270950 - I found the virus "MHTMLRedir.Exploit" downloaded via mozilla's browser.

Status: RESOLVED INVALID

(Core :: DOM: HTML Parser, defect)

Description

[Rex Stevens]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040927
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a4) Gecko/20040927

I noticed during my virus scan the the "MHTMLRedir.Exploit" can be downloaded
into the mozilla cache through the browser.  I'm going to check my logs and see
what site downloaded the virus and then attempt to duplicate it.

Reproducible: Didn't try
Steps to Reproduce:
1.
2.
3.

Comment 1

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

Web pages are downloaded into the cache during normal browser operation. If the
browser were vulnerable it would be infected upon processing the page whether or
not a copy is saved locally (the browser can operate with the cache turned off,
it just results in slower performance).

The cached copy is not a danger to your system. The AV warning is useful for
several reasons:
 - you can check the exploit details and make sure your browser is safe,
   or if it's not then what steps you can take to clean up the infection
 - it alerts you that you've wandered into a "bad part of town" on the web
   and can avoid those sites (or possibly that a reputable site was hacked).