0

ClamAV Scan found the virus Html.Exploit.CVE_2016_0108 on a .css file. What are the risks? How do I remove the code from the file? Thanks for any help.

4
  • in a CSS?! How is that suppose to infect your system? Can anyone explain the concept?
    – Rinzwind
    Mar 9, 2016 at 17:58
  • 1
    CSS stylesheet files are used in web-browsers for formatting. Technically they are harmless, unless that file is masquerading itself with that .css extension. I would open the file in text editor and just read the source code for potential threats. Otherwise, really nothing to worry about Mar 9, 2016 at 18:05
  • 2
    and since Linux does not really care about extensions .... Oh: and windows only-> web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0108
    – Rinzwind
    Mar 9, 2016 at 18:19
  • What CSS-file was that Fernando? I'm Autoptimize's developer and have 2 users reporting this problem with the aggregated/ optimized CSS and would like to investigate (and possibly submitt this as a false positive, if/ when confirmed).
    – futtta
    Mar 10, 2016 at 9:07

3 Answers 3

2

clamav is notorious for false positives and there is no way to "remove the code from the file" - your only option is to manually review the file yourself or delete the file.

When you get a positive , you need to google search for information

http://bfy.tw/4fKd

Which gets to - https://clamxav.com/BB/viewtopic.php?p=17793

Up to you to trust that thread or do more research ...

If you need help , read the message / warning from clamav or post the exact message you re getting. You can pastebin the file and perhaps someone will review it.

See https://help.ubuntu.com/community/ClamAV

Clamav doesn't disinfect the files

See also How do I scan for viruses with ClamAV? and http://www.clamav.net/documents/miscellaneous-faq

Can ClamAV disinfect files?

No, it can’t.

1

I received the same alert regarding a few CSS files we had on our server starting yesterday morning. I was unable to get any help since this appears to be a new issue. I've come to the conclusion there is no fix except to white list this signature.

Doing some Googlin' I found that this has to do with an IE 11 vulnerability.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0108

http://www.scip.ch/en/?vuldb.81247

https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-0108

There doesn't seem to be a way to fix this. You can create a white list of virus signatures in the event of false positives. I don't think I'm going to run IE 11 on my Ubuntu server any time soon, so its safe to say you can ignore Html.Exploit.CVE_2016_0108

Following the instructions here I was able to successfully create an ignore list for ClamAV

http://sysnet-adventures.blogspot.com/2013/05/whitelist-files-with-clamav.html

create an ignore file using an editor of your choice, I'm using pico ( .ign2 indicates the new format http://pig.made-it.com/clamav.html )

pico /var/lib/clamav/whitelist-signatures.ign2 

And insert the signature

# /var/lib/clamav/whitelist-signatures.ign2
Html.Exploit.CVE_2016_0108

Then run a scan

sudo clamscan -r -i /path/to/dir/

You should see Infected files: 0

1

It seems most agree these are false positives, so best approach would be to submit them as such at http://www.clamav.net/reports/fp

I already did so for a couple of examples I was able to collect in Autoptimize's (CSS & JS optimizer for WordPress) thread on that topic.

frank

3
  • Oh nice! This is certainly a better approach, but in the mean time I'll be whitelisting. I don't need any more calls wondering why we're getting these Infection alerts via email! I also provided our sample CSS files that were triggering the false positives. Thanks for the link!
    – Eko3alpha
    Mar 10, 2016 at 18:34
  • @Eko3alpha; just had a confirmation mail from Clam AV, pretty vague though. would be great if you could confirm tomorrow if your CSS-files are still being flagged?
    – futtta
    Mar 11, 2016 at 19:21
  • 1
    I removed Html.Exploit.CVE_2016_0108 from the white list and ran the scan. I can confirm that the CSS files no longer trigger a false positive!
    – Eko3alpha
    Mar 11, 2016 at 19:27

Not the answer you're looking for? Browse other questions tagged .