Expert: Murray S. - 11/7/2004

Question
While viewing a website my Norton antivirus auto-protect detected an mhtmlredir.exploit in my system. As soon as I clicked the ok button it detected another mhtmlredir.exploit. I quickly left that website. The next day when I opened my browser before I even went to any websites Norton came on the screen and it said it detected yet another mhtmlredir.exploit I then did a full Norton scan and found a mhtmlredir.exploit in my cache files. At the Symantec website it stated that this exploit only affects Internet Exploer. However I never use Internet Explorer I only use my Netscape browser. So my question is if this exploit only affects Internet Explorer how did it get into my Netscape cache files. I would also like to know how that exploit got past my Norton auto-protect feature.    Thanks Alan

Answer
Howdy:

First of all, Norton did do something as you got the message..  as per their website...

"Because this is an exploit only, there are no removal instructions, since there is nothing to remove. This is a detection for the exploit, preventing the execution of malicious content on your computer. By detecting the exploit, it is prevented from running."

As per another site (please read the bottom)..  Did you install the patch as suggested by BOTH Norton and this site??

HTML.MHTMLRedir.exploit is a generic detection of web pages or e-mail messages which attempt to exploit the "MHTML URL Processing" vulnerability in Internet Explorer. For more information specific to this vulnerability, please visit our Vulnerability Information Center.

This does not necessarily mean that a virus has been found. It merely means that HTML code was found which attempts to activate additional executable code without the user's express permission. This exploit can be used in a malicious web page or inside e-mail messages to execute code of the attacker's choice on the user's machine.  Users of Internet Explorer and applications such as Outlook or Outlook Express that employs Internet Explorer to render HTML content are vulnerable to this exploit.

Microsoft have released a patch to address this issue. Please visit Microsoft for further information and to apply the relevant patches:

http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx

Murray