Virsu In Download Area ?

[jack111]

I been using sqlyog enterprise it is simply great and after my initial pessimism now totally love it. It is a very very good.

I tend to keep my software updated and today [26 march 2007 ] when I when to the download area and tried to download the latest update to my shock found that a trogan was being downloaded. luckily norton internet security 2007 fixed it for me.

http://www.symantec.com/security_response/…-090516-0204-99

VirusBurst

Updated: March 1, 2007 5:24:43 PM

Also Known As: SpyDawn [Sophos]

Type: Other

Risk Impact: Medium

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Behavior

VirusBurst is a misleading application that is installed without user notification or consent by a Trojan.

Could urgent action be taken. Looks like your servers have been compromised.

[peterlaursen]

99.99999999 % it is a 'false positive'.  Looks like new erroneous detections were distributed this night by some AV companies. That has happened once before – and the day after they corrected the error and distribuged new definitions.   We had one more report this morning.  We are  trying to find out what happend

Note that SQLyog 5.25 has been available for 2 months, and those reports only start today!  The file on the server is binary identical to what it has always been!  

You do not need to be horrified, but better be informative!!! When did that happen and when did it not happen and what has changed in between?  AND WHAT IS (including THE EXACT VERSION of) the antivirus software that you are using ?

[peterlaursen]

It is confirmed that Norton Antivirus 2007 with detections from yesterday (2007-03-25) identifies all SQLyog installers from 5.23 onwards as the 'Virusburst' virus.  NAV 2007 quarantaines those files per default.

We think it is an issue with the NAV updates from yesterday and the NSIS installer.  We are working on this now.  We have a few options!!

It is 100% a 'false postive' !!

[peterlaursen]

There is a more recent NSIS installer-builder available, that does not raise this alert.

We will build and release with this one shortly.

Also for the future we will check for new NSIS release (at least) before releasing a FINAL version!

[peterlaursen]

By the way:

It looks like Symantec released new detections this morning!  

With the latest detections there is no alert!

anybody can confirm this?

[jack111]

Quote:

You do not need to be horrified, but better be informative!!!

What do you mean “better be informative” I donot like the tone of your statement. First for somebody who is trying to help a thank you would be a good start.

As regards being informative ……………… I have clearly stated that it is norton internet security 2007 and given you the date I updated it. Read it again below if you missed it the first time.

Quote:

I tend to keep my software updated and today [26 march 2007 ] when I when to the download area and tried to download the latest update to my shock found that a trogan was being downloaded. luckily norton internet security 2007 fixed it for me.

When did that happen and when did it not happen and what has changed in between? …………………. I saw a valid security concern and reported it. When did people start shooting the messenger.

[jack111]

Quote:

It looks like Symantec released new detections this morning!

With the latest detections there is no alert!

anybody can confirm this?

The security alert no longer shows up now

[peterlaursen]

Thanks for the feedback.  My apology if I 'lost balance'.

However when you worte

“Could urgent action be taken. Looks like your servers have been compromised.”

.. I just wanted to state that nothing is certain just because an AV program displays an alert.

I think it was Symantec you had most actions to take!  If was new detections that raised the alert, not new code.  that aleone tells that if is like an issue with the detection!

However we have learned that we will check for Nullsoft updates more frequently and before release of every stable version!

[MikeA]

jack111 wrote on Mar 27 2007, 03:23 AM:

What do you mean “better be informative” I donot like the tone of your statement. First for somebody who is trying to help a thank you would be a good start.

“You do not need to be horrified, but better be informative!!!”

I did not read this as a harsh remark towards you. I read it as it is better to be informed about things than just assume it is okay. In other words, don't be horrified as the AV companies keep after things. Don't panic. But be informed about the latest virus infections. Do as you did and notify Webyog. I know that he appreciates it because for every customer that reports a problem at least 10 do not!

You did the right thing and helped all of us! Thanks!

[Author]

Posts