VBS/Virus.invadesys.(253879) - Potential False Positive?

[dciccone]

Hi,

Recently, on some of our clients we have been seeing the same threat / virus appear. The name is VBS/Virus.invadesys. and the ID is 253879.

Some interesting things to note...

1. The file-name is ALWAYS a bookmark file ending in .url
2. All of the files sound VERY generic.

Small sample of some URLs...

• "Guide Entertainment Network.url"
• "Monitor Tool 2008.url"
• "IE site on Microsoft.com.url"
• "Windows Media Showcase.url"
• "Welcome to IE7.url"

Upon further investigation, it seems that these files come pre-packaged with IE7, as seen with one of the above URLs.

So my question is, has anyone else seen an abundance of these alerts in the recent days?

[goku123]

False positives for threat ID 253879 have been confirmed. Fix targeted through AV release 1076.

[dciccone]

Hi achitwadgi,

Thanks for the information. Any idea when this update will be available for download? I just checked on the PA devices, and it is not showing yet.

Also, where did you obtain this information? I cannot find it anywhere.

[goku123]

Hi, current AV version available is 1075. 1076 should go out later today.

[goku123]

Hi,

AV 1076 was just released, we are testing again with a couple of links. Will update this thread shortly.

[goku123]

AV 1076 is still triggering alerts on this threat id 253879 for URLs such as support.microsoft.com/kb/2123563.

This issue has been reopened with PAN threat team and is being further investigated.

[goku123]

A problem was discovered with the signature and this is being addressed with the combination of AV update today and the app+threat content update that is targeted for release on Tuesday Aug 13.

[mikand]

Thanks for the updates on this issue!

[urb]

I have just received a report from a customer running 1078, that he has this false positive as well. Guess we are not quit there yet.

[goku123]

Please ensure that in addition to the latest AV package, you are also running apps+threat version 388 or newer.

[jam1]

I am running Apps and Threats version 388 antivirus version 1078 and am still reviving these alerts. Interestingly the threat ID and name are not present in the threat vault.

[goku123]

Maybe the signature needs additional tuning. If you suspect this to be a false positive alert, can you please open a support case with the threat log screenshot & sample/url/threat pcap and 'show system info' output?