Loading ...
Sorry, an error occurred while loading the content.

I am getting w32.feebs warning at mail login as well

Expand Messages
  • not_for_consumption
    Symantec captures the install of it. It occurs during the animation that plays during mail login. I have not tried using the old mail. I might try lowering
    Message 1 of 19 , Feb 28, 2007
    View Source
    • 0 Attachment
      Symantec captures the install of it. It occurs during the animation
      that plays during mail login. I have not tried using the old mail. I
      might try lowering my resolution and logging in to get that "your
      resolution is too low, use the old mail interface" bit and see if the
      virus still comes through
    • too_much green_tea
      Could it be a false positive? I m using avast! and I haven t seen any warning. How about other AVs?
      Message 2 of 19 , Feb 28, 2007
      View Source
      • 0 Attachment
        Could it be a false positive? I'm using avast! and I haven't seen any warning. How about other AVs?

        ____________________________________________________________________________________
        Come and visit my 360°
        http://360.yahoo.com/toomuchgreentea

        ----- Original Message ----
        From: not_for_consumption <doug_dyer@...>
        To: Y-Mail@yahoogroups.com
        Sent: Wednesday, February 28, 2007 8:06:51 AM
        Subject: [Y-Mail] I am getting w32.feebs warning at mail login as well

        Symantec captures the install of it. It occurs during the animation
        that plays during mail login. I have not tried using the old mail. I
        might try lowering my resolution and logging in to get that "your
        resolution is too low, use the old mail interface" bit and see if the
        virus still comes through








        ____________________________________________________________________________________
        Do you Yahoo!?
        Everyone is raving about the all-new Yahoo! Mail beta.
        http://new.mail.yahoo.com

        [Non-text portions of this message have been removed]
      • turner_727
        I m using the beta (f308) at work and the classic at home, and I have not had this problem yet. too_much green_tea wrote: Could it
        Message 3 of 19 , Feb 28, 2007
        View Source
        • 0 Attachment
          I'm using the beta (f308) at work and the classic at home, and I have not had this problem yet.


          too_much green_tea <toomuchgreentea@...> wrote:
          Could it be a false positive? I'm using avast! and I haven't seen any warning. How about other AVs?

          ____________________________________________________________________________________
          Come and visit my 360°
          http://360.yahoo.com/toomuchgreentea

          ----- Original Message ----
          From: not_for_consumption
          To: Y-Mail@yahoogroups.com
          Sent: Wednesday, February 28, 2007 8:06:51 AM
          Subject: [Y-Mail] I am getting w32.feebs warning at mail login as well

          Symantec captures the install of it. It occurs during the animation
          that plays during mail login. I have not tried using the old mail. I
          might try lowering my resolution and logging in to get that "your
          resolution is too low, use the old mail interface" bit and see if the
          virus still comes through








          ____________________________________________________________________________________
          Do you Yahoo!?
          Everyone is raving about the all-new Yahoo! Mail beta.
          http://new.mail.yahoo.com

          [Non-text portions of this message have been removed]




          Yahoo! Groups Links






          ---------------------------------
          Get your own web address.
          Have a HUGE year through Yahoo! Small Business.

          [Non-text portions of this message have been removed]
        • turner_727
          ...but I seem to be on the classic at home (where I want to be on classic) and the beta at work. Not quite sure how that worked out, but I m wondering if the
          Message 4 of 19 , Feb 28, 2007
          View Source
          • 0 Attachment
            ...but I seem to be on the classic at home (where I want to be on classic) and the beta at work. Not quite sure how that worked out, but I'm wondering if the two-week login doesn't have something to do with it....


            too_much green_tea <toomuchgreentea@...> wrote:
            Could it be a false positive? I'm using avast! and I haven't seen any warning. How about other AVs?

            ____________________________________________________________________________________
            Come and visit my 360°
            http://360.yahoo.com/toomuchgreentea

            ----- Original Message ----
            From: not_for_consumption
            To: Y-Mail@yahoogroups.com
            Sent: Wednesday, February 28, 2007 8:06:51 AM
            Subject: [Y-Mail] I am getting w32.feebs warning at mail login as well

            Symantec captures the install of it. It occurs during the animation
            that plays during mail login. I have not tried using the old mail. I
            might try lowering my resolution and logging in to get that "your
            resolution is too low, use the old mail interface" bit and see if the
            virus still comes through








            ____________________________________________________________________________________
            Do you Yahoo!?
            Everyone is raving about the all-new Yahoo! Mail beta.
            http://new.mail.yahoo.com

            [Non-text portions of this message have been removed]




            Yahoo! Groups Links






            ---------------------------------
            Finding fabulous fares is fun.
            Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains.

