A Trojan called Exploit.HTML/Frame_Exploit.D

06-10-2008

"StephenB" <sboots@xxxxxx> wrote in message
news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx

Quote:

> "Jdr" <jdr@xxxxxx> wrote:
>

	Quote:
	>>Why do I get every day at 9:00 am GMT a Trojan called >>Exploit.HTML/Frame_Exploit.D >>which fails the Quarantine by OneCare every time? Ist i a nasty hacker >>doing or is Microsoft >> testing it's own OneCare ?

> See this post for information about Quarantine Failed -
> http://forums.microsoft.com/WindowsO...48384&SiteID=2
>
> Basically, the infection is likely located in a compressed file or mail
> store as
> an attachment. OneCare won't quarantine from there.
> -steve
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

Thanks for your information, Stephen.
For some I didn't treat seriously enough this Exploit.HTML/Frame_Exploit.D
May be because there was not enough info provided by OneCare as to where
and what it is? I think there is problem for MS and OneCare Team, as this
"Exploit.HTML/Frame_Exploit.D " seems to be not only may case.
I'll se what I can do about it, but I wonder WHY MS OneCare Team
doesn't deal with this problem competently?

Jdr

06-10-2008

"Jdr" <jdr@xxxxxx> wrote:

Quote:

>"StephenB" <sboots@xxxxxx> wrote in message
>news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx

Quote:

>> "Jdr" <jdr@xxxxxx> wrote:
>>

	Quote:
	>>>Why do I get every day at 9:00 am GMT a Trojan called >>>Exploit.HTML/Frame_Exploit.D >>>which fails the Quarantine by OneCare every time? Ist i a nasty hacker >>>doing or is Microsoft >>> testing it's own OneCare ?

>> See this post for information about Quarantine Failed -
>> http://forums.microsoft.com/WindowsO...48384&SiteID=2
>>
>> Basically, the infection is likely located in a compressed file or mail
>> store as
>> an attachment. OneCare won't quarantine from there.
>> -steve
>> --
>> Stephen Boots
>> MVP Windows Live
>> Windows Live OneCare Forum Moderator
>> sboots@xxxxxx

>
>
>
>Thanks for your information, Stephen.
>For some I didn't treat seriously enough this Exploit.HTML/Frame_Exploit.D
>May be because there was not enough info provided by OneCare as to where
>and what it is? I think there is problem for MS and OneCare Team, as this
>"Exploit.HTML/Frame_Exploit.D " seems to be not only may case.
>I'll se what I can do about it, but I wonder WHY MS OneCare Team
>doesn't deal with this problem competently?
>
>Jdr

I'm not sure that I say that they don't deal with it competently. I think it is
unfortunate messaging from OneCare regarding "Quarantine Failed." However, your
option is to contact support for help with removal of the threat. All antivirus
products are fighting a never ending battle to keep up with the latest threats.
Note that even if you see the Quarantine Failed message, the threat was
identified and blocked.
-steve
--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

**SCSIraidGURU** · 06-10-2008

I would not implement OneCare on my corporate network or my home network until it was proven to work. I would add a proper anti-virus solution to protect you from harm. It is too new to trust. I am sure Microsoft is working on Trojan detection and removal. This is very tricky to program and accomplish. Anti-virus Trojan Horse detection and removal either works or fails. No such thing as partial works with viruses and Trojan Horses.

I would get another product that does work against Trojan Horses properly.

06-10-2008

"SCSIraidGURU" <guest@xxxxxx-email.com> wrote in message
news:568ac7a95f7d25dd624fd4b0ec352cb2@xxxxxx-gateway.com...

	Quote:
	> > I would not implement OneCare on my corporate network or my home network > until it was proven to work. I would add a proper anti-virus solution > to protect you from harm. It is too new to trust. I am sure Microsoft > is working on Trojan detection and removal. This is very tricky to > program and accomplish. Anti-virus Trojan Horse detection and removal > either works or fails. No such thing as partial works with viruses and > Trojan Horses. > > I would get another product that does work against Trojan Horses > properly.

Well, Mr. Guru, if you find one, let us know. I've been in IT for 28 years
now, and have dealt with just about every anti-virus and anti-spyware
scenario you can think of. Then one day, in order to "un-freeze" a cordless
mouse, I accidentally clicked on some web banner, and unleashed a tirade on
my laptop. Absolutely nothing would remove it, the worst trojan I'd ever
encountered. Windows Live OneCare fixed it flat and it's never come back.
Since then, I again somehow got another bogus trojan on my desktop. I
installed WLOC and it's gone.

