[836] in winnt
VirusScan 4201 .DAT
daemon@ATHENA.MIT.EDU (Huxley, Bil)
Fri May 3 15:35:20 2002
Message-Id: <5.0.2.1.2.20020503152527.02f62c40@po9.mit.edu>
Date: Fri, 03 May 2002 15:35:59 -0400
To: itpartners@mit.edu, winpartners@mit.edu, mitvirus@mitvma.mit.edu
From: "Huxley, Bil" <huxley@MIT.EDU>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Hi All,
With all the recent virus related activity we've been seeing for the last
week, I was particularly curious when I noticed the Network Associates
released a "extra" .DAT today. After some time searching we found the
following reason for the release on the "New Bat" description within
"Recently Updated Viruses":
-- Update 5/03/2002 --
Due to a change in this heuristic detection of "New Bat" in the 4200 DAT
files, AVERT has received
reports of numerous false detections. This only occurs when scanning with
macro heuristics enabled.
The 4201 DAT files will be released shortly to fix this issue for those
users who run macro heuristics.
This is a heuristic detection which indicates a file might be infected
with a batch file virus. Send a
sample to AVERT for analysis.
The ReadMe for 4201 states that .SWF is added to 'files to scan' list, but
we're all scanning 'All Files' anyway (right? :)
I thought it might save others some time if I passed this along,
Bil
P.S. While searching for this I also found a better explanation for the
out-of-cycle release of 4199 last Thursday
This is a generic detection for an Internet Explorer, Back Button Cross
Site Scripting exploit. By
manipulating the browser history, it can cause arbitrary code to execute
when the back button is
pressed.
At the time of this writing, a patch was not available from Microsoft.
Using VirusScan or the McAfee.com scanner, and the 4198 DATs, will
result in the products
incorrectly detecting this exploit in some files and/or on webpages,
such as www.travelocity.com and
Travelociy partner sites including USAirways.com. The message from
VirusScan will tell you that the
JS/Exploit-BackCSS program has been detected on pages such as the
"Select An Airline" pages.
This virus/exploit does not exist, to AVERT's knowledge, on any page at
the www.travelocity.com
website.
The 4199 DATs were released early and correct this problem. Please
UPDATE your DAT files ASAP.
