> -----Original Message----- > From: [EMAIL PROTECTED] [mailto:clamav-users- > [EMAIL PROTECTED] On Behalf Of aCaB > Sent: Wednesday, April 09, 2008 11:28 AM > To: ClamAV users ML > Subject: Re: [Clamav-users] Many Javascript false - positives > > Henrik K wrote: > > On Wed, Apr 09, 2008 at 04:49:17PM +0200, aCaB wrote: > >> Henrik K wrote: > >>> On Wed, Apr 09, 2008 at 03:53:16PM +0200, aCaB wrote:
> >>>> Henrik K wrote: > >>>>>> But I have another one, also without PUA ;-) > >>>>>> http://www.beta.wetter.com/lib/js/1d7c7a52.js --> > >>>>>> Trojan.Downloader.JS.Agent-2 > >>>>>> This is also a "ajax - jquery - lib" from a popular, german - > >>>>>> website. > >>>>> I can confirm too that Trojan.Downloader.JS.Agent-2 (and 1) hit a > load of legitimate sites. Hello . I ran into this " Trojan.Downloader.JS.Agent-2" issue yesterday on our web server. When notified, the webmaster replied with "these are coming from compressed js files using Dean Edwards' javascript "packer" [http://dean.edwards.name/packer/], which compresses js and usually reduces the file size by 30-40 percent." Regards, Jamie _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
