It's a javascript file that Norton is detecting from a Website/Webpage website so is detected with iexplore (internet explorer, using it), even some safe websites have recently had bad javascript inside, so people could get infected by "drive byes". Or just bad for some reason.
If malwarebytes and Norton don't detect an infected file on your PC I would say, It's a .js file as part of a webpage that Norton has blocked, so that javascript never got loaded as part of the webpage,
I just went back to the site and I get the same message in recent history! Why would this be happening from such a safe site? What could be causing it?
You don’t need to be concerned about the detection you noted in the history.
This is part of a test signature that is put in to validate some new detection
and these submissions via Norton Community Watch help to reduce the chances of
false positives.
Edit: fixed font selection.
Message Edited by reese_anschultz on 03-06-2009 01:16 PM
You don’t need to be concerned about the detection you noted in the history. This is part of a test signature that is put in to validate some new detection and these submissions via Norton Community Watch help to reduce the chances of false positives.
Edit: fixed font selection.
Message Edited by reese_anschultz on 03-06-2009 01:16 PM
Surely not, Reese. Unless I reading this wrong.
Are you saying the report cited ("IPS detection- statistacal submission" etc.) is actually a product of Symantec? Considering the relentless misspelling of "statistical", I assumed this was a fake report.
"Pay no attention to that man behind the curtain." Nobody ever looks in these logs so why should we run a spell checker? Seriously, I've written up an incident report for the misspelling. (Checks spelling of this message before posting.)
well I get this every time I visit some certian sites. but you guys say its normal. Quads told me it was a java script drive by download that norton was detecting and blocking. The thing is this is coming from reputable sites like hp.com. Is this malware coming rom reputable sites? could someone explain this better to me? thanks
As previously indicated, this is part of a test signature that got a hit. This signature is replacing/updating an existing signature in the future but currently is being tested to make sure that it doesn't get false positives. From your reports, it sounds like it is getting some false positives so the signature will have to be revised before it officially become a part of the IPS signatures.