NAV detected IFrame.Exploit zoo worm and won't delete/repair

[keiramackenzie]

Dear Users,

Just a minute ago, NAV (of my N.I.S. 2004 program) detected the virus 'iFrame.Exploit', but would not repair, or remove it, so I went to Symantec's site and checked up on this, using http://securityresponse.symantec.com/av...ploit.html

It gives you the removal instructions...http://www.microsoft.com/technet/sec.../MS01-020.asp.

and they tell me that I shouldn't have had the virus in the first place as I:

*Am running XP
*Have IE version 6.0.2800.1106.xpsp2.030422-1633

and they say it is something to do with a 'mime' function which IE 6 eliminates.

So, now I am stuck. I don't know how to remove the file. The only thing I have done is a clean-up i.e. deleted Temporary Internet Files from my browser, cookies, and history, but as NAV cannot access it I am afraid it is still romaing round my system!

If anyone has had this problem, or knows how exactly to deal with it, please let me know pls help as I am worried.

I have been suffering from a slow start-up, and generally slow processes aswell..(but this may be partly due to the fact I have 8.09 gb of my 18.6 gb hard drive left - due to digital camera photos needing to be compressed).

Until recently, I have also been experiencing problems with my PC automatically restarting, and am told this is something to do with a setting within XP which auto-restarts when something has caused an error, instead of giving you the blue error screen. But now, I am more worried I have virus(es)/ or worm(s) which N.I.S. is not detecting/protecting me against, and am in need of some good help.

Even though I regularly update my virus definitions/program updates/windows security updates and the like.....

...Is there a fool proof online scan which will test for ALL trojans/viruses, and clean them, or remove them, as I need to make sure I don't have some roaming around my PC?

Thank you for reading

[nomaxim]

Your links go to a general page. DO NOT PROVIDE INFO on what you have.

This should be your first link:
http://securityresponse.symantec.com...e.exploit.html

This is what you have:
http://securityresponse.symantec.com/av...ploit.html

Let me look at the info and get back to you.

[keiramackenzie]

Whoops! Apologies on the links..it's all getting a bit haywire here.

Thanks very much for taking a look for me - it's much needed.

[nomaxim]

Done.

NAV gives a link ( the MS link) to a patch.

Update IE is what it is saying.

From NAV site:

This vulnerability allows an individual to send you email that has an attachment containing malicious code; the author of the threat can enable the attachment to automatically run when you receive it.

This dosen't say you have anything, just that you are vulnerable.

Is that what NAV is telling you?

PS.
I use McAfee myself, but that's what I'm thinking it says. You could wait for one of the NAV user's to come along. Thay may have more input then I do.

[keiramackenzie]

Yeah, I know. But the update is for IE 5.1 and IE 5.5, but not for IE 6.

NAV came up telling me I had the iFrame.Exploit virus in a file, but would not access, repair or delete.

I did have a go at installing the patch anyway, just in case the file was missing from my IE 6, but it said it was 'Not Needed'..

this is why I am stuck...as there doesn't seem to be a solution now..

any help as to why I got the virus, when I already have the update, and how I can remove the virus would be much appreciated.

Could this be that I.E. is in need of repair (seems to be working fine), and in this case, is there anyway to test it, to tell me if files are missing/corrupt?

Or am I missing something else?

Thanks again for your help - it is still much needed..

[nomaxim]

Try this:
Browser Security Test

That's the most I can offer. Not familar with NAV, Sorry!

PS.
I use McAfee myself, but that's what I'm thinking it says. You could wait for one of the NAV user's to come along. Thay may have more input then I do.

[zen]

Well, what file was it?

[Jarhed7276]

It's not a virus it's an exploit meaning that it takes advantage of an existing flaw in IE. You get them from visiting websites that have malicious code written in them. The code will be downloaded even though you are patched but because you are patched the flaw cannot be exploited.

To remove the exploit you need to find the file(s) then manually delete it.