wget a trojan?

I've had wget installed for sometime and my antivirus has never showed it.
I've scanned with several programs and it's never showed up..

Just yesterday I was playing around a bit and accidentially infected myself with a trojan.
Not to worry, scan, remove, cleanup...

I used the cleaner and it took care of it nicely.

However, in the process it claims that wget.exe is a trojan?!

The version of wget I've used and tested this with is located @
http://www.interlog.com/~tcharron/wgetwin.html

Sure enough, I downloaded it again and scanned that folder and it deleted it again...

Information from moosoft on the supposed "trojan" is located @
http://www.moosoft.com/products/clea...n&query=Webget

Has anyone else heard of this? They are saying its trojan webget...

Confused....

McAfee says it is legitimate...
http://vil.nai.com/vil/content/v_101106.htm

Quote:

---

This is not a virus or trojan. It is a legitimate application for retrieving files from the Internet via HTTP and FTP. The application has been misused by certain pieces of malware in order to facilitate remote downloads.

The exact file size varies (there are many different versions), and it may be packed with a PE packer (eg. UPX, Aspack). Malware that use this tool maliciously typically do so using the quiet switch, disabling screen output.

Users who would like to check for the presence of potentially unwanted programs on their system should run the command line scanner with the /PROGRAM switch.

Please note that VirusScan 7, and higher, has an option that enables users to detect this kind of program automatically (see below).

---

Maybe MooSoft needs to elaborate a bit more before calling it a trojan... it can be used to download a trojan to your PC... but itself is not a trojan...

MsM... you posted before I refreshed... I edited my post. I just found McAfee's report on it.

I did a little search as I was kinda surprised to see what you wrote. Apparently there was a wget trojan. But I wonder if Moosoft is considering it a "trojan" for the same reason ZA is?

McAfee's Comments on it from 2002

ZoneLab's Virus Info Comments

Now Zonelab's page might be more of interest since they associate it with Win32.Fibot.022. Perhaps that's what's being picked up?

MsM. I edited my post above about McAfee's writeup.

Here is the log from the scan on the decompressed wget folder.

Quote:

---

[8/11/2004 5:20:31 PM] Scanning...
[8/11/2004 5:20:31 PM] Cleaning Webget found in c:\wget\wget.exe
[8/11/2004 5:20:31 PM] 8 files scanned in 0m:0s @ 8 files/s

---

No mention of the other trojan...

Ah well, just had me confused for a minute.

So it's making an assumption about the file then? Perhaps you could create a directory with "clean tools" and have Moosoft avoid scanning it? (I do that for my "toys directories" as the AV may delete them before I've had a chance to show them to classes or play with them myself.)

Yeah, I suppose I could do that.

I'll probably just uninstall it though. I only wanted to make sure a trojan was removed.

Thanks for the insight.