Hi,Inasmuchas I am apparently one of the "uneducated and clueless", I was a bit disturbed when NAV repeatedly halted my machine as the prank site repeatedly tried to do whatever it does. Anyway since NAV and the prank were fighting each other faster than my human mind and human fingers could react, all I could do to escape was to hit my reset button, which was followed by a scan disc before rebooting. A full system scan by NAV subsequently detected a "trojan horse virus" in my ContentIE5 folder. If not for that, manually closing a few dozen pop ups, or whatever might have happened if not for NAV, would not have disturbed me. I have a collection of every prank program written by the rjlsoftware people and the lizardworks people as well as a a few from other sources, some quite mean. With all that I have found and tried up until now there was no damage done, and even with the "mean" ones the biggest challenge sometimes is to figure out how to close them. This one is the first one however that NAV detected as malicious. Symantec's stated philosophy is to not detect prank or joke programs. The following is from Symantec:
This is a joke program. It is not a virus, worm, or Trojan, and it is not detected as such. By design, Symantec Security Response does not provide virus definitions to detect joke programs. Such programs are not malicious, and detecting them only leads to unnecessary virus alerts which could cause you to believe that you have run or received a dangerous program when you have not.
On the other hand, when I have done online scans at Housecall by comparison, half my inventory of prank programs is detected as trojans.
I don't consider NAV to be a poorly written AV, to the contrary I have found it to be very reliable and if this instance was a "false positive", then it is the first one that I have seen in four years of using NAV.
" (The reason flash is a natural format for this sort of thing is that it runs independently of most other browser function calls.)"
To the "uneducated and clueless" such as myself, this sounds like a potential vulnerability if an online flash cartoon can drop a new and previously unknown trojan into unsuspecting user's temp folders.
Perhaps NAV's heuristic detection detected this because it looks too much like a known trojan, I don't really know.
"There does seem to be some random redirect going on. I wonder if the ref to offiz.bei.t-online.de in the source has anything to do with it? I'm curious enough to run a capture later...be interesting to check out the TCP flow. "
If there is more going on than there first appears to the educated and clueful, then maybe NAV is ahead of the curve. Anyway it did me no real damage other than whatever risk there might be in doing, what is it called?, a hard boot? Also I would rather be safe than sorry, so I'm glad to have a practical demonstration of of NAV's ability to stop potentially malicious content while browsing. Up until now, the only alerts I have experience from NAV were infected attachements in emails from people even more "uneducated and clueless" than I.
Mowergun
Printer-friendly copy
Email this topic to a friend
)
I couldn't End Task on 32 open IE windows (i.e. 32 instances of IE listed in Task Manager), or right click on the toolbar to close. Even the Start button was inoperative, hence the hard reboot.
"Spyware/Adware is NOT freeware, it costs all of us dearly." 
