Maybe false positive ELF:Agent [Trj] on (old) Debian 2.0

system · 2007-08-29T12:00:07.000Z

I’ ve found that my Avast 4.7.1029 (virus database version 000769-1) show a file on an old Debian distribution like a trojan horse. The distribution is downloaded by the official debian ftp server. I’ ve attached the file (renamed *.vir.txt).

Maxx_original · 2007-08-29T12:06:38.000Z

thx for the sample… but use the mail next time

system · 2007-08-29T13:02:38.000Z

Thank you for the sample. The false alarm will be fixed in the next virus database update.

zilog · 2007-08-29T14:29:38.000Z

Hallo,

thanks for the sample - indeed, the file looks like quite old version of dynamically-linked top, although the header is slightly incorrect. it doesn’t seem to contain any infection, so we’ll probably remove the relevant signature in the next 400.vps database release.

btw. small hint - file-renaming doesn’t prevent detection in e-mail attachments, please use password-protected archives (zip, rar, …) next time

system · 2007-08-29T15:52:08.000Z

Ok, if I see something similar I’ll send an email with a rar compressed file.
Thank you for your attention and your speed (at the moment the problem seems fixed with the version 000769-2).

Announcements