Virus confirmation??

HI all. Today i recomended Languard to a friend who wanted to see how it works.

He runs win XP pro. The link i provided him with was http://www.webattack.com/get/languardscan.shtml

He downloaded it and tried to run it.

His Norton AV 2003 popped up and said:

malicious script WSO
D:\Program Files\GFI\LANguard Network Security Scanner 3\InstallScript.vbs

and it then opened up his Java console......?

Since i dont have XP nor norton 2003, i was wandering if someone could confirm this. Is this a virus, or is it normal (since languard does include malicous scripts for testing purposes).


His current options are system halted, allow or block it.

Any advice would be much apreciated.

I dont have a winbox available at this moment to test it with other AV, which is why im posting this here.


Cheers.

Hey,

Looks like GFI is aware of this and in their knowledge base say to ignore the Norton messages. Their response to this can be found here.

http://kbase.gfi.com/showarticle.asp?id=KBID001653

I'm not real good with virus info but I would say that its just part of the install process. I could be wrong. Maybe if you could paste the code from the script file here we could see how it works. But it should be ok. Its probably just a little script file that triggers some other operations during the install.

Swarisd.

Thanky you very much. Indeed this answers my problem. Well done there.

Cheers.

Just to add as a note, this problem is the same whenever updating your graphics drivers and such. You should disable your AV program if you are installing an application from a "trusted" source (whether it be a website or bought from the store). This is to help the program install itself correctly.

I know from my personal experiences with my NVIDIA GeForce 3 graphic's card, that if I don't disable my AV before I install/upgrade the drivers... I will have some serious issues after I restart my computer.

Just to add one more thing.

since the file is a vbs file and NAV knows that many viruses are created and run as vbs it will alert you.

malicious script WSO
InstallScript.vbs

I get messages like this when using the win2k resource kit, or any .vbs file/script for that matter.

I create a .vbs script for a school project... norton pops up and wants to quarantine it...

You can configure norton to ignore .vbs files.

I just wouldn't recommend that to your average Joe User....

Yep, just add the vbs filename to the exception list in Norton and this annoyance goes away.

BTW, GFI LanGuard has produced shoddy results when we tested it. I hope your friend *really* gives it the once over. One more thing that is annoying is the salesman who will hound you to death after about two weeks. As you know, you have to contact them to get a demo license to try this product out.

My two cents...

GFI Languard Network Scanner is a good network administration tool. And when you install it, it runns a Script that stores information in the Registry file, so because of so many viruses do this to trigger them selves any time the machine starts, Norton Antivirus and Norton Personal Fire Wall, stops this kind of action and ask's you if you agree that execution. Don't be afraid, you can leave it do it's work else LanGuard will not be able to do some things (like upgrade). And a litle more, you can find a vbs cript on youre hard drive named UnInstallScript.vbs that performs the remotion of the keys stores into youre registry, so when you uninstall the LanGuard, i'm shure that Norton Will ask you again.

xDrack.

Hey, thanks everyone for your replies. The info you have provided here is really helpful.

The horse, what do you mean with license? Its a 30 day trial version. Or are you talking about the legal side of using it on 3rd party "targets"? :s

Cheers.