Adobe CS3

Viruses and worms
1

Avast has marked Adobe CS3 AdobeXMPscript.dll as Win32:Vapsup-IL [trj]
Is this a false positive or is this really a trojen

This is the Virus total test result
2/36(5.56%)

Antivirus Version Last Update Result
AhnLab-V3 2008.7.29.1 2008.08.01 -
AntiVir 7.8.1.15 2008.08.01 -
Authentium 5.1.0.4 2008.08.01 -
Avast 4.8.1195.0 2008.08.01 Win32:Vapsup-IL
AVG 8.0.0.156 2008.08.01 -
BitDefender 7.2 2008.08.02 -
CAT-QuickHeal 9.50 2008.08.01 -
ClamAV 0.93.1 2008.08.02 -
DrWeb 4.44.0.09170 2008.08.01 -
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.6002 2008.08.02 -
Ewido 4.0 2008.08.01 -
F-Prot 4.4.4.56 2008.08.01 -
F-Secure 7.60.13501.0 2008.08.01 -
Fortinet 3.14.0.0 2008.08.01 -
GData 2.0.7306.1023 2008.08.02 Win32:Vapsup-IL
Ikarus T3.1.1.34.0 2008.08.02 -
K7AntiVirus 7.10.402 2008.08.01 -
Kaspersky 7.0.0.125 2008.08.02 -
McAfee 5352 2008.08.01 -
Microsoft 1.3704 2008.07.28 -
NOD32v2 3318 2008.08.01 -
Norman 5.80.02 2008.08.01 -
Panda 9.0.0.4 2008.08.02 -
PCTools 4.4.2.0 2008.08.01 -
Prevx1 V2 2008.08.02 -
Rising 20.55.42.00 2008.08.01 -
Sophos 4.31.0 2008.08.02 -
Sunbelt 3.1.1537.1 2008.08.01 -
Symantec 10 2008.08.02 -
TheHacker 6.2.96.391 2008.07.31 -
TrendMicro 8.700.0.1004 2008.08.01 -
VBA32 3.12.8.2 2008.08.01 -
ViRobot 2008.8.1.1321 2008.08.01 -
VirusBuster 4.5.11.0 2008.08.01 -
Webwasher-Gateway 6.6.2 2008.08.01 -

Thanks in advance

2

normally would look like a false positive

virus@avast.com? is the correct location the attached sample should be zipped and password protected (anything is fine) with the password in the body of the email.
Put possible false positive in the email subject along with any relevant information.

however googling shows that it is a real adware threat
avast should have caught it
did you put in chest?

Kaspersky also lists but they did not catch it at virus-total
so best to send it in and have it checked

you might try a Kaspersky on line scan- you might have to turn off avast web and standard shields
May be old info but Kaspersky used to require activeX and had to be run from IE
thanks

another question
will Kaspersky find it if it is the chest?

3

Today I also got this AdobeXMPscript.dll as Win32:Vapsup-IL [trj], is it real ?

Keith

4

This is false positive alert and will be fixed in few hours in VPS 080802-0

5

I sent this along to the e-mail address listed above in a passworded zip file. Hope it gets cleared up soon.