            [Non-text portions of this message have been removed]
          • themissinghour
            No problems here - I m using AVG Anti-Virus. Yahoo uses Norton as its native anti-virus product. Could it be that all emails in your inbox are scanned
            Message 5 of 19 , Feb 28, 2007
            View Source
            • 0 Attachment
              No problems here - I'm using AVG Anti-Virus.

              Yahoo uses Norton as its native anti-virus product. Could it be that
              all emails in your inbox are scanned automatically by Yahoo before the
              list and preview screen are shown? I just wonder if the warning is
              coming from your computers version of the Symantec product or from
              Yahoo's resident one.

              Just a suggestion.

              More on the virus here:
              http://www.symantec.com/security_response/writeup.jsp?docid=2006-013122-5631-99

              Cheers,
              Kenny
            • not_for_consumption
              Try running the symantec removal tool to see what it says. I have used the beta interface for months without incident until this morning.
              Message 6 of 19 , Feb 28, 2007
              View Source
              • 0 Attachment
                Try running the symantec removal tool to see what it says. I have
                used the beta interface for months without incident until this morning.

                http://www.neowin.net/forum/index.php?showtopic=542465

                My dad checked his email and I had him run this tool. It said it
                identified and removed the virus.

                Could be a false positive in that a cached file had something that
                triggered the signature of the virus.
              • not_for_consumption
                ... Its happening during log in. I never get to my mail window. Symantec AV (on my pc) jumps up with the alert. This only started happening this morning. I
                Message 7 of 19 , Feb 28, 2007
                View Source
                • 0 Attachment
                  --- In Y-Mail@yahoogroups.com, "themissinghour" <themissinghour@...>
                  wrote:
                  >
                  > No problems here - I'm using AVG Anti-Virus.

                  Its happening during log in. I never get to my mail window. Symantec
                  AV (on my pc) jumps up with the alert.

                  This only started happening this morning. I have been using beta mail
                  for a very long time.
                • turner_727
                  I just tried reloading the beta mail on my work puter, and got this error as well. Symantec AntiVirus Corporate edition. This is the report I get: Scan type:
                  Message 8 of 19 , Feb 28, 2007
                  View Source
                  • 0 Attachment
                    I just tried reloading the beta mail on my work puter, and got this error as well. Symantec AntiVirus Corporate edition. This is the report I get:

                    Scan type: Auto-Protect Scan
                    Event: Security Risk Found!
                    Threat: W32.Feebs
                    File: C:\DOCUME~1\------\LOCALS~1\TEMPOR~1\Content.IE5\ID7KL47Q\BF3159~2.JS
                    Location: Unknown Storage
                    Computer: ------
                    User: -----\--------
                    Action taken: Delete succeeded : Access denied


                    not_for_consumption <doug_dyer@...> wrote:
                    --- In Y-Mail@yahoogroups.com, "themissinghour"
                    wrote:
                    >
                    > No problems here - I'm using AVG Anti-Virus.

                    Its happening during log in. I never get to my mail window. Symantec
                    AV (on my pc) jumps up with the alert.

                    This only started happening this morning. I have been using beta mail
                    for a very long time.





                    Yahoo! Groups Links






                    ---------------------------------
                    Have a burning question? Go to Yahoo! Answers and get answers from real people who know.

                    [Non-text portions of this message have been removed]
                  • Brent
                    I saw an virus definition update from Symantec come through last night. That seems to be when the problem started. I am sure it is a false positive but someone
                    Message 9 of 19 , Feb 28, 2007
                    View Source
                    • 0 Attachment
                      I saw an virus definition update from Symantec come through last night. That
                      seems to be when the problem started. I am sure it is a false positive but
                      someone is going to have to fix it.