BTW, Stephen, I got my CD from Amazon today. While I consider myself to be
fairly intelligent, I about had a fit trying to figure out how to open the
package. In fact, I destroyed the packaging before finally realizing that
it's a "tilt-out" type package... Sheesh, they need to put some opening
instructions on that danged thing. It was also a little frustrating that I
had to uninstall and reinstall. I have three laptops with one registration
already, so I wasn't sure how exactly it was going to unlock this new
package for my desktop, but I finally got it all done.

06-10-2008

"Bill Hileman" <discgolfdad@xxxxxx> wrote:

Quote:

>"SCSIraidGURU" <guest@xxxxxx-email.com> wrote in message
>news:568ac7a95f7d25dd624fd4b0ec352cb2@xxxxxx-gateway.com...

	Quote:
	>> >> I would not implement OneCare on my corporate network or my home network >> until it was proven to work. I would add a proper anti-virus solution >> to protect you from harm. It is too new to trust. I am sure Microsoft >> is working on Trojan detection and removal. This is very tricky to >> program and accomplish. Anti-virus Trojan Horse detection and removal >> either works or fails. No such thing as partial works with viruses and >> Trojan Horses. >> >> I would get another product that does work against Trojan Horses >> properly.

>
>Well, Mr. Guru, if you find one, let us know. I've been in IT for 28 years
>now, and have dealt with just about every anti-virus and anti-spyware
>scenario you can think of. Then one day, in order to "un-freeze" a cordless
>mouse, I accidentally clicked on some web banner, and unleashed a tirade on
>my laptop. Absolutely nothing would remove it, the worst trojan I'd ever
>encountered. Windows Live OneCare fixed it flat and it's never come back.
>Since then, I again somehow got another bogus trojan on my desktop. I
>installed WLOC and it's gone.
>
>BTW, Stephen, I got my CD from Amazon today. While I consider myself to be
>fairly intelligent, I about had a fit trying to figure out how to open the
>package. In fact, I destroyed the packaging before finally realizing that
>it's a "tilt-out" type package... Sheesh, they need to put some opening
>instructions on that danged thing. It was also a little frustrating that I
>had to uninstall and reinstall. I have three laptops with one registration
>already, so I wasn't sure how exactly it was going to unlock this new
>package for my desktop, but I finally got it all done.
>

Yes, that packaging is indeed a nightmare, Bill! That little red tab is not very
obvious and when it looks like a book, I expect it to open like a book!
-steve
--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

**SCSIraidGURU** · 06-10-2008

I hope it works for you.

06-11-2008

"StephenB" <sboots@xxxxxx> wrote in message
news:sk1t4495eoa5i06nmmb2qu7vnump353df1@xxxxxx

Quote:

> "Jdr" <jdr@xxxxxx> wrote:
>

Quote:

>>"StephenB" <sboots@xxxxxx> wrote in message
>>news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx

	Quote:
	>>> "Jdr" <jdr@xxxxxx> wrote: >>> >>>>Why do I get every day at 9:00 am GMT a Trojan called >>>>Exploit.HTML/Frame_Exploit.D >>>>which fails the Quarantine by OneCare every time? Ist i a nasty hacker >>>>doing or is Microsoft >>>> testing it's own OneCare ? >>> See this post for information about Quarantine Failed - >>> http://forums.microsoft.com/WindowsO...48384&SiteID=2 >>> >>> Basically, the infection is likely located in a compressed file or mail >>> store as >>> an attachment. OneCare won't quarantine from there. >>> -steve >>> -- >>> Stephen Boots >>> MVP Windows Live >>> Windows Live OneCare Forum Moderator >>> sboots@xxxxxx

>>
>>
>>
>>Thanks for your information, Stephen.
>>For some I didn't treat seriously enough this Exploit.HTML/Frame_Exploit.D
>>May be because there was not enough info provided by OneCare as to where
>>and what it is? I think there is problem for MS and OneCare Team, as
>>this
>>"Exploit.HTML/Frame_Exploit.D " seems to be not only may case.
>>I'll se what I can do about it, but I wonder WHY MS OneCare Team
>>doesn't deal with this problem competently?
>>
>>Jdr

>
> I'm not sure that I say that they don't deal with it competently. I think
> it is
> unfortunate messaging from OneCare regarding "Quarantine Failed." However,
> your
> option is to contact support for help with removal of the threat. All
> antivirus
> products are fighting a never ending battle to keep up with the latest
> threats.
> Note that even if you see the Quarantine Failed message, the threat was
> identified and blocked.
> -steve
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

	Quote:
	> I'm not sure that I say that they don't deal with it competently.

