Spyware Warrior Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
 
FAQ :: Search :: Memberlist :: Usergroups :: Register
Profile :: Log in to check your private messages :: Log in

Trojan Exploit.HTML.Mht from Spyware Warrior link?

 
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Virus, Worm &Trojan Alerts
View previous topic :: View next topic  
Author Message
luther
Newbie


Joined: 12 Jul 2006
Last Visit: 11 Feb 2010
Posts: 2

PostPosted: Thu Mar 26, 2009 2:08 pm    Post subject: Trojan Exploit.HTML.Mht from Spyware Warrior link? Reply with quote

Hello Suzie & co, I have been visiting this forum for ages but thought I would report a strange occurence. I was on the Tutorial part of the forum and looked at the Malware Hunting Guide v1.0. There is a collection of links and I clicked on the Kephyr.com malware research page and received this warning from Kaspersky Internet Security: 26/03/2009 21:55:19 Denied: Exploit.HTML.Mht Internet Explorer http://www.kephyr.com/spywarescanner/pus-practices/index.phtml//index.

It could be a false positive but thought I would let you know.

Thanks.
Back to top
View user's profile Send private message
mikey
Malware Expert


Joined: 12 Feb 2004
Last Visit: 14 Aug 2014
Posts: 1073
Location: CenTex

PostPosted: Thu Mar 26, 2009 2:41 pm    Post subject: Reply with quote

Hey luther,

Thx for the heads up.

I really wouldn't call it a F/P. However, after looking at the source of that page, I believe I know what is happening.

On that page, malware definitions are displayed in HJT logs. I believe your AV is simply picking up on the name recognition from those logs.

I found nothing else in the source other than the definitions that would trigger your AV.

So in essence, it's not really false but the pages are safe to view.

Thx again for bringing a potential exploit to attention.
_________________
-

UbuntuStudio...community supported multi-media development optimization.

-
Back to top
View user's profile Send private message Visit poster's website
luther
Newbie


Joined: 12 Jul 2006
Last Visit: 11 Feb 2010
Posts: 2

PostPosted: Thu Mar 26, 2009 2:57 pm    Post subject: Reply with quote

No problem Mikey. I thought it would be safe as this is a reputable site that certainly wouldn't mislead people into malware exploits. Thumb Up
Back to top
View user's profile Send private message
suzi
Site Admin


Joined: 27 Jul 2003
Last Visit: 16 Sep 2014
Posts: 10325
Location: sunny California

PostPosted: Thu Mar 26, 2009 5:30 pm    Post subject: Reply with quote

I went to the page and got the same warning from my Kaspersky AV. I also looked at the source code of the page and I believe Mikey is right. We've had people report similar issues on some of out HijackThis log threads a very few times.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile
Back to top
View user's profile Send private message Visit poster's website
Display posts from previous:   
Post new topic   Reply to topic    Spyware Warrior Forum Index -> Virus, Worm &Trojan Alerts All times are GMT - 8 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group