cancel
Showing results for 
Search instead for 
Did you mean: 
bigninja
Level 7

McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

While playing a MSN Free online solitaire game, I keep getting a popup message from McAfee Antivirus saying, " It has removed Exploit Iframe trojan." Problem is it happens numerous times. Shouldn't McAfee block the same virus from entering or is it just not totally removing all traces? What should I do next? The popup says I don't need to do anything else, but aparently I do. I have the latest virus updates. Windows 7 Ultimate. Explorer 9.

Message was edited by: bigninja on 6/13/12 6:46:51 PM CDT
0 Kudos
10 Replies
Peacekeeper
Level 20

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

The info on this 2005 issue says the dats should remove the problem. maybe as it is malicious IFrames embedded on various legitimate websites these iframes might be reloaded.

Unsure here is some info

https://community.mcafee.com/message/32448#32448

Have you tried stinger and Malwarebytes?

McAfee Communities: Anti-Spyware, Malware & Hijacker Tools

0 Kudos
bigninja
Level 7

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

McAfee has detected and removed 18 trojans as of 6/15/12, all while playing a MSN free online game. I used Stinger and Malwarebytes with no success. No viruses or trojans detected while manually scanning. McAfee automatically detects trojans only while playing the game. Hence they must be getting downloaded from the MSN site along with the game. I emailed a fellow game player, who also has McAfee, said he has never seen a trojan. Would this mean that someone is deliberately singling me out? That is the only way I know that makes any sense why I am the only one targeted multiple times. 18 attempts so far. Very unusual wouldn't you think?

0 Kudos
Peacekeeper
Level 20

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

In the link above run the getsusp program ensure your email addy is in the preferences.

Sorry no good on virus removal

Where are the trojans reported as residing? Have you considered restoring the PC to a day before this started?

Message was edited by: Peacekeeper on 18/06/12 7:50:30 PM

Message was edited by: Peacekeeper on 19/06/12 6:36:53 AM
0 Kudos
Hayton
Level 17

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

MSN shows 10 different Solitaire games. Which one is causing the problem? I should be able to reproduce this if I know which game it is.

0 Kudos
bigninja
Level 7

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

Addiction Solitaire, this is a new game. I had 18 trojans removed while playing for two days. I did notice that it seemed to happen only when I had downloaded 2 or more of the same game at one time. I stopped playing that game and haven;t had any trojans since. So it was definately from that game.

0 Kudos
Hayton
Level 17

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

MSN doesn't have Addiction Solitaire but Yahoo Games does, and the page at http://games.yahoo.com/console/sa needs Java, presumably to play the game. And Java is the single worst entry point for getting infected with trojans and other malware. If this is what you meant, and you've got Java installed on your system, my advice is first to uninstall it completely - not forgetting any add-ons, plug-ins or extensions in your browsers - and then go to http://java.com/en/download/manual.jsp to get the latest version (JRE 7.5). While you're there you should read the section on Uninstalling Earlier Versions (at http://java.com/en/download/faq/remove_olderversions.xml). Once you've got it make sure you keep it updated; they keep finding bugs in it and the malware authors are quick to turn those bugs into working infections.

And if that's not the game you meant which one is it?

0 Kudos
bigninja
Level 7

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

MSN has Addiction Solitaire as you can see by clicking on the shortcut below. Look on the right side of the page under "Recently released free games."

I ran the JAVA detector and it said no working JAVA found on my notebook. I have been avoiding JAVA everytime a game wants to install it.

http://zone.msn.com/en-us/home?intgid=ba_Nav_1.

Message was edited by: bigninja on 6/19/12 4:54:18 AM CDT
0 Kudos
Hayton
Level 17

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

A-ha! So it does. I blame Bing, which ignored MSN and just displayed the Yahoo results.

Interesting : in Chrome I get a "blocked pop-up" warning, there are cookies blocked (not unusual) and DNTP+ shows that it has blocked 3 tracking ad networks and 3 tracking companies, including Appnexus and Adnexus. Flash is blocked, as it is on all sites (by default) in my Chrome installation. No Trojans; but I have this message - and the game does not load. It opens a new window but doesn't display.

Important Note: Your browser or operating system does not meet the minimum requirements to play on MSN Games. You may be able to download games for offline play; however, the online games can be played only with Internet Explorer version 7 or later, and Windows XP or later

In Firefox I have an enforce-HTTPS rule, and I see a warning about insecure content (not all elements are coming over a secure link). NoScript is blocking scripts from footprint.net and img.widgets.video.s-msn.com, but the game downloads and displays. In FF Flash is enabled, so that explains the Chrome display failure. No Trojans.

A thought : Flash is also notoriously buggy and gets updated about every week, or so it seems. The version-checking process is tiresome but necessary; you need to have the very latest version to be safe from the current round of malware exploits. In that respect it's exactly like Java. The best guide to updating I've come across is this one - http://krebsonsecurity.com/2012/06/critical-security-fixes-for-adobe-flash-player/

I'll play on a bit further but I suspect I won't find any Trojans because a) I'm fully patched in absolutely everything, and b) I treat websites as enemy territory. I go in with shields up. If there's an exploit waiting to pounce it rarely has a chance to succeed.

Edit - There's a note in Chrome of a new blocked cookie, this time from mochibot.com - and here's what mochibot does.

MochiBot is a Flash traffic monitoring tool (similar to a hit counter) that tracks the performance of individual Flash content files (SWFs) no matter where they end up on the web.

Wherever the iframes are coming from, they are likely to be from an external source, so it pays to monitor the changes as the game progresses.

Message was edited by: Hayton on 20/06/12 06:13:15 IST
0 Kudos
bigninja
Level 7

Re: McAfee Antivirus keeps removing Exploit-Iframe trojan. What should I do?

Stopped playing Addiction Solitaire and no more signs of trojans. Another new game just released, Royal Envoy, and the trojans are back again.

0 Kudos