                      Brent


                      On 2/28/07, turner_727 <turner_727@...> wrote:
                      >
                      > I just tried reloading the beta mail on my work puter, and got this
                      > error as well. Symantec AntiVirus Corporate edition. This is the report I
                      > get:
                      >
                      > Scan type: Auto-Protect Scan
                      > Event: Security Risk Found!
                      > Threat: W32.Feebs
                      > File:
                      > C:\DOCUME~1\------\LOCALS~1\TEMPOR~1\Content.IE5\ID7KL47Q\BF3159~2.JS
                      > Location: Unknown Storage
                      > Computer: ------
                      > User: -----\--------
                      > Action taken: Delete succeeded : Access denied
                      >
                      >
                      > not_for_consumption <doug_dyer@... <doug_dyer%40yahoo.com>> wrote:
                      > --- In Y-Mail@yahoogroups.com <Y-Mail%40yahoogroups.com>, "themissinghour"
                      >
                      > wrote:
                      > >
                      > > No problems here - I'm using AVG Anti-Virus.
                      >
                      > Its happening during log in. I never get to my mail window. Symantec
                      > AV (on my pc) jumps up with the alert.
                      >
                      > This only started happening this morning. I have been using beta mail
                      > for a very long time.
                      >
                      > Yahoo! Groups Links
                      >
                      > ---------------------------------
                      > Have a burning question? Go to Yahoo! Answers and get answers from real
                      > people who know.
                      >
                      > [Non-text portions of this message have been removed]
                      >
                      >
                      >


                      [Non-text portions of this message have been removed]
                    • chris_daigle
                      I also started experiencing this problem last night. I get a warning screen when I try to log into Yahoo Mail Beta on my personal computer. Yahoo Mail Beta
                      Message 10 of 19 , Feb 28, 2007
                      View Source
                      • 0 Attachment
                        I also started experiencing this problem last night. I get a warning
                        screen when I try to log into Yahoo Mail Beta on my personal
                        computer. Yahoo Mail Beta does not load. I was sure that my son
                        downloaded a virus.

                        Is this a virus or is it a result of an update from Symantec? I did
                        update all of my definitions yesterday.

                        Has Symanted published an offical statement on this problem.

                        CD.

                        --- In Y-Mail@yahoogroups.com, Brent <flapdoodle@...> wrote:
                        >
                        > I saw an virus definition update from Symantec come through last
                        night. That
                        > seems to be when the problem started. I am sure it is a false
                        positive but
                        > someone is going to have to fix it.
                        >
                        > Brent
                        >
                        >
                        > On 2/28/07, turner_727 <turner_727@...> wrote:
                        > >
                        > > I just tried reloading the beta mail on my work puter, and got
                        this
                        > > error as well. Symantec AntiVirus Corporate edition. This is the
                        report I
                        > > get:
                        > >
                        > > Scan type: Auto-Protect Scan
                        > > Event: Security Risk Found!
                        > > Threat: W32.Feebs
                        > > File:
                        > > C:\DOCUME~1\------\LOCALS~1\TEMPOR~1\Content.IE5
                        \ID7KL47Q\BF3159~2.JS
                        > > Location: Unknown Storage
                        > > Computer: ------
                        > > User: -----\--------
                        > > Action taken: Delete succeeded : Access denied
                        > >
                        > >
                        > > not_for_consumption <doug_dyer@... <doug_dyer%40yahoo.com>> wrote:
                        > > --- In Y-Mail@yahoogroups.com <Y-Mail%
                        40yahoogroups.com>, "themissinghour"
                        > >
                        > > wrote:
                        > > >
                        > > > No problems here - I'm using AVG Anti-Virus.
                        > >
                        > > Its happening during log in. I never get to my mail window.
                        Symantec
                        > > AV (on my pc) jumps up with the alert.
                        > >
                        > > This only started happening this morning. I have been using beta
                        mail
                        > > for a very long time.
                        > >
                        > > Yahoo! Groups Links
                        > >
                        > > ---------------------------------
                        > > Have a burning question? Go to Yahoo! Answers and get answers
                        from real
                        > > people who know.
                        > >
                        > > [Non-text portions of this message have been removed]
                        > >
                        > >
                        > >
                        >
                        >
                        > [Non-text portions of this message have been removed]
                        >
                      • Ryan Kennedy
                        I m trying to get further details, but this is a false positive. If you are running Norton, get it to pull a new virus definition update and the problem should
                        Message 11 of 19 , Feb 28, 2007
                        View Source
                        • 0 Attachment
                          I'm trying to get further details, but this is a false positive. If you are running Norton, get it to pull a new virus definition update and the problem should go away. I'll write again as soon as I have more details.

