Hello,

Yesterday, Norton Anti Virus popped up and said I had a virus, and in
the logs it tells me this:

Source: C:\Documents and Settings\Owner\Local Settings\Temporary
Internet Files\Content.IE5\6PEFGNU1\celebsf[1].htm
Click for more information about this threat : MHTMLRedir.Exploit

I just installed Spy Sweeper to help prevent this from happening
again.  But can you helpme remove this Virus as I don't think Norton
or Spysweeper has done it for me?

Thanks

Dear ebst23-ga;

Thank you for allowing me to answer your interesting question.

There?s good news! The detection of MHTMLRedir.Exploit is not
indicative of a virus rather it is a notice that the worm was found
and prevented.

?Because this is an exploit only, there are no removal instructions,
since there is nothing to remove. This is a detection for the exploit,
preventing the execution of malicious content on your computer. By
detecting the exploit, it is prevented from running.?

SYMANTEC
http://www.symantec.com/avcenter/venc/data/mhtmlredir.exploit.html

So the detection prevented HTML files containing potential
vulnerability from being executed so the bottom line is that there?s
nothing to remove. If you are concerned about this happening again in
the future Microsoft has released patch MS04-013 to address this
issue.

Microsoft Security Bulletin MS04-013
Cumulative Security Update for Outlook Express (837009)
http://www.microsoft.com/technet/security/bulletin/ms04-013.mspx

You may have other viral problems but MHTMLRedir.Exploit is not one of them.

I hope you find that my answer exceeds your expectations. If you have
any questions about my research please post a clarification request
prior to rating the answer. Otherwise I welcome your rating and your
final comments and I look forward to working with you again in the
near future. Thank you for bringing your question to us.

Best regards;
Tutuzdad-ga ? Google Answers Researcher



INFORMATION SOURCES

Defined above


SEARCH STRATEGY


SEARCH ENGINE USED:

Google ://www.google.com


SEARCH TERMS USED:

MHTMLRedir.Exploit

Worm

Trojan

Removal

Symantec

Norton

This "virus" will probably not bother you again, as it's just html
code which doesn't do any damage to your system. As you can see in the
full path, it's in your internet cache now (probably already deleted
by either Norton or SpySweeper), which you can clean yourself
(Internet Explorer > Tools > Internet Options, the second section it
titled Temporary Internet Files, and there's a button called "Delete
Files", press it, and it's gone). You can even browse to it with
Windows Explorer and delete it manually.