• Home
  • About 404TS
  • Contact

404 Tech Support

Where IT Help is Found

  • Articles
    • Code
    • Entertainment
    • Going Green
    • Hardware, Gadgets, and Products
    • Management
    • Network
    • News
    • Operating Systems
    • Security and Privacy
    • Software
    • System Administration
    • Talking Points
    • Tech Solutions
    • Web
    • Webmaster
  • Reviews
  • Media
    • Infographics
    • Videos
  • Tech Events
  • Tools
    • How do I find my IP address?
    • Browser and plugin tests
  • Get a Technical Consultation
You are here: Home / Articles / Security and Privacy / Symantec Endpoint Protection giving Trojan.Webkit!html false positive

Symantec Endpoint Protection giving Trojan.Webkit!html false positive

2014-07-24 by Jason

Symantec Endpoint Protection is flagging files called sh165.htm from people’s Temporary Internet Files as a Trojan.Webkit!html. My Symantec Endpoint Protection Manager is currently reporting hundreds of the detections around the organization.

The file is found at the multiple paths depending on the browser used. The file detected as a Trojan webkit might also be named sh165[1].htm, sh165[2].htm, and so on.

Internet Explorer: c:users[username]AppDataLocalMicrosoftWindowsTemporary Internet FilesContent.IE[hash]sh165.htm. 

Mozilla Firefox: C:Users[username]AppDataLocalMozillaFirefoxProfiles[profile].defaultCache1BBFF063d01

Google Chrome: C:Users[username]AppDataLocalGoogleChromeUser DataDefaultCachef_010726

symantec_trojanwebkit

This false positive picking up a temporary internet file is very low key compared to detecting a critical system file. Symantec​ is aware of the issue and is deploying rapid release definitions to correct the problem. Their write-up of the issue recommends using the Rapid Release definitions but also mentions backdating your definitions to a set prior to July 23 2014 revision 22. Their thread will be updated when the next Certified definitions are released and correct the false detection. You can also monitor the definitions version page to see the fix.

The Rapid Release definitions are currently available from Symantec’s FTP site. The Rapid Release definitions can be applied to a SEP client or SEPM.

Please be aware that the definitions currently available for Symantec Endpoint Protection contain a False Positive (FP).  Treat as a “known issue” any detections of Trojan.Webkit!html for the file with the following unique hash:

  • MD5 75bd3d5707ab06ac4b53eefc41ab729f
  • SHA256 5bcd9a716ba1564bf21bf3fa6f55133f076f53b2b17c0177fa5a78dc2bc5c2aa

This legitimate file is often named sh165[1].htm, sh165.html or similar.  Some iFrames are malicious and are rightly detected by SEP, but this particular one is in fact harmless and is not a cause for security concern.

Symantec is currently preparing Rapid Release definitions which will remove this detection.  It is also possible to configure a SEP organization to use older definitions to avoid the detection (any set before July 23 2014 revision 22 will do), but rolling out new Rapid Release definitions is the recommended approach.

How to Backdate Virus Definitions in Symantec Endpoint Protection Manager
Article URL http://www.symantec.com/docs/TECH102935

The next release of Certified definitions, available via LiveUpdate, will also include the fix.

There is no need to open a Technical Support case about these detections.  Just subscribe to this thread- it will be updated as soon as Rapid Release definitions and then Certified defintiions are available which remove this detection.

With thanks and best regards,

Mick

Filed Under: Security and Privacy, Software

Trending

  • Installing Disk Defragmenter for Windows XP
    In Tech Solutions
  • Adobe Releases Updates for Adobe Acrobat and Reader
    In Security and Privacy, Software
  • Would gaming eyewear like Gunnar Optiks also benefit the eyes of IT Pros?
    In Hardware, Gadgets, and Products

Latest Media Posts

Find Out Where To Download SNES ROMs

Find Out Where To Download SNES ROMs

Multifunctional Video Conversion Tools – Wondershare Video Converter

Multifunctional Video Conversion Tools – Wondershare Video Converter

  • Popular
  • Latest
  • Today Week Month All
  • How to ‘Unblock’ multiple files at a time with PowerShell How to 'Unblock' multiple files at a time with PowerShell
  • Command line to take ownership and change permissions Command line to take ownership and change permissions
  • Increase IIS Private Memory Limit to improve WSUS availability Increase IIS Private Memory Limit to improve WSUS availability
  • SOLVED: “This modification is not allowed because the selection is locked.” SOLVED: "This modification is not allowed because the selection is locked."
  • Creating and editing views in phpMyAdmin Creating and editing views in phpMyAdmin
  • customer contactless payment for drink with mobile phon at cafe counter bar,seller coffee shop accept payment by mobile.new normal lifestyle concept The Latest Innovations In Payment Technology
  • How Digital Technology Brought the Rise of the CMO   How Digital Technology Brought the Rise of the CMO  
  • How to Purchase Cryptocurrencies? How to Purchase Cryptocurrencies?
  • Top 6 necessary aspects to consider when hiring Angular developers Top 6 necessary aspects to consider when hiring Angular developers
  • Full guide on drawbacks and benefits of Node.js for making the perfect choice for your business Full guide on drawbacks and benefits of Node.js for making the perfect choice for your business
Ajax spinner

Elevator Pitch

404 Tech Support documents solutions to IT problems, shares worthwhile software and websites, and reviews hardware, consumer electronics, and technology-related books.

Subscribe to 404TS articles by email.

Recent Posts

  • The Latest Innovations In Payment Technology
  • How Digital Technology Brought the Rise of the CMO  
  • How to Purchase Cryptocurrencies?

Search

FTC Disclaimer

404TechSupport is an Amazon.com affiliate; when you click on an Amazon link from 404TS, the site gets a cut of the proceeds from whatever you buy. This site also uses Skimlinks for smart monetization of other affiliate links.
Use of this site requires displaying and viewing ads as they are presented.

Copyright © 2023 · Magazine Pro Theme on Genesis Framework · WordPress · Log in