                          Ryan Kennedy
                          Yahoo! Mail
                        • turner_727
                          I forced Symantec to do a LiveUpdate, and this fixed the problem on my work computer as well. Thanks for the help on this, Ryan! :) Ryan Kennedy
                          Message 12 of 19 , Feb 28, 2007
                          View Source
                          • 0 Attachment
                            I forced Symantec to do a LiveUpdate, and this fixed the problem on my work computer as well.

                            Thanks for the help on this, Ryan! :)

                            Ryan Kennedy <rckenned@...> wrote:
                            I'm trying to get further details, but this is a false positive. If you are running Norton, get it to pull a new virus definition update and the problem should go away. I'll write again as soon as I have more details.

                            Ryan Kennedy
                            Yahoo! Mail


                            ---------------------------------
                            TV dinner still cooling?
                            Check out "Tonight's Picks" on Yahoo! TV.

                            [Non-text portions of this message have been removed]
                          • chandi_s
                            Thanks you guys! I m happy to see my dear Yahoo Mail Beta come back to life! Virus warning is gone! ... you are running Norton, get it to pull a new virus
                            Message 13 of 19 , Feb 28, 2007
                            View Source
                            • 0 Attachment
                              Thanks you guys! I'm happy to see my dear Yahoo Mail Beta come back to
                              life! Virus warning is gone!


                              --- In Y-Mail@yahoogroups.com, Ryan Kennedy <rckenned@...> wrote:
                              >
                              > I'm trying to get further details, but this is a false positive. If
                              you are running Norton, get it to pull a new virus definition update
                              and the problem should go away. I'll write again as soon as I have more
                              details.
                              >
                              > Ryan Kennedy
                              > Yahoo! Mail
                              >
                            • chris_daigle
                              As part of my wild goose chase to solve the problem last night, I uninstalled and reinstalled Norton, updated the defs, and I still have the problem. I ll
                              Message 14 of 19 , Feb 28, 2007
                              View Source
                              • 0 Attachment
                                As part of my "wild goose chase" to solve the problem last night, I
                                uninstalled and reinstalled Norton, updated the defs, and I still
                                have the problem. I'll force an update when I get home this evening.
                                Hopefully, Norton and/or Yahoo have fixed the problem......

                                cd

                                --- In Y-Mail@yahoogroups.com, turner_727 <turner_727@...> wrote:
                                >
                                > I forced Symantec to do a LiveUpdate, and this fixed the problem on
                                my work computer as well.
                                >
                                > Thanks for the help on this, Ryan! :)
                                >
                                > Ryan Kennedy <rckenned@...> wrote:
                                > I'm trying to get further details, but this is a false positive.
                                If you are running Norton, get it to pull a new virus definition
                                update and the problem should go away. I'll write again as soon as I
                                have more details.
                                >
                                > Ryan Kennedy
                                > Yahoo! Mail
                                >
                                >
                                > ---------------------------------
                                > TV dinner still cooling?
                                > Check out "Tonight's Picks" on Yahoo! TV.
                                >
                                > [Non-text portions of this message have been removed]
                                >
                              • tm_pearson
                                ... evening. ... on ... positive. ... I ... This IS NOT A FALSE/POSITIVE! I packet sniffed last night and watch the .js file get pushed out to my cache folder
                                Message 15 of 19 , Feb 28, 2007
                                View Source
                                • 0 Attachment
                                  --- In Y-Mail@yahoogroups.com, "chris_daigle" <chris_daigle@...>
                                  wrote:
                                  >
                                  > As part of my "wild goose chase" to solve the problem last night, I
                                  > uninstalled and reinstalled Norton, updated the defs, and I still
                                  > have the problem. I'll force an update when I get home this
                                  evening.
                                  > Hopefully, Norton and/or Yahoo have fixed the problem......
                                  >
                                  > cd
                                  >
                                  > --- In Y-Mail@yahoogroups.com, turner_727 <turner_727@> wrote:
                                  > >
                                  > > I forced Symantec to do a LiveUpdate, and this fixed the problem
                                  on
                                  > my work computer as well.
                                  > >
                                  > > Thanks for the help on this, Ryan! :)
                                  > >
                                  > > Ryan Kennedy <rckenned@> wrote:
                                  > > I'm trying to get further details, but this is a false
                                  positive.
                                  > If you are running Norton, get it to pull a new virus definition
                                  > update and the problem should go away. I'll write again as soon as
                                  I
                                  > have more details.
                                  > >
                                  > > Ryan Kennedy
                                  > > Yahoo! Mail
                                  > >
                                  > >
                                  > > ---------------------------------
                                  > > TV dinner still cooling?
                                  > > Check out "Tonight's Picks" on Yahoo! TV.
                                  > >
                                  > > [Non-text portions of this message have been removed]
                                  > >
                                  >
                                  This IS NOT A FALSE/POSITIVE! I packet sniffed last night and watch
                                  the .js file get pushed out to my cache folder and launched only to
                                  have Norton cache the file as well as CA caught it too. This file and
                                  issue came directly from YAHOO and they of course have fixed this
                                  issue as of this AM. Of course I don't see them wanting to admit to a
                                  virus being PUSHED out to people's PC's when logging into Yahoo Beta
                                  Mail. There is more here then a False/Positive.
                                • Ryan Kennedy
                                  ... Yes, Symmantec fixed the issue on their end late last night. Pretty impressive turnaround, really. Ryan Kennedy Yahoo! Mail
                                  Message 16 of 19 , Feb 28, 2007
                                  View Source
                                  • 0 Attachment
                                    > Hopefully, Norton and/or Yahoo have fixed the problem..... .