It's not what you're saying. It's what it is...-

I am the end user of this application (OneCare). If this application
fails to accomplish the task which it suppose to accomplish - then
it fails. Selling / offering the product for public use, which is not
doing properly its job - it is a feature of incompetence or even
worse...-

Jdr

06-11-2008

"StephenB" <sboots@xxxxxx> wrote in message
news:sk1t4495eoa5i06nmmb2qu7vnump353df1@xxxxxx

Quote:

> "Jdr" <jdr@xxxxxx> wrote:
>

Quote:

>>"StephenB" <sboots@xxxxxx> wrote in message
>>news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx

	Quote:
	>>> "Jdr" <jdr@xxxxxx> wrote: >>> >>>>Why do I get every day at 9:00 am GMT a Trojan called >>>>Exploit.HTML/Frame_Exploit.D >>>>which fails the Quarantine by OneCare every time? Ist i a nasty hacker >>>>doing or is Microsoft >>>> testing it's own OneCare ? >>> See this post for information about Quarantine Failed - >>> http://forums.microsoft.com/WindowsO...48384&SiteID=2 >>> >>> Basically, the infection is likely located in a compressed file or mail >>> store as >>> an attachment. OneCare won't quarantine from there. >>> -steve >>> -- >>> Stephen Boots >>> MVP Windows Live >>> Windows Live OneCare Forum Moderator >>> sboots@xxxxxx

>>
>>
>>
>>Thanks for your information, Stephen.
>>For some I didn't treat seriously enough this Exploit.HTML/Frame_Exploit.D
>>May be because there was not enough info provided by OneCare as to where
>>and what it is? I think there is problem for MS and OneCare Team, as
>>this
>>"Exploit.HTML/Frame_Exploit.D " seems to be not only may case.
>>I'll se what I can do about it, but I wonder WHY MS OneCare Team
>>doesn't deal with this problem competently?
>>
>>Jdr

>
> I'm not sure that I say that they don't deal with it competently. I think
> it is
> unfortunate messaging from OneCare regarding "Quarantine Failed." However,
> your
> option is to contact support for help with removal of the threat. All
> antivirus
> products are fighting a never ending battle to keep up with the latest
> threats.
> Note that even if you see the Quarantine Failed message, the threat was
> identified and blocked.
> -steve
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

PS.
Just to let you know that I uninstalled OneCare and went back to
Norton 360 which identified the Trojan and deleted infected file.
This is what I call "competence"...-

06-11-2008

"Jdr" <jdr@xxxxxx> wrote:

Quote:

>"StephenB" <sboots@xxxxxx> wrote in message
>news:sk1t4495eoa5i06nmmb2qu7vnump353df1@xxxxxx

Quote:

>> "Jdr" <jdr@xxxxxx> wrote:
>>

	Quote:
	>>>"StephenB" <sboots@xxxxxx> wrote in message >>>news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx >>>> "Jdr" <jdr@xxxxxx> wrote: >>>> >>>>>Why do I get every day at 9:00 am GMT a Trojan called >>>>>Exploit.HTML/Frame_Exploit.D >>>>>which fails the Quarantine by OneCare every time? Ist i a nasty hacker >>>>>doing or is Microsoft >>>>> testing it's own OneCare ? >>>> See this post for information about Quarantine Failed - >>>> http://forums.microsoft.com/WindowsO...48384&SiteID=2 >>>> >>>> Basically, the infection is likely located in a compressed file or mail >>>> store as >>>> an attachment. OneCare won't quarantine from there. >>>> -steve >>>> -- >>>> Stephen Boots >>>> MVP Windows Live >>>> Windows Live OneCare Forum Moderator >>>> sboots@xxxxxx >>> >>> >>> >>>Thanks for your information, Stephen. >>>For some I didn't treat seriously enough this Exploit.HTML/Frame_Exploit.D >>>May be because there was not enough info provided by OneCare as to where >>>and what it is? I think there is problem for MS and OneCare Team, as >>>this >>>"Exploit.HTML/Frame_Exploit.D " seems to be not only may case. >>>I'll se what I can do about it, but I wonder WHY MS OneCare Team >>>doesn't deal with this problem competently? >>> >>>Jdr

