Jump to content

Norton AV says that CDSwitch has the "download" virus


Recommended Posts

I downloaded the latest version of WPI Wizard, including all the various options. Then Norton Internet Security 2008 started to give me warnings about a serious threat that could not be removed automatically, the CDswitch.exe file inside tools.rar.

Has anyone else gotten this message? Any real solution, aside from simply deleting this executable? Has anyone had their system infected by this "virus?".

Here are some details:

The NIS 2008 contains the following entry:

Risk category: Virus

Overall Risk Impact: High

Performance: High

Privacy: High

Removal: High

Stealth: High

Click for more information about this risk : Downloader

Action taken: Removal failed

Affected Areas: [cdswitch.exe] inside of [f:\software\windows post-install wizard\tools.rar]

On the Symantec website (here http://securityresponse.symantec.com/secur...101518-4323-99) there is more information. Here is the summary tab contents:

Discovered: June 8, 2001

Updated: February 13, 2007 11:50:11 AM

Type: Trojan Horse

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Downloader connects to the Internet and downloads other Trojan horses or components.

Note: Virus definitions dated June 1, 2006 or earlier may detect this threat as Download.Trojan.

ProtectionInitial Rapid Release version June 11, 2001

Latest Rapid Release version April 19, 2009 revision 049

Initial Daily Certified version June 11, 2001 revision 007

Latest Daily Certified version April 19, 2009 revision 024

Initial Weekly Certified release date June 13, 2001

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat AssessmentWildWild Level: Low

Number of Infections: 0 - 49

Number of Sites: 0 - 2

Geographical Distribution: Low

Threat Containment: Easy

Removal: Easy

DamageDamage Level: Low

DistributionDistribution Level: Low

Writeup By: Gor Nazaryan

x509

Link to comment
Share on other sites


#1 False positive, it is a compiled auto-it file compiled with a OLD version of auto-it.

#2 It's not really needed unless you either: a = don't have a dvd burner or b = have a WPI setup that is too big for one disk thus neccesitating the use of several disks.

#3 Nortons' really is not the best choice of AV.

http://www.virustotal.com/

Is a good choice for checking a suspicious file out.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...