# Bluecloth 1.0.0 - Test contain trojan?

**URL:** <https://www.ruby-forum.com/t/bluecloth-1-0-0-test-contain-trojan/49330>\
**Category:** Ruby\
**Created:** [December 2, 2005, 5:41pm UTC](https://www.ruby-forum.com/t/bluecloth-1-0-0-test-contain-trojan/49330 "2005-12-02T17:41:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![itsme213](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/258eb7/32.png) [@itsme213](https://www.ruby-forum.com/u/itsme213)\
**Post date:** [December 2, 2005, 5:41pm UTC](https://www.ruby-forum.com/t/bluecloth-1-0-0-test-contain-trojan/49330/1 "2005-12-02T17:41:11Z")

</div>

I just got a very peculiar warning from running McAfee virus scan (XP):

BlueCloth-1.0.0\tests\15\_Contrib.tests.rb is infected by the  
JS\Exploit-CrossSite trojan.

Anything to be concerned about here? Or a total red-herring from McAfee?

(McAfee seems to have the file somehow locked right now so I can’t even  
browse its contents.)

Thanks.

---

<div class="post-metadata">

**Author:** ![itsme213](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/258eb7/32.png) [@itsme213](https://www.ruby-forum.com/u/itsme213)\
**Post date:** [December 2, 2005, 6:29pm UTC](https://www.ruby-forum.com/t/bluecloth-1-0-0-test-contain-trojan/49330/2 "2005-12-02T18:29:57Z")

</div>

itsme213 wrote:

> I just got a very peculiar warning from running McAfee virus scan (XP):
> 
> BlueCloth-1.0.0\tests\15\_Contrib.tests.rb is infected by the  
> JS\Exploit-CrossSite trojan.
> 
> Anything to be concerned about here? Or a total red-herring from McAfee?

Antivir (updated 2 hours ago) does not complain.

Perhaps McAffee uses some heuristics to guess whether sth is a virus or  
not.

Possibly because of the string DangerousHtml (containing tags).

There has been an online-virus-scanner somewhere sometime, but - here it  
is:

[http://www.kaspersky.com/scanforvirus](http://www.kaspersky.com/scanforvirus)

---

<div class="post-metadata">

**Author:** ![itsme213](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/258eb7/32.png) [@itsme213](https://www.ruby-forum.com/u/itsme213)\
**Post date:** [December 7, 2005, 11:24pm UTC](https://www.ruby-forum.com/t/bluecloth-1-0-0-test-contain-trojan/49330/3 "2005-12-07T23:24:55Z")

</div>

This has already been reported, but it’s an artifact of McAfee’s  
heuristics, not an actual virus. For more details check out:

[http://www.deveiate.org/projects/BlueCloth/ticket/29](http://www.deveiate.org/projects/BlueCloth/ticket/29)