                                    Yes, Symmantec fixed the issue on their end late last night. Pretty impressive turnaround, really.

                                    Ryan Kennedy
                                    Yahoo! Mail
                                  • Ryan Kennedy
                                    ... The JavaScript file contained no viruses. It was a false positive. The reason it works this morning is because new virus definition files have been pushed
                                    Message 17 of 19 , Feb 28, 2007
                                    View Source
                                    • 0 Attachment
                                      > This IS NOT A FALSE/POSITIVE! I packet sniffed last night and watch
                                      > the .js file get pushed out to my cache folder and launched only to
                                      > have Norton cache the file as well as CA caught it too. This file and
                                      > issue came directly from YAHOO and they of course have fixed this
                                      > issue as of this AM. Of course I don't see them wanting to admit to a
                                      > virus being PUSHED out to people's PC's when logging into Yahoo Beta
                                      > Mail. There is more here then a False/Positive.

                                      The JavaScript file contained no viruses. It was a false positive. The reason it works this morning is because new virus definition files have been pushed by the manufacturer. You can check yourself by looking at the JavaScript files on the server, they haven't changed a bit.

                                      Ryan Kennedy
                                      Yahoo! Mail
                                    • tm_pearson
                                      ... watch ... to ... and ... to a ... Beta ... The reason it works this morning is because new virus definition files have been pushed by the manufacturer. You
                                      Message 18 of 19 , Feb 28, 2007
                                      View Source
                                      • 0 Attachment
                                        --- In Y-Mail@yahoogroups.com, Ryan Kennedy <rckenned@...> wrote:
                                        >
                                        > > This IS NOT A FALSE/POSITIVE! I packet sniffed last night and
                                        watch
                                        > > the .js file get pushed out to my cache folder and launched only
                                        to
                                        > > have Norton cache the file as well as CA caught it too. This file
                                        and
                                        > > issue came directly from YAHOO and they of course have fixed this
                                        > > issue as of this AM. Of course I don't see them wanting to admit
                                        to a
                                        > > virus being PUSHED out to people's PC's when logging into Yahoo
                                        Beta
                                        > > Mail. There is more here then a False/Positive.
                                        >
                                        > The JavaScript file contained no viruses. It was a false positive.
                                        The reason it works this morning is because new virus definition
                                        files have been pushed by the manufacturer. You can check yourself by
                                        looking at the JavaScript files on the server, they haven't changed a
                                        bit.
                                        >
                                        > Ryan Kennedy
                                        > Yahoo! Mail
                                        >

                                        Ryan, I have saved all packets again just a few ago and compared the
                                        JS file from last night to it and you are correct. They are the same.

                                        I did notice in my Firewall that Symantec did an update push on Virus
                                        Defs so it does appear that this was the issue as you stated.

                                        Wasn't the best time in the evening to have this all happen. Been a
                                        LONG day and trying to troubleshoot the problem. Glad to know that
                                        ALL is well.
                                      • Mark
                                        There is an article about this now on CNET. http://news.com.com/Symantec+incorrectly+flags+Yahoo+Mail+as+a+virus/2100-1002_3-6163068.html?tag=nefd.top
                                        Message 19 of 19 , Feb 28, 2007
                                        View Source
                                        • 0 Attachment
                                        Your message has been successfully submitted and would be delivered to recipients shortly.