wget a trojan?
Results 1 to 5 of 5

Thread: wget a trojan?

  1. #1
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,324

    wget a trojan?

    I've had wget installed for sometime and my antivirus has never showed it.
    I've scanned with several programs and it's never showed up..

    Just yesterday I was playing around a bit and accidentially infected myself with a trojan.
    Not to worry, scan, remove, cleanup...

    I used the cleaner and it took care of it nicely.

    However, in the process it claims that wget.exe is a trojan?!

    The version of wget I've used and tested this with is located @
    http://www.interlog.com/~tcharron/wgetwin.html

    Sure enough, I downloaded it again and scanned that folder and it deleted it again...

    Information from moosoft on the supposed "trojan" is located @
    http://www.moosoft.com/products/clea...n&query=Webget

    Has anyone else heard of this? They are saying its trojan webget...

    Confused....

    McAfee says it is legitimate...
    http://vil.nai.com/vil/content/v_101106.htm

    This is not a virus or trojan. It is a legitimate application for retrieving files from the Internet via HTTP and FTP. The application has been misused by certain pieces of malware in order to facilitate remote downloads.

    The exact file size varies (there are many different versions), and it may be packed with a PE packer (eg. UPX, Aspack). Malware that use this tool maliciously typically do so using the quiet switch, disabling screen output.

    Users who would like to check for the presence of potentially unwanted programs on their system should run the command line scanner with the /PROGRAM switch.

    Please note that VirusScan 7, and higher, has an option that enables users to detect this kind of program automatically (see below).
    Maybe MooSoft needs to elaborate a bit more before calling it a trojan... it can be used to download a trojan to your PC... but itself is not a trojan...

    MsM... you posted before I refreshed... I edited my post. I just found McAfee's report on it.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  2. #2
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    I did a little search as I was kinda surprised to see what you wrote. Apparently there was a wget trojan. But I wonder if Moosoft is considering it a "trojan" for the same reason ZA is?

    McAfee's Comments on it from 2002

    ZoneLab's Virus Info Comments

    Now Zonelab's page might be more of interest since they associate it with Win32.Fibot.022. Perhaps that's what's being picked up?
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  3. #3
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,324
    MsM. I edited my post above about McAfee's writeup.

    Here is the log from the scan on the decompressed wget folder.

    [8/11/2004 5:20:31 PM] Scanning...
    [8/11/2004 5:20:31 PM] Cleaning Webget found in c:\wget\wget.exe
    [8/11/2004 5:20:31 PM] 8 files scanned in 0m:0s @ 8 files/s
    No mention of the other trojan...

    Ah well, just had me confused for a minute.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  4. #4
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    So it's making an assumption about the file then? Perhaps you could create a directory with "clean tools" and have Moosoft avoid scanning it? (I do that for my "toys directories" as the AV may delete them before I've had a chance to show them to classes or play with them myself.)
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  5. #5
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    Posts
    4,324
    Yeah, I suppose I could do that.

    I'll probably just uninstall it though. I only wanted to make sure a trojan was removed.

    Thanks for the insight.
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides