ClamAV Scan found the virus Html.Exploit.CVE_2016_0108 on a .css file. What are the risks? How do I remove the code from the file? Thanks for any help.
in a CSS?! How is that suppose to infect your system? Can anyone explain the concept?– RinzwindMar 9, 2016 at 17:58
1CSS stylesheet files are used in web-browsers for formatting. Technically they are harmless, unless that file is masquerading itself with that .css extension. I would open the file in text editor and just read the source code for potential threats. Otherwise, really nothing to worry about– Sergiy KolodyazhnyyMar 9, 2016 at 18:05
2and since Linux does not really care about extensions .... Oh: and windows only-> web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-0108– RinzwindMar 9, 2016 at 18:19
What CSS-file was that Fernando? I'm Autoptimize's developer and have 2 users reporting this problem with the aggregated/ optimized CSS and would like to investigate (and possibly submitt this as a false positive, if/ when confirmed).– futttaMar 10, 2016 at 9:07
clamav is notorious for false positives and there is no way to "remove the code from the file" - your only option is to manually review the file yourself or delete the file.
When you get a positive , you need to google search for information
Which gets to - https://clamxav.com/BB/viewtopic.php?p=17793
Up to you to trust that thread or do more research ...
If you need help , read the message / warning from clamav or post the exact message you re getting. You can pastebin the file and perhaps someone will review it.
Clamav doesn't disinfect the files
See also How do I scan for viruses with ClamAV? and http://www.clamav.net/documents/miscellaneous-faq
Can ClamAV disinfect files?
No, it can’t.
I received the same alert regarding a few CSS files we had on our server starting yesterday morning. I was unable to get any help since this appears to be a new issue. I've come to the conclusion there is no fix except to white list this signature.
Doing some Googlin' I found that this has to do with an IE 11 vulnerability.
There doesn't seem to be a way to fix this. You can create a white list of virus signatures in the event of false positives. I don't think I'm going to run IE 11 on my Ubuntu server any time soon, so its safe to say you can ignore Html.Exploit.CVE_2016_0108
Following the instructions here I was able to successfully create an ignore list for ClamAV
create an ignore file using an editor of your choice, I'm using pico ( .ign2 indicates the new format http://pig.made-it.com/clamav.html )
And insert the signature
# /var/lib/clamav/whitelist-signatures.ign2 Html.Exploit.CVE_2016_0108
Then run a scan
sudo clamscan -r -i /path/to/dir/
You should see Infected files: 0
It seems most agree these are false positives, so best approach would be to submit them as such at http://www.clamav.net/reports/fp
I already did so for a couple of examples I was able to collect in Autoptimize's (CSS & JS optimizer for WordPress) thread on that topic.
Oh nice! This is certainly a better approach, but in the mean time I'll be whitelisting. I don't need any more calls wondering why we're getting these Infection alerts via email! I also provided our sample CSS files that were triggering the false positives. Thanks for the link! Mar 10, 2016 at 18:34
@Eko3alpha; just had a confirmation mail from Clam AV, pretty vague though. would be great if you could confirm tomorrow if your CSS-files are still being flagged?– futttaMar 11, 2016 at 19:21
1I removed Html.Exploit.CVE_2016_0108 from the white list and ran the scan. I can confirm that the CSS files no longer trigger a false positive! Mar 11, 2016 at 19:27