False virus warning in javascript.

Discussion in 'NOD32 version 2 Forum' started by 3r1c, Feb 21, 2007.

Thread Status:
Not open for further replies.
  1. 3r1c

    3r1c Registered Member

    Joined:
    Feb 21, 2007
    Posts:
    3
    Hello.

    I am a webmaster of a website which uses the advertising company paypopup.com to make money.

    They show popup ad when someone visits the page.

    But i have gotten reports that nod32 is detecting the javascript popup code as a virus.

    If you ar blocking popups can you please show an alert that a popup was blocked NOT THAT IT CONTAINS A VIRUS!!

    This is making me look bad when its your broken software that is the problem.

    The link that shows the virus warning is.

    http://www.paypopup.com/popup.php?id=x&pop=enter&t=0&subid=63382&blk=1
     
    Last edited by a moderator: Feb 21, 2007
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    As a virus or a TrojanClicker.Agent.A trojan ?

    Also....would you mind saying which site you are a Webmaster of....Kelly Clarkson perhaps ?
     
  3. sir_carew

    sir_carew Registered Member

    Joined:
    Sep 2, 2003
    Posts:
    884
    Location:
    Santiago, Chile
    Hello,
    I got your file and I submitted the file in question to Virustotal in order to see if NOD32 is the only AV that is detecting this file.
    NOD32 is detecting this code as Trojan Clicker, in others words, Trojan that are used to click certains links in order to get more public or things like that.
    What's the purpose of your code?

    Off topic: I know that post Virustotal results is against Wilders rules, but I think that in this case, it's correct. If I'm wrong, please delete the results.


    Complete scanning result of "popup_1_.htm", received in VirusTotal at 02.22.2007, 01:00:56 (CET).

    Antivirus Version Update Result
    AntiVir 7.3.1.37 02.21.2007 EXP/Agent.B
    Authentium 4.93.8 02.21.2007 JS/ForcePopup@troj
    Avast 4.7.936.0 02.21.2007 no virus found
    AVG 386 02.21.2007 no virus found
    BitDefender 7.2 02.22.2007 Trojan.Clicker.AC
    CAT-QuickHeal 9.00 02.21.2007 no virus found
    ClamAV devel-20060426 02.21.2007 Trojan.Clicker.HTML.Agent
    DrWeb 4.33 02.21.2007 no virus found
    eSafe 7.0.14.0 02.21.2007 no virus found
    eTrust-Vet 30.4.3417 02.21.2007 no virus found
    Ewido 4.0 02.21.2007 no virus found
    FileAdvisor 1 02.22.2007 no virus found
    Fortinet 2.85.0.0 02.21.2007 no virus found
    F-Prot 4.2.1.29 02.21.2007 JS/ForcePopup@t
    F-Secure 6.70.13030.0 02.21.2007 JS/ForcePopup@troj
    Ikarus T3.1.0.31 02.21.2007 Trojan-Downloader.JS.IstBar.AI
    Kaspersky 4.0.2.24 02.22.2007 no virus found
    McAfee 4968 02.21.2007 no virus found
    Microsoft 1.2204 02.21.2007 no virus found
    NOD32v2 2074 02.21.2007 HTML/TrojanClicker.Agent.A
    Norman 5.80.02 02.21.2007 no virus found
    Panda 9.0.0.4 02.21.2007 no virus found
    Prevx1 V2 02.22.2007 no virus found
    Sophos 4.14.0 02.21.2007 no virus found
    Sunbelt 2.2.907.0 02.17.2007 no virus found
    Symantec 10 02.22.2007 no virus found
    TheHacker 6.1.6.062 02.21.2007 no virus found
    UNA 1.83 02.21.2007 TrojanClicker.HTML.Agent
    VBA32 3.11.2 02.21.2007 no virus found
    VirusBuster 4.3.19:9 02.21.2007 no virus found

    Aditional Information
    File size: 21993 bytes
    MD5: 6d2631a2edeef61d48f9a8febde1bae7
    SHA1: 7c431c4cf64a9926ca977ea67b9edd1837779500

     
  4. 3r1c

    3r1c Registered Member

    Joined:
    Feb 21, 2007
    Posts:
    3
    I am a programmer i have looked at the code and it is NOT a trojan.
    Its just normal javascript code.

    Its not an installation, it does not install anything.
    All it does is make a popup window.
     
  5. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    I hate pop ups. It,s trojan or not, it,s good that soem AVs dertect it as badware.
     
  6. 3r1c

    3r1c Registered Member

    Joined:
    Feb 21, 2007
    Posts:
    3
    Then it should say a popup was blocked.
    It should NOT say there was a virus/trojan.
     
  7. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,047
    Location:
    Saudi Arabia/ Pakistan
    Do u say all what u do by ur popups?
    Do u ask permission to display pop ups?
    Tit for tat. Ok?
     
  8. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    The appropriate channel for this is NOT the NOD32 Support Forum, it is direct discussions with ESET. A starting point would be to email support @ eset.com
     
Thread Status:
Not open for further replies.