ClamAV Scan found the virus Html.Exploit.CVE_2016_0108 on a .css file. What are the risks? How do I remove the code from the file? Thanks for any help.
closed as unclear what you're asking by Panther, mikewhatever, Terrance, Eric Carvalho, Braiam Mar 13 '16 at 14:41
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
clamav is notorious for false positives and there is no way to "remove the code from the file" - your only option is to manually review the file yourself or delete the file.
When you get a positive , you need to google search for information
Which gets to - https://clamxav.com/BB/viewtopic.php?p=17793
Up to you to trust that thread or do more research ...
If you need help , read the message / warning from clamav or post the exact message you re getting. You can pastebin the file and perhaps someone will review it.
Clamav doesn't disinfect the files
Can ClamAV disinfect files?
No, it can’t.
I received the same alert regarding a few CSS files we had on our server starting yesterday morning. I was unable to get any help since this appears to be a new issue. I've come to the conclusion there is no fix except to white list this signature.
Doing some Googlin' I found that this has to do with an IE 11 vulnerability.
There doesn't seem to be a way to fix this. You can create a white list of virus signatures in the event of false positives. I don't think I'm going to run IE 11 on my Ubuntu server any time soon, so its safe to say you can ignore Html.Exploit.CVE_2016_0108
Following the instructions here I was able to successfully create an ignore list for ClamAV
create an ignore file using an editor of your choice, I'm using pico ( .ign2 indicates the new format http://pig.made-it.com/clamav.html )
And insert the signature
# /var/lib/clamav/whitelist-signatures.ign2 Html.Exploit.CVE_2016_0108
Then run a scan
sudo clamscan -r -i /path/to/dir/
You should see Infected files: 0