>>
>> I'm not sure that I say that they don't deal with it competently. I think
>> it is
>> unfortunate messaging from OneCare regarding "Quarantine Failed." However,
>> your
>> option is to contact support for help with removal of the threat. All
>> antivirus
>> products are fighting a never ending battle to keep up with the latest
>> threats.
>> Note that even if you see the Quarantine Failed message, the threat was
>> identified and blocked.
>> -steve
>> --
>> Stephen Boots
>> MVP Windows Live
>> Windows Live OneCare Forum Moderator
>> sboots@xxxxxx

>
>

	Quote:
	>> I'm not sure that I say that they don't deal with it competently.

>
>It's not what you're saying. It's what it is...-

>I am the end user of this application (OneCare). If this application
>fails to accomplish the task which it suppose to accomplish - then
>it fails. Selling / offering the product for public use, which is not
>doing properly its job - it is a feature of incompetence or even
>worse...-

>Jdr

Jdr,
Let's go back.
The original issue was that OneCare identified a threat, but reported
"Quarantine failed" as the outcome. I agree that this is a problem. However, the
threat was blocked from perfoming its intended action. The fact that it was not
removed automatically is the only issue here.
I don't believe that you will find any single security program that can prevent
100% of threats.
-steve
--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

06-11-2008

"StephenB" <sboots@xxxxxx> wrote in message
news:bn3v44t7ondpfnroj3300g2hj38heis5v1@xxxxxx

Quote:

> "Jdr" <jdr@xxxxxx> wrote:
>

Quote:

>>"StephenB" <sboots@xxxxxx> wrote in message
>>news:sk1t4495eoa5i06nmmb2qu7vnump353df1@xxxxxx

	Quote:
	>>> "Jdr" <jdr@xxxxxx> wrote: >>> >>>>"StephenB" <sboots@xxxxxx> wrote in message >>>>news:gbpq449sq05vj5rqj5pngq81v7bbc5vjul@xxxxxx >>>>> "Jdr" <jdr@xxxxxx> wrote: >>>>> >>>>>>Why do I get every day at 9:00 am GMT a Trojan called >>>>>>Exploit.HTML/Frame_Exploit.D >>>>>>which fails the Quarantine by OneCare every time? Ist i a nasty >>>>>>hacker >>>>>>doing or is Microsoft >>>>>> testing it's own OneCare ? >>>>> See this post for information about Quarantine Failed - >>>>> http://forums.microsoft.com/WindowsO...48384&SiteID=2 >>>>> >>>>> Basically, the infection is likely located in a compressed file or >>>>> mail >>>>> store as >>>>> an attachment. OneCare won't quarantine from there. >>>>> -steve >>>>> -- >>>>> Stephen Boots >>>>> MVP Windows Live >>>>> Windows Live OneCare Forum Moderator >>>>> sboots@xxxxxx >>>> >>>> >>>> >>>>Thanks for your information, Stephen. >>>>For some I didn't treat seriously

06-10-2008	#13 (permalink)
SCSIraidGURU Guru Join Date: May 2008 Vista x64 Ultimate 937 posts Rep Power: 47	Re: A Trojan called Exploit.HTML/Frame_Exploit.D I would not implement OneCare on my corporate network or my home network until it was proven to work. I would add a proper anti-virus solution to protect you from harm. It is too new to trust. I am sure Microsoft is working on Trojan detection and removal. This is very tricky to program and accomplish. Anti-virus Trojan Horse detection and removal either works or fails. No such thing as partial works with viruses and Trojan Horses. I would get another product that does work against Trojan Horses properly.
My System Specs

06-10-2008	#16 (permalink)
SCSIraidGURU Guru Join Date: May 2008 Vista x64 Ultimate 937 posts Rep Power: 47	Re: A Trojan called Exploit.HTML/Frame_Exploit.D I hope it works for you.
My System Specs