Loads of "Trojan Horse" detections

[Vargar]

Since my clients either got on the 6/22 or 6/23 dat files, I have noticed a huge jump in detections on web sites. All it ever labels the threat as is "Trojan Horse".

Is anybody else seeing this? and do you know if Symantec has expanded their dat to look for new types of threats?

Thanks,
Ned

 

[quell]

We have had a few pc's do the same thing here yesterday. Employees would visit certain web sites and an av warning would pop up. Could not clean, quarentee, delete etc.. After further search on symantec's site it mentioned there was nothing you could do to remeove this because the infection was at the site you visited. Funny thing was that I visited those sites via another pc and nothing happened. Might have been some faulty dat's or something. dunno

 

[Vargar]

I was able to duplicate this issue by going to

http://www.legendmicro.com

and clicking on the rebates center.

I'm still getting other users that are getting the same issues on other sites. It almost seems like SAV is picking up threats that it used to let go.


hmmmmm...

 

[Davetoo]

I found a story this morning on Foxnews that there's a new virus threat out that attacks IIS and tries to plant software on a users computer that visits an infected website. Haven't found anything beyond that story so far.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[Vargar]

Thanks for the tip on Fox. I'll look around.

 

[FaiTHLeSS]

Its happening because of un-patched IIS5 machines which includes 2000 and XP pre SP2. Which have not installed this update

http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Its allow for an attacker to download files to the webserver, some IT admins are finding strange dlls on their servers located in \winnt\system32\inetsrv .

Within the dlls in some javascript which points to a russain site which is still known to be live at this time, it then downloads malware to the person computer this is why you are picking up an increase in trojan dections on your network.

Its only some sites this is happening on not all.

Heres a link to MS site about it:

http://www.microsoft.com/security/incident/download_ject.mspx

 

[quell]

http://zdnet.com.com/2100-1105_2-5247187.html