Attention Administrator: Trojan detected when clicking on thread

Discussion in 'adware, spyware & hijack cleaning' started by simplygib, May 20, 2004.

Thread Status:
Not open for further replies.
  1. simplygib

    simplygib Registered Member

    Joined:
    May 20, 2004
    Posts:
    2
    Hello - I just found this forum while searching for some malware/virus information. Nice site. However, I am getting a virus alert every time I click on the thread below called "spyware help" posted today by ralphtg (not the thread by the same name posted by KBKneeland). Other threads do not generate this warning.

    I am running McAfee Viruscan Enterprise 7.1.0 with latest updates. The warning states:

    Detected As: Exploit-URLSpoof.gen
    Name: showthread[1].php

    It seems to jump around in different subfolders of IE5.Content under Temporary Internet Files, and sometimes is detected as showthread[2].php. McAfee tries to delete the file and is often successful, but sometimes fails. Closing down, rebooting into safe mode and doing a full scan reveals nothing.

    Not sure if this is a false positive or not, but thought you might like to know.

    Gib
     
  2. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    Hi simplygib and welcome.

    Please read the info as provided over here in regard to this flag. Conclusion in short:

    a) triggered by an URL as mentioned in the post/log file you referred to - and as such no real hazard;

    b) you surely are advized to update Windows, as mentioned in the provided link above.

    regards.

    paul
     
  3. simplygib

    simplygib Registered Member

    Joined:
    May 20, 2004
    Posts:
    2
    Hi Paul, and thank you for the welcome and the information. I am running Win2k and routinely check for patches. Windows Update indicates no new patches available.

    After reading your post, I checked for the patch refered to in one of the links you provided (Q832894) and it was not installed on my computer, despite Windows Update not detecting any patches needed. After downloading and running 832894, I noticed another patch was gone that had been there previously (831167, overwritten, apparently). Windows Update then indicated 831167 was needed, and installing that removed 832894.

    So I assume 831167 supercedes 832894, which means my computer was already patched with the latest updates.

    Regardless, thanks again for the explanation on what's causing the alert.

    Gib
     
  4. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,472
    Location:
    The Netherlands
    My pleasure, gib ;)

    regards.

    paul
     
Thread Status:
Not open for further replies.