stljohnd
Joined: 02 Mar 2008 |
Posts: 0 |
|
|
 |
Posted: Sun Mar 02, 2008 5:33 pm |
|
 |
 |
 |
 |
I have been running clamwin for a month with no problems. Now COMODO reports:
clamscan.exe is a safe application. It is about to modify the contents of C:\WINDOWS\system32\msasn1.dll. This usually happens when you try to install or update an application. If you are not performing any of these operations, you may consider blocking this request.
Any ideas?
|
|
sherpya
Joined: 22 Mar 2006 |
Posts: 0 |
Location: Italy |
|
 |
Posted: Mon Mar 03, 2008 4:58 am |
|
 |
 |
 |
 |
clamscan does not modify any system dll, (at least if it does not believe that that dll is a virus and you configured to remove/move)
so it's not really normal, and you should not allow this, perhaps what does mean "modifying" for comodo?
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Wed Mar 05, 2008 1:59 pm |
|
 |
 |
 |
 |
That msasn.dll file you mentioned is a Microsoft file used for secure communications between applications (primarily Secure Socked Layer). There was a vulnerability (one of the ever-present buffer overflows) that could involve this file. If the vulnerability is successfully exploited, it could allow an attacker to have system level access to the computer. It can afffect NT/XP/2000/2003 Servers. Microsoft took care of this with Security Update MS04-007. There is some information about this in Microsoft's KB828028. It is my understand that if you find the file on your computer, it means you do not have the update and are vulnerable, so you should get the security update.
Get it and then do another ClamWin scan. I also suggest that you do a scan with another antivirus if you have one. If you don't, you might try Dr. Web's Cureit or Norman's Malware Cleaner (Safe Mode).
Regards,
|
|