02-21-2012 10:06 AM
Hello,
Starting from what appears to be right after pattern update 683-936 was committed - we began receiving a very substantial amount of alerts from multiple internal "victims" for this Trojan. I am still investigating this internally. Has anyone else had a large amount of activity on this signature starting recently? Looking to verify if this is a false positive or not. Other AV protection layers are not reporting this type of activity. Thanks.
| Name: | JS/Trojan.redirector.cay |
|---|---|
| ID: | 250007 |
| Severity: | |
| Description: | This signature detected JS/Trojan.redirector.cay |
02-24-2012 05:27 PM
Content version 686-XXX has the fix.
When we get a report of a false positive we usually ask for the following.
show system info
-- To see all currently installed software.
Threat logs that you believe to be a false positive.
Traffic logs for the IP address identified in the Threat log.
If the firewall is configured to save a PCAP of the packet that triggered the threat we ask for this as well.
If the threat was triggered by a URL or a file download, we would like this information to try and reproduce internally.
Thanks,
Steve Krall
02-21-2012 11:44 AM
I am seeing this as well. I thought maybe it was a single website, but from the looks of it, I think it just may be a false positive. I have identified the source IP's as being owned by a company called AppNexus (at least this is our case). I'm still investigating myself.
02-21-2012 12:34 PM
Thank you for the update from your end as well. I updated to the latest version a few minutes ago and no change. Events still showing up.
| Antivirus version | 684-937 (2012/02/20) |
02-22-2012 06:47 AM
We also have a lot of these. The ones I have examined are from adnxs.com, which appears to be an advertising site. Brightcloud categorizes it as Trustworthy.
We also seem to have URL filtering categorizing a lot of advertisers like atdmt.com and doubleclick.net as malware sites.
Neil Flanagan
02-22-2012 07:50 AM
We are also seeing a high number of these. Have the latest and greatest defenitions as well.
02-22-2012 08:56 AM
I was seeing the exact same problems. Multiple blocks of JS/Trojan.redirector.cay as threat, and atdmt.com and doubleclick.net are blocked as malware-sites. Google Maps and Mapquest will not work.
I received an email that it was indeed a false positive on JS/Trojan.redirector.cay and that it would be corrected in the next update.
02-22-2012 09:01 AM
This signature is a confirmed false positive. It has been removed for tomorrow's AV content release.
02-22-2012 05:37 PM
I want to update the AV manually later. Can you provide which AV version have fixed this issue?
02-23-2012 08:24 PM
Anyone can help to confirm which AV version have fixed the "JS/Trojan.redirector.cay false positive" issue?
We have opened a tech support case with case no. 00066795 to get the AV version number. The funny thing is the engineer still asking me for pcap. If the signature is removed I cannot get packet capture based on threat id in threat logs. :smileyconfused:
02-24-2012 05:27 PM
Content version 686-XXX has the fix.
When we get a report of a false positive we usually ask for the following.
show system info
-- To see all currently installed software.
Threat logs that you believe to be a false positive.
Traffic logs for the IP address identified in the Threat log.
If the firewall is configured to save a PCAP of the packet that triggered the threat we ask for this as well.
If the threat was triggered by a URL or a file download, we would like this information to try and reproduce internally.
Thanks,
Steve Krall
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
