Spyware Warrior

luther

Hello Suzie & co, I have been visiting this forum for ages but thought I would report a strange occurence. I was on the Tutorial part of the forum and looked at the Malware Hunting Guide v1.0. There is a collection of links and I clicked on the Kephyr.com malware research page and received this warning from Kaspersky Internet Security: 26/03/2009 21:55:19 Denied: Exploit.HTML.Mht Internet Explorer http://www.kephyr.com/spywarescanner/pus-practices/index.phtml//index.

It could be a false positive but thought I would let you know.

Thanks.

mikey · Posted: Thu Mar 26, 2009 2:41 pm Post subject:

Hey luther,

Thx for the heads up.

I really wouldn't call it a F/P. However, after looking at the source of that page, I believe I know what is happening.

On that page, malware definitions are displayed in HJT logs. I believe your AV is simply picking up on the name recognition from those logs.

I found nothing else in the source other than the definitions that would trigger your AV.

So in essence, it's not really false but the pages are safe to view.

Thx again for bringing a potential exploit to attention.
_________________
-
W2K/2K3/XP/2K8/Vista/W7/RHE/DEBIAN/SUSE

Spyware/Adware is NOT freeware, it costs all of us dearly.

Mikey's Stuff

Fiddler and friends...essential web diagnostic, forensic, & development tools.
-

luther · Posted: Thu Mar 26, 2009 2:57 pm Post subject:

No problem Mikey. I thought it would be safe as this is a reputable site that certainly wouldn't mislead people into malware exploits. Thumb Up

suzi · Posted: Thu Mar 26, 2009 5:30 pm Post subject:

I went to the page and got the same warning from my Kaspersky AV. I also looked at the source code of the page and I believe Mikey is right. We've had people report similar issues on some of out HijackThis log threads a very few times.
_________________
Former Microsoft MVP 2005-2009, Consumer Security
Please do not PM or Email me for personal support. Post in the Forums instead and we will all learn. Smile