Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just ran Symantec Anti-Virus and it's flagging literally every since HTML, PHP, ASP/ASPX file on my computer as a virus. That's nearly 600 files on my laptop.

Can this be? How can a text file (html/php/etc..) be a virus.

share|improve this question
Hmm. How can a PHP program be a virus? Let me see... – Ernie Aug 11 '09 at 21:35
A server I run got nailed by a worm a month ago that wrote some code into every HTML file it could find (including some php, etc). That code was some nasty Javascript. It was easy to clean up, but took some time. Maybe you've been visited by the waste-some-time-cleaning-up-iframes fairy as well? – Bill Weiss Sep 18 '09 at 20:46

It's probably finding Javascript or something like that that it suspects is malicious. What are your scan settings?

share|improve this answer
Just the normal setting for a full scan to look at all file types. – Tim Aug 11 '09 at 20:55

First: Don't assume its wrong until you have actually checked**[1]** some of those files and confirmed they are false positives. It is possible that some malware compromised your machine and is trying to use HTML files as a vector to the next infection.

The next step will depend on what you find.


[1] Ways you could check if the files are false positives or not:

Look at the source in your favorite text editor ... is there anything bad added?


If HTML isn't your strong point copy/paste the following into a file and save as something.html:

    <style>h1 { color: red; }</style>
    <h1>HTML FILE</h1>
    <iframe src=""/>

The above is completely non-malicious but uses a couple different HTML elements that could be triggering a false positive. Now scan this new file and see if it is also flagged as bad. If it is flagged as bad, edit it again and check that the file has not been changed (malware could have changed it). If the file is not changed, but symantec still thinks its bad, then there is something wrong with your anti-virus.

share|improve this answer
How do I "check some of those files" without infecting my computer? – Tim Aug 11 '09 at 22:08
I updated the answer with some ways you can check for false positives – ehempel Aug 11 '09 at 23:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.