1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Resolved Exploit.Iframe.Vulnerability

Discussion in 'Security and Privacy' started by Ken52, 2010/07/13.

Page 1 of 2
  1. 2010/07/13
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    I have what appears to be a strange situation. I'm using Windows XP SP3, Explorer 8 and Outlook 2003.

    During a virus scan an "Exploit.Iframe.Vulnerability" was detected in my outlook.pst file. My security software (Bell Canada using Radial Point Services) quarantined the file.

    I had a heck of a time restoring the outlook.pst but needed to do this in order to get several email that were crucial.

    I can only find info on the Exploit.Iframe.Vulnerability 'virus' from 2004 and earlier. Apparently it was fixed with a patch from Microsoft for IE4 & IE5 so it doesn't seem to make sense to encounter this now. Yet it sure caused a major problem.

    Any suggestions on how to get rid of it without deleting my .pst file are greatly appreciated. How the heck can I scan individual emails?

    Regards,
    Ken
     
    Ken52,
    #1
  2. 2010/07/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You have to worry about two items only
    - links inside the mail (as long, as you don't click on any suspicious link, you can read your mail and you're fine)
    - attachments (you can download it to your desktop and scan it as any other file; as long, as you don't open the attachment, you're OK)
     
    broni,
    #2


  3. to hide this advert.

  4. 2010/07/14
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    Thank you Broni. Problem is I have many, many emails with attachments, years of them, and I have no way of knowing which one has the virus. Any suggestions on how to find it among all the others?
     
    Ken52,
    #3
  5. 2010/07/14
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    A virus in an attachment will not be an image file and will probably have a very long file name. Save the attachments to a new dir on your Desktop. The virus will likely be an htm or html file with embedded links to malicious code.
     
    TonyT,
    #4
  6. 2010/07/14
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I'm not aware of any way, other than checking them one by one.
    However, I'd simply do nothing.
    There is no threat, as long, as don't open any attachment.
    So, if for any reason you need to work on some old mail and it has some attachment, scan in then.
     
    broni,
    #5
  7. 2010/07/15
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Is the AV quarantining the entire Outlook.PST or just the single infected message? If just the single message then no worries, as you have been disinfected.

    If the entire PST then you'll have to disable the AV, save ALL the attachements, reenable the AV and scan them all. Then open Outlook and delete the infected message.

    The AV shoiuld have a log where you can read which message was infected.
     
    TonyT,
    #6
  8. 2010/07/15
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    Thank you Tony. The entire outlook.pst file was quarantined. So I have begun the process, as you suggested, and I'm checking each attachment.
     
    Ken52,
    #7
  9. 2010/07/15
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    I'd also look into a different antivirus software, it should be "smart" enough to not class a PST as an infected file, but should only check the messages when Outlook is opened. Perhaps yours has a setting to exclude the outlook.pst from system scans.
     
    TonyT,
    #8
  10. 2010/07/15
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No AV program, I'm aware of will single out just one email.
    The reason is simple.
    A single email is not a file. AV programs scan files, such as Inbox folder, which IS a file.
     
    broni,
    #9
  11. 2010/07/16
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    Thanks Tony, I'm questioning the service provider, Bell Canada, on why the AV software didn't detect the virus "on arrival." (Bell license the s/w from Radialpoint.) They don't have a clue as to 'why'. After the .pst file was quarantined the first time and I was able to recover it, I changed the settings so that the AV wouldn't scan the .pst file at all. And I also copied the file in a different directory that wasn't to be scanned. But, the next scan quarantined both files! So there must be a glitch in the s/w. I'm waiting for a call from Bell to explain the "whys ". I hope I'm not disappointed but I talked to five 'experts' there already. Thx again.
     
    Ken52,
    #10
  12. 2010/07/16
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    There is no perfect AV program. It doesn't exist.
     
    broni,
    #11
  13. 2010/07/16
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    I absolutely agree 100% and more with you, Broni.
     
    Ken52,
    #12
  14. 2010/07/17
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    I realize that. I was referring to 'real time protection' integrated with email clients. When that function is running it will flag a single message, as the AV filters the inbound messages, usually via a localhost proxy server.

    If one uses an AV that filters messages then then one can exclude the message stores from system scans.
     
    TonyT,
    #13
  15. 2010/07/17
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    I've received a call from Bell and I asked them that question: why didn't the anti-virus software detect the virus on the incoming message? They haven't got a clue and they're looking into it further. I assume they'll need to talk to Radial Point as it's their s/w. I'm supposed to receive a follow-up call from Bell today.
     
    Ken52,
    #14
  16. 2010/07/18
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    The reason it may not have detected it upon receipt is because it probably couldn't detect it when it was received. AV programs get updated with new detection rules so they can detect newest malware.

    You had an infected message.
    AV was update later on.
    AV can now detect that virus upon receipt if arrives again.

    Else the AV is executing a False Positive (erroneously flagging something as a virus when it really isn't)
     
    TonyT,
    #15
  17. 2010/07/19
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    Thanks Tony. I understand your comment but this particular virus was supposedly eliminated with a patch way back in IE5 days. I've also now gone thru all the attachments and nothing shows up with the virus. This makes me think that it is a 'false positive.' I'm expecting to receive a call from Bell today and hopefully that will clarify.
     
    Ken52,
    #16
  18. 2010/07/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Btw, I just found out, that BitDefender online scanner will indicate single infected emails :)

    BitDefender Online Scan
     
    broni,
    #17
  19. 2010/07/19
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,072
    Likes Received:
    400
    Thanks, that's good to know, esp for mbx type clients.
     
    TonyT,
    #18
  20. 2010/07/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're welcome :)
     
    broni,
    #19
  21. 2010/07/20
    Ken52

    Ken52 Inactive Thread Starter

    Joined:
    2010/07/13
    Messages:
    11
    Likes Received:
    0
    Thanks Broni, I'm running the bitdefender scan now. I'm leaving outlook open as I run this scan. When I do that with the AV I'm using it doesn't detect anything. It's only when outlook is closed. If bitdefender doesn't find anything with outlook open then I'll back-up my pst file, close it and run the scan again. I'll let you know what happens. Oh, BTW, Bell refered the issue to Radial Point - they sent an email saying they would contact me. Haven't heard from them yet. Thanks again. Ken
     
    Ken52,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...