Help Sought: When Using Mozilla Firefox AVG Reports Virus

Archived from groups: comp.security.firewalls (More info?)

Someone wrote:

>Hi,
>
>Has anybody come across the following problem?
>
>AVG Free Edition (Virus Database: 487 Release Date: 2nd August, 2004)
>reports that the computer could be infected by a virus - JS/Fortnight
>in \Mozilla\Firefox\Profiles\Default.A4E\Bookmarks.html
>
>Is this overprotective AVG or a problem with Firefox? Any ideas?
>Please advise?
>
>cya Ó¿Ó¬
>
>
You should not have any virus type files in your Bookmarks file, this is
a HTML file with nothing but text links to the web sites you have saved
as Bookmarks. This is a text only file saved in HTML. You can use
Firefox to open and read the Bookmarks.html file and review all text
links. Check over all the entries by placing your cursor over each
link, then read the URL down on the Status Bar. The Status Bar will
reveal the URL coding for the link. It is possible that an imported
bookmark from OE contains a redirect in the URL that AVG is warning
about. If you find such a link close Firefox, reopen it as a web
browser and go to Bookmarks/Manager and delete the suspect Bookmark.

Michael

Archived from groups: comp.security.firewalls (More info?)

"Michael" <mgordon2@BeamMeUpScottie.earthlink.net> wrote in message
news:10h73oiq2bsj019@corp.supernews.com...
> Someone wrote:
>
> >Hi,
> >
> >Has anybody come across the following problem?
> >
> >AVG Free Edition (Virus Database: 487 Release Date: 2nd August, 2004)
> >reports that the computer could be infected by a virus - JS/Fortnight
> >in \Mozilla\Firefox\Profiles\Default.A4E\Bookmarks.html
> >
> >Is this overprotective AVG or a problem with Firefox? Any ideas?
> >Please advise?
> >
> >cya Ó¿Ó¬
> >
> >
> You should not have any virus type files in your Bookmarks file, this is
> a HTML file with nothing but text links to the web sites you have saved
> as Bookmarks. This is a text only file saved in HTML. You can use
> Firefox to open and read the Bookmarks.html file and review all text
> links. Check over all the entries by placing your cursor over each
> link, then read the URL down on the Status Bar. The Status Bar will
> reveal the URL coding for the link. It is possible that an imported
> bookmark from OE contains a redirect in the URL that AVG is warning
> about. If you find such a link close Firefox, reopen it as a web
> browser and go to Bookmarks/Manager and delete the suspect Bookmark.
>
> Michael

If there's a risk of javascript in the HTML file that's being reported,
surely opening it in a browser is asking for trouble.

Open the file in a text editor, look for any javascript. There shouldn't be
any <script> tags in that file - if there are, something has infected it.

Dan

Archived from groups: comp.security.firewalls (More info?)

Spack wrote:

>"Michael" <mgordon2@BeamMeUpScottie.earthlink.net> wrote in message
>news:10h73oiq2bsj019@corp.supernews.com...
>
>
>>Someone wrote:
>>
>>
>>
>>>Hi,
>>>
>>>Has anybody come across the following problem?
>>>
>>>AVG Free Edition (Virus Database: 487 Release Date: 2nd August, 2004)
>>>reports that the computer could be infected by a virus - JS/Fortnight
>>>in \Mozilla\Firefox\Profiles\Default.A4E\Bookmarks.html
>>>
>>>Is this overprotective AVG or a problem with Firefox? Any ideas?
>>>Please advise?
>>>
>>>cya Ó¿Ó¬
>>>
>>>
>>>
>>>
>>You should not have any virus type files in your Bookmarks file, this is
>>a HTML file with nothing but text links to the web sites you have saved
>>as Bookmarks. This is a text only file saved in HTML. You can use
>>Firefox to open and read the Bookmarks.html file and review all text
>>links. Check over all the entries by placing your cursor over each
>>link, then read the URL down on the Status Bar. The Status Bar will
>>reveal the URL coding for the link. It is possible that an imported
>>bookmark from OE contains a redirect in the URL that AVG is warning
>>about. If you find such a link close Firefox, reopen it as a web
>>browser and go to Bookmarks/Manager and delete the suspect Bookmark.
>>
>>Michael
>>
>>
>
>If there's a risk of javascript in the HTML file that's being reported,
>surely opening it in a browser is asking for trouble.
>
>Open the file in a text editor, look for any javascript. There shouldn't be
>any <script> tags in that file - if there are, something has infected it.
>
>Dan
>
>
>
>
There is no risk of JavaScript in the Bookmarks.html. Mozilla creates
the file Bookmarks.html during the initial installation. When the user
saves a web page URL Mozilla copies the URL into Bookmarks.html as a
"Text Link".

It is the Links that might contain a redirect to a web site with
malicious content, that can be seen in the Statue Bar on the bottom of
the Mozilla window.

Michael

Archived from groups: comp.security.firewalls (More info?)

"Michael" <mgordon2@BeamMeUpScottie.earthlink.net> wrote in message
news:10havrcfiooorff@corp.supernews.com...
> There is no risk of JavaScript in the Bookmarks.html. Mozilla creates
> the file Bookmarks.html during the initial installation. When the user
> saves a web page URL Mozilla copies the URL into Bookmarks.html as a
> "Text Link".

If a virus/worm has written javascript into the bookmarks.html file, then
there is a risk if you just blindly open the file in any browser that
supports javascript. I'm not talking about Mozilla adding links to the file,
I'm talking about a possible issue if a virus/worm has been written to
infect either specifically that file, or all html files on the infected pc.
If AVG is reporting a possible virus in that file, it's possible that
something has modified it outside of Mozilla, isn't it?

Dan