Exploit Virus Found after loading SP2

[Guest]

I installed Windows XP SP2 several weeks ago without incident. Today my
Norton Anti-virus program found MHTMLRedir.Exploit on my PC. I searched the
Symantec web site and found the virus should have been removed with MS
Security Patch 837009 pre-SP2. I tried to run the patch but received an error
message stating the patch cannot be run without Internet Explorer 6.0 SP1
being run. Does Windows XP SP2 load all previous SP1 patches and updates? Is
there anything I should do to minimize the risk to my computer and IE6?

 

[Frank Saunders, MS-MVP IE/OE]

I installed Windows XP SP2 several weeks ago without incident. Today
my Norton Anti-virus program found MHTMLRedir.Exploit on my PC. I
searched the Symantec web site and found the virus should have been
removed with MS Security Patch 837009 pre-SP2. I tried to run the
patch but received an error message stating the patch cannot be run
without Internet Explorer 6.0 SP1 being run. Does Windows XP SP2 load
all previous SP1 patches and updates? Is there anything I should do
to minimize the risk to my computer and IE6?

SP2 includes all patches that came out before SP2 was released.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

Caravaggio,
Did Norton report it only as a file in the IE temporary files area?
The MHTMLRdir.exploit can be detected by Norton in two ways, as a file
during a scan or when you visit a web site and the exploit runs, since it is
script contained in a web page.

When you visit a web site that runs the exploit script, it will attemp to
download another file or program (usually a trojan). With SP2's security,
scripting is off by default, so the web page with the offending script will
end up in your browser cache (temp files), without ever being a threat.
Norton may not catch it on the way in because it is looking for the action of
the script running, not the code in the file.

Try clearing IE's temporary files* and then rescanning to be sure it's gone.
If the exploit actually ran, the trojan code should be caught with a scan
with an updated version of Norton

Hope this helps
-J

Menu item Tools/Internet Options - click on Delete Files button.