and I noticed the same NOD32 false positive a week ago, so emailled him and told him his webmaster needs to update the parasite.js script, or get rid of it entirely.

    If you go to the parasite.js author's website, they have the most up to date version of the script, which does NOT trigger a NOD32 false positive.
     
  13. tazdevl

    tazdevl Registered Member

    Joined:
    May 17, 2004
    Posts:
    837
    Location:
    AZ, USA
    Wow they need to upgrade their connection.
     
  14. bsilva

    bsilva Registered Member

    Joined:
    Mar 24, 2004
    Posts:
    238
    Location:
    MA, USA

    I agree... I can see why NOD32 is picking it up. If this was a site that is up to no good, I would like for something to pick it up.
     
  15. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Eggzactly! BTW, Andrew Clover is one of the most respected experts in the field of Spyware, adware, and other unsolicited software, and his site holds a wealth of information for the uninitiated and the pros alike.

    Others are using the script as well, but no problem there either. Here's another example:

    http://aumha.org/a/noads.php
     
Thread Status:
Not open for further replies.