For details on cookie usage on our site, read our Privacy Policy
JS/Trojan.redirector.cay false postive?
- LIVEcommunity
- Discussions
- General Topics
- JS/Trojan.redirector.cay false postive?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-21-2012 10:06 AM
Hello,
Starting from what appears to be right after pattern update 683-936 was committed - we began receiving a very substantial amount of alerts from multiple internal "victims" for this Trojan. I am still investigating this internally. Has anyone else had a large amount of activity on this signature starting recently? Looking to verify if this is a false positive or not. Other AV protection layers are not reporting this type of activity. Thanks.
| Name: | JS/Trojan.redirector.cay |
|---|---|
| ID: | 250007 |
| Severity: | |
| Description: | This signature detected JS/Trojan.redirector.cay |
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-24-2012 05:27 PM
Content version 686-XXX has the fix.
When we get a report of a false positive we usually ask for the following.
show system info
-- To see all currently installed software.
Threat logs that you believe to be a false positive.
Traffic logs for the IP address identified in the Threat log.
If the firewall is configured to save a PCAP of the packet that triggered the threat we ask for this as well.
If the threat was triggered by a URL or a file download, we would like this information to try and reproduce internally.
Thanks,
Steve Krall
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-21-2012 11:44 AM
I am seeing this as well. I thought maybe it was a single website, but from the looks of it, I think it just may be a false positive. I have identified the source IP's as being owned by a company called AppNexus (at least this is our case). I'm still investigating myself.
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-21-2012 12:34 PM
Thank you for the update from your end as well. I updated to the latest version a few minutes ago and no change. Events still showing up.
| Antivirus version | 684-937 (2012/02/20) |
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-22-2012 06:47 AM
We also have a lot of these. The ones I have examined are from adnxs.com, which appears to be an advertising site. Brightcloud categorizes it as Trustworthy.
We also seem to have URL filtering categorizing a lot of advertisers like atdmt.com and doubleclick.net as malware sites.
Neil Flanagan
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-22-2012 07:50 AM
We are also seeing a high number of these. Have the latest and greatest defenitions as well.
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
