Michael McNamara

technology, networking, virtualization and IP telephony

Kaspersky Antivirus – Google Adsense – Trojan

by

It was like deja vu, only a few months ago I wrote about an issue with Kaspersky Internet Security 2010 and Google Adsense. So you can imagine my surprise this morning when our Blue Coat ProxyAV appliances started sending out hundreds of alarms that URLs associated with Google Adsense were infected with a Trojan. After looking at the Javascript it was pretty clear that this was a false positive result.

2010-01-25 12:04:25-05:00EST
Hardware serial number: 3806111111
ProxyAV (Version 3.2.4.1(43261)) – http://www.BlueCoat.com/ Antivirus
Vendor: Kaspersky Labs Scan Engine Version: 8.0.1.23
Pattern File Version: 100125.095500.3363319 (Timestamp: 2010.01.25 09:55:00)

Machine name: ProxyAV-gosford
Machine IP address: 10.1.1.45
Server: 64.233.169.165
Client: 10.1.1.100

Protocol: ICAP
Virus/PUS: “Trojan.JS.Redirector.ar” found!
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

There was quite a thread over on the support forums at Kaspersky on the subject.

Cheers!

Kaspersky Internet Security 2010 – Google Adsense – Phishing URL

by

It seems there is something amiss on the Internet this morning. It all started when my installation of Kaspersky Internet Security 2010 updated itself around 11:56AM this morning. I was looking at the new forums setup by Jeff Wiener over at TheTelecomBlog.com when I was greeted with a Phishing URL kaspersky-internet-security-2010-google-adsense-phishingalert from the Kaspersky program. I had already been out to the site earlier in the morning so I was immediately puzzled by the prompt. Upon closer evaluation it appears that Kaspersky is marking one of the JavaScript files used (http://googleads.g.doubleclick.net/pagead/test_domain.js) to place Google Adsense ads onto the site as a phishing URL.

I browsed over to my own personal blog and got the same alert from Kaspersky, I also got the same alert visiting the discussion forums I recently setup. I went into the Kaspersky application and sure enough the ‘Phishing URL’ database was updated this morning 11/22/09 at 10:56AM (see screenshot).kaspersky-internet-security-2010-updates

It looks to me to be a simple false positive, although I did download the JavaScript file and gave it a quick browse through.

A quick search of the Internet didn’t turn up anything relative.

I guess I’ll head off to the Kaspersky support forums and post a topic.

Cheers!

Update: It seems this is definitely a false positive with the Kaspersky phishing URL database. There is a thread over on the Kaspersky support forums with similar reports.

Update: (Sunday November 22, 2009 at 4:30PM EST) I recieved a response from Kaspersky Support indicating that the problem was a false positive and the problem was resolved in the Phishing URL database update issued at 1:16PM EST. As a side note I had to inform Kaspersky by sending an email message to newvirus@kaspersky.com with the subject of ‘False Positive’. EJW3D44WYAKM

Recent Posts

Categories

SUBSCRIBE BY EMAIL