Exploit

Threat description

Details

Category: Malware
Type: Exploit
Platform: W32

Summary

A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.



Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Exploit prevention

The vulnerabilities leveraged by the exploits are usually application or platform specific; in other words, a specific program (or even a specific version of a particular program) must be installed on the machine in order for the exploit to be effective.

To prevent exploitation of such vulnerabilities, please refer to the application vendor for the latest updates and additional advice.

In some cases, an infected file, or archive file containing infected files, is detected inside a temporary or cache folder. For instructions on dealing with such an infection, see:

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:



Technical Details

In computer security terms, an exploit is an object - a program, a section of code, even a string of characters - that takes advantage of a vulnerability in a program or operating system to perform various actions. An exploit is almost always used in a malicious context.

Exploits may be incorporated into standalone malware or as part of the 'arsenal' of an exploit kit.

If successfully used, exploits can allow an attacker to perform a wide range of possible actions on an affected device, from viewing data on a restricted-user database to almost complete control of a compromised system.

For examples of exploits on various platfoms, see the following:

Note that some exploit detection names indicate the vulnerability involved, such as:

  • Exploit.Java.CVE-2012-0507

Where CVE-2012-0507 is the name used by the CVE - Common Vulnerabilities and Exposures (CVE) organization to identify the specific vulnerability targeted by the exploit.

Vulnerability Protection

Further information on the most common vulnerabilities found in most programs may be found at:






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More