EXP Systems Forum: Worm.HLLM.BlackWorm in OSSMTP.dll ?

Message

   Hello,

I have installed PDF reDirect from download.com:
http://www.download.com/3001-6675_4-10539357.html

Antivirus on-line scanner from www.mks.com.pl finds
Worm.HLLM.BlackWorm in
c:\Program Files\PDF reDirect\OSSMTP.dll

I have scanned computer, because there were problems with slow work.
I have read this topic:
http://www.exp-systems.com/forum_exp/forum_posts.asp?TID=146&PN=1

but there is nothing about Worm.HLLM.BlackWorm

Best regards,
Kamil

Author	Message
kamil Newbie Joined: 21 Jun 07 Posts: 2	Topic: Worm.HLLM.BlackWorm in OSSMTP.dll ? Posted: 21 Jun 07 at 5:53AM
	Hello, I have installed PDF reDirect from download.com: http://www.download.com/3001-6675_4-10539357.html Antivirus on-line scanner from www.mks.com.pl finds Worm.HLLM.BlackWorm in c:\Program Files\PDF reDirect\OSSMTP.dll I have scanned computer, because there were problems with slow work. I have read this topic: http://www.exp-systems.com/forum_exp/forum_posts.asp?TID=146&PN=1 but there is nothing about Worm.HLLM.BlackWorm Best regards, Kamil
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 21 Jun 07 at 11:16PM
	Hi Kamil, PDF reDirect is scanned for viruses (and worms) by myself before being released. The web site "download.com" also scans the files to make sure they are OK. I suspect that the scan from www.mks.com.pl is a "false positive". That means that they think there is a problem, even though there is not one. I would recommend you try a different virus scanner such as "Norton", NOD32 (my favorite), or Trend Micro and see if you continue having the report of a problem. Please let me know if you continue having difficulties, and I can see what I can do to work with MKS from Poland. However, my Polish is nearly non-existant, so I am not sure that I will be able to resolve the issue with them. Thanks for letting me know!
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

kamil Newbie Joined: 21 Jun 07 Posts: 2	Posted: 22 Jun 07 at 4:08AM
	Hi Michel, Thank you for your quick and "positive" answer. I scanned PDF reDirect files with - avast 4.7 for Windows SB 2003 - on-line scanner at www.kaspersky.pl (http://www.kaspersky.pl/virusscanner.html). - and ClamWin antivirus (http://sourceforge.net/projects/clamwin) - None of them did not find virus in PDF reDirect files including OSSMTP.DLL. I hope you are right that it was "false positive". Probably I send my previous post to quickly and it was false alarm - I am sorry - I trust MKS Scanner and on last Thursday I was almost sure that I install a trojan in my company. Best regards, Kamil
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 23 Jun 07 at 12:23AM
	Thanks for the update. Please let me know if you continue experiencing any difficulties.
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

Slartibartfast Newbie Joined: 15 Jul 08 Posts: 2	Posted: 15 Jul 08 at 10:15AM
	I received a similar warning today. Avira AntiVir reported that OSSTMP.dll "Contains detection pattern of the worm WORM/Israz.86016"
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 15 Jul 08 at 11:02PM
	Hi, Have you seen the post [here]? It talks about this quite a bit. Basically, some older, out of date, or foreign anti-virus vendors flag this DLL incorrectly. However, all of the major anti-virus software such as NOD32, Norton, McAfee say that this file is safe (which it is). This DLL is a component I use for the "Pro" version which I purchased from www.ostrosoft.com. If you are using PDF reDirect freeware, you can delete this file: it is used only in the Pro version to add the ability to send your PDF files by e-mail. I hope that helps, Michel
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

Slartibartfast Newbie Joined: 15 Jul 08 Posts: 2	Posted: 16 Jul 08 at 12:18PM
	Thanks for the link and the info. I searched for "worm" and got no hits. I will delete the file for now, but perhaps you can get Avira to fix their detections. AntiVir is actually rated as one of the best antivirus programs available here.
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 16 Jul 08 at 1:06PM
	Hi, Thanks for the update. I contacted Avira last night and submitted a "false positive" report with them. They said that they will investigate and get back to me, hopefully soon. Cheers!
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 16 Jul 08 at 1:08PM
	Hi, Just got a reply from Avira. They reported the package as "clean" [here]. They made no mention of the DLL, so I asked them for more info, and confirmation that they will fix their definition file. Cheers!
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 17 Jul 08 at 10:25AM
	I just received the following e-mail from Avira. I think this says it all. ---------------------------------------- Dear Sir or Madam, Thank you for your recent inquiry. We could not find a virus in the attachment you have sent us. The alert you have got was a false positive. That false positive will not be longer detected by AntiVir with the current VDF. -- Freundliche Gruesse / Best regards Avira GmbH Andreas Pohl First Level Support Avira GmbH Lindauer Str. 21, D-88069 Tettnang, Germany Internet: http://www.avira.com
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

vgorKys Newbie Joined: 25 Aug 10 Posts: 1	Posted: 25 Aug 10 at 8:02AM
	Hi! I had the same problem with a 'not found' virus when I used Avira. It's a good antivirus, but maybe you should try another option too. I recommend Avast, because is the one I'm using now, but you can find useful information about antiviruses comparison and problems here: www.best-antivirus.co It's a free reviews and downloads site. Good luck!
	IP Logged

Michel_K17 Moderator Group Forum Administrator Joined: 25 Jan 03 Posts: 1673	Posted: 26 Aug 10 at 12:11AM
	Thanks for the tip.
	Michel Korwin-Szymanowski EXP Systems LLC
	IP Logged

Using PDF reDirect
EXP Systems Forum : PDF reDirect : Using PDF reDirect