Trojan:W32/Scob

Classification

Category :

Malware

Type :

Trojan

Aliases :

Trojan:W32/Scob, JS/Scob.A, Trojan-Clicker.Win32.VBScobb

Summary

When executed, the trojan attempts to use an invisible frame to connect to a page at a remote web site.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Trojan-Downloader:W32/Scob was found on a number of web sites on late June 24th, 2004, appending to existing files such as jpeg and gif files. According to reports, the script was not appended by modifying the actual files on the server but by using the footer feature from Microsoft's Internet Information Server.

Activity

At the time of writing, the page in the web site is not available. While the page is not currently available, there has been reports that this downloader has been used to install variants of Backdoor:W32/Padodor.

The trojan also sets a cookie on the system, causing that it will attempt to connect the remote site no often than once every week.

Note

Further information about this case is also available from Microsoft:

  • https://www.microsoft.com/security/incident/download_ject.mspx

In addition Microsoft has released a new KB (871277) on the Download.Ject Detection and Recovery Advisory:

  • https://support.microsoft.com/?kbid=871277