up vote 1 down vote favorite
share [g+] share [fb]

We use sunbelts VIPRE enterprise systems, and I was alerted to almost every computer in the company having this and being quarantined.

Is anyone familiar with addthis_widget.js. It detects it as a trojan.js.redirector.bg , I'm not sure if this is a false positive or if it is actually a threat.

I tried googling it a few different ways but didnt find anything definitive. Does anyone have any experience with this?

link|improve this question
100% accept rate
+1 -We are having the same issue here. – Aaron Apr 21 '11 at 13:25
yeah i started getting emails on my phone roughly starting at 7am this morning with high risk alerts so i got to come in nice and early :| – Jeff Apr 21 '11 at 13:51
feedback

2 Answers

up vote 1 down vote accepted

I think it is a false positive. I just found this on the GFI community site:

We disabled this threat late last night to allow for further investigation. Please make sure you have the latest definitions.
Joe Frederick QA Engineer Sunbelt Software

link|improve this answer
i'm still going to quarantine it and then delete it. i dont know what it is so it is better safe than sorry – Jeff Apr 21 '11 at 13:45
@Aaaron malwaresurvival.net/tag/trojan-buzus/page/2 – Jeff Apr 21 '11 at 14:01
feedback
up vote 1 down vote

I just got the same thing, 18 computers showing various threats. addthis_widget.js, common.js, friendconnect.js, espn.core.min.js and a couple others. Seems to me there is something in the java script being falsely reported.

link|improve this answer
malwaresurvival.net/tag/trojan-buzus/page/2 i do not know if this will help – Jeff Apr 21 '11 at 14:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.