ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Can I safely delete "Exploit.IFrame.Gen" from quar
ffaucher


Joined: 19 Feb 2009
Posts: 0
Reply with quote
A scan with Clamwin found Exploit.IFrame.Gen:
c:\WINDOWS\All users\.clamwin\quarantine\infected.Bo?®te de r?©ception.mbx: Exploit.IFrame.Gen FOUND

Can I delete it safely from quarantine (bo?®te de r?©ception is the box for my incoming e-mail in Outlook Express)?
View user's profileSend private message
Antonio S.


Joined: 20 Apr 2008
Posts: 0
Location: Italy
Reply with quote
Hello,
I am not 100% sure since I have no mail client installed on my machine but if you remove the quarantine file you risk to lose the whole inbox (if I am not wrong this is stored as a single file). My suggestion is to copy back the file to its original position removing the infected. prefix from filename. Then check yr. inbox to see if you find mails coming from unknown/unexpected sender or simply if there are unusual attachments in it. Set clamwin preferences to 'Report only' option (and keep it as a default setting) and scan the suspect message. If clamwin find the message is infected you can safely remove it. run a complete scan again and threat should have gone.
Be aware that you have no real time scan of email using Outlook express; this is active only with the integration with MS Outlook (which come as a part of MS Office) . If you wish to have a real time scan for in/outgoing mail you should choose any of the free AV tools (Avast, Avira Antivir free, AVG free) which are available on the web. As Clamwin has no real time scan feature enabled right now it won't conflict with any resident AV.

Regards,
Antonio
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 9
Location: USA
Reply with quote
That Exploit.IFrame.Gen may be a false positive. Not every IFrame is malicious, and it looks like a generic signature.

Regards,
View user's profileSend private message
ffaucher


Joined: 19 Feb 2009
Posts: 0
Reply with quote
I took a look in C:\windows\...\Outlook Express\ and my bo?®te de r?©ception.dbx was still there while there was "infected bo?®te de r?©ception" in quarantine. I deleted what was in quarantine, it went in the recycle bin. A new scan with clamwin revealed no infection this time. My Outlook Express works good ( I sent myself a e-mail).

I'm wondering if what is sent in quarantine is a copy or the whole file itself?
View user's profileSend private message
Antonio S.


Joined: 20 Apr 2008
Posts: 0
Location: Italy
Reply with quote
Hello ffaucher,

Just to be sure, make a check that all the messages in your inbox are at their place and fully accessible.
More info on https://en.wikipedia.org/wiki/Outlook_Express .

Slts
Antonio
View user's profileSend private message
ffaucher


Joined: 19 Feb 2009
Posts: 0
Reply with quote
Hello Antonio,

Can you explain in other words what you mean by checking that the inbox messages "at their place" and fully accessible". I received the last topic reply notification from the ClamWin forum with no problem and I can read it.
View user's profileSend private message
Antonio S.


Joined: 20 Apr 2008
Posts: 0
Location: Italy
Reply with quote
Hello,

My concern was about older/stored messages in the inbox. Just verify if older messages are correcly stored and accessible. If they are I assume you can remove the file from the recycle bin.

Regards,
Antonio
View user's profileSend private message
ffaucher


Joined: 19 Feb 2009
Posts: 0
Reply with quote
I never keep old messages in my inbox to have it clear and easy to detect the new ones. As soon I read them, I move them to deleted files box or a specific box when I decide to keep some. But I will keep the messages in my inbox for 1-2 days to check if it works good. Thanks for the clue.
View user's profileSend private message
Can I safely delete "Exploit.IFrame.Gen" from quar
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic