contains signature of the phish-file/Email PHISH/BANKFRAUD

[spagetti&prosciutto]

quand je lance un scan d'antivir il me dit:

contains signature of the phish-file/Email PHISH/BANKFRAUD

le probleme c'est que c'est des sites sauvegardes...c'est a dire des pages htm(sauvegardes sur le disque dur a l'aide de save as)

est ce normal?

est-ce un faut positif?

quand on clique sur le fichier, explorer fait un preview du fichier en question et affiche la page web

est ce que cela infecte le systeme?(par une faille internet explorer)

et y'en as plusieurs de fichichiers infectes...

 

sinon on uttilise firefox qui est a jour(2.0.0.3) mais je me souvient plus de quand on est passe d'internet explorer a firefox donc l'infection peut dater car je croyait que c'etais pas un virus jusqu'a ce que je trouve recament sur le net que c'est un trojan

 

 

voici un rapport hyjackthis:

Logfile of HijackThis v1.99.1

Scan saved at 22.28.51, on 26/04/2007

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

C:\WINNT\system32\nfsclnt.exe

C:\Programmi\ewido anti-malware\ewidoctrl.exe

C:\WINNT\system32\hidserv.exe

C:\Programmi\File comuni\Microsoft Shared\VS7Debug\mdm.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\SYSTEM32\THOTKEY.EXE

C:\Programmi\TOSHIBA\TME3\Tmesbs3.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\PSXRUN.EXE

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\psxss.exe

C:\SFU\Mapper\mapsvc.exe

C:\WINNT\system32\nfssvc.exe

C:\WINNT\system32\pcnfsd.exe

C:\WINNT\Explorer.EXE

C:\SFU\usr\sbin\zzInterix

C:\SFU\usr\sbin\init

C:\SFU\usr\sbin\inetd

C:\WINNT\system32\TPWRTRAY.EXE

C:\WINNT\system32\TFNF5.exe

C:\Programmi\TOSHIBA\Wireless Hotkey\TosHKCW.exe

C:\Programmi\Apoint2K\Apoint.exe

C:\Programmi\TOSHIBA\TouchED\TouchED.Exe

C:\Programmi\Java\jre1.6.0\bin\jusched.exe

C:\Programmi\ClamWin\bin\ClamTray.exe

C:\Programmi\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\PRISMSVR.EXE

C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programmi\Apoint2K\Apntex.exe

C:\Programmi\File comuni\Real\Update_OB\realsched.exe

C:\WINNT\system32\ctfmon.exe

C:\Programmi\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\Monitor.exe

C:\Programmi\Olympus\DeviceDetector\DevDtct2.exe

C:\Programmi\OpenOffice.org 2.2\program\soffice.exe

C:\Programmi\OpenOffice.org 2.2\program\soffice.BIN

C:\WINNT\system32\wuauclt.exe

C:\SFU\usr\sbin\cron

C:\Programmi\Mozilla Firefox\firefox.exe

C:\Programmi\AntiVir PersonalEdition Classic\avscan.exe

C:\Documents and Settings\FC1\Desktop\system\hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0\bin\ssv.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe

O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE

O4 - HKLM\..\Run: [TMESRV.EXE] C:\Programmi\TOSHIBA\TME3\TMESRV3.EXE /Logon

O4 - HKLM\..\Run: [TMESBS.EXE] C:\Programmi\TOSHIBA\TME3\TMESBS3.EXE /logon

O4 - HKLM\..\Run: [TFNF5] TFNF5.exe

O4 - HKLM\..\Run: [TosHKCW.exe] C:\Programmi\TOSHIBA\Wireless Hotkey\TosHKCW.exe

O4 - HKLM\..\Run: [Apoint] C:\Programmi\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [TouchED] C:\Programmi\TOSHIBA\TouchED\TouchED.Exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0\bin\jusched.exe"

O4 - HKLM\..\Run: [ClamWin] "C:\Programmi\ClamWin\bin\ClamTray.exe" --logon

O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Programmi\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\PRISMSVR.EXE" /APPLY

O4 - HKLM\..\Run: [avgnt] "C:\Programmi\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb07.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Programmi\File comuni\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKCU\..\Run: [Wengo] "C:/Programmi/Wengo/wengophone.exe" -background

O4 - Startup: OpenOffice.org 2.2.lnk = C:\Programmi\OpenOffice.org 2.2\program\quickstart.exe

O4 - Global Startup: 3Com Wireless 11g PC Card.lnk = C:\Programmi\3Com\3Com OfficeConnect Wireless Utility\3Com Wireless 11g PC Card\Monitor.exe

O4 - Global Startup: Device Detector 2.lnk = C:\Programmi\Olympus\DeviceDetector\DevDtct2.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0\bin\ssv.dll

O16 - DPF: {7142BA01-8BDF-11CF-9E23-0000E8A37440} (Surround Video Control Object) - http://www.villaserbelloni.com/multilang/sdvideo/svideo.cab

O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - C:\Programmi\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: ewido security suite control - ewido networks - C:\Programmi\ewido anti-malware\ewidoctrl.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: THotkey (THOTKEY) - TOSHIBA Corp. - C:\WINNT\SYSTEM32\THOTKEY.EXE

O23 - Service: Tmesbs3 (Tmesbs) - TOSHIBA Corporation - C:\Programmi\TOSHIBA\TME3\Tmesbs3.exe

O23 - Service: Tmesrv3 (Tmesrv) - Toshiba - C:\Programmi\TOSHIBA\TME3\Tmesrv3.exe

O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Programmi\RealVNC\VNC4\WinVNC4.exe" -service (file missing)