Kaspersky reporting trojan in Topicscape - a false positive

38 views
Skip to first unread message

Argey

unread,
Nov 8, 2010, 9:36:05 PM11/8/10
to Topicscape
Kaspersky anti-virus software started reporting a virus in Topicscape
recently.

We downloaded this A-V s/w, installed it on one of our test PCs and
investigated.

On our machine, it reported that "jittmp0.dll" in
C:\Program Files\Topicscape Pro 2\bin\jittemp was infected with
"Backdoor.Win32.VanBot.clq"

Now this is actually a file generated by the Java (for the technically
minded, by the JIT compiler). If I delete
the jittemp directory completely, the directory is regenerated on the
next Topicscape run and the same warning appears.

A user of Topicscape (using the same version) had a report from his
Kaspersky installation that points at jittmp2.dll as the infected
item. This may be because the order in which files are added to
jittemp can vary according to what action the user does first on the
first run after installation.

We asked Kaspersky to investigate and adjust their signatures.
Yesterday, they replied "Sorry, it was a false detection. It will be
fixed as soon as possible. Thank you for your help."

We expect it to take a few days to go through their admin and be
released to update signatures on Kaspersky users' PCs.

If you experience this after, say, 12th November, please let us know.

Argey
Reply all
Reply to author
Forward
0 new messages