Announcement

Collapse
No announcement yet.

Phish virus in skin????

Collapse
X
Collapse
 
  • Page of 1
  • Filter
  • Time
  • Show
Clear All
new posts
Previous template Next
    #1

    Phish virus in skin????

    I just opened Actinic and got a message from my virus scanner saying there was a phish paypal virus or something found in one of the skins. I didn't know what it was or what to do so I put it into quarantine. Now, each time I open Actinic software on my computer I get these error messages:

    Click image for larger version Name: Actinic-error.gif Views: 1 Size: 18.1 KB ID: 545543

    What does it mean, is it bad? What should I do?

    Jenny
    Tags: None
    #2
    first thing to do is run a full anti virus scan on your system, along with spyware etc software.

    Once you are entirely sure your system is free of viruses and spyware, readdress the actinic issue

    Comment

      #3
      Thanks for your reply.

      I have run all my spyware and so on and nothing major to add... just the usual cookies and so on.

      The phish thing that was found in my Actinic, I quarantined it anyway. Presumably it can't do any harm now. Here is what the Avira Antivirus says about it:

      File
      PHISH/Paypalfraud.6
      C:/Programme Files/Actinic v8/formats/NavigatorSkins/UsingActinicCatalog/1.htm

      Do I delete it from quarantine now? What about those 3 error messages? If I delete the PHISH file will I get those every time I open Actinic now? I am getting them everytime since it happened.

      Jenny

      Comment

        #4
        the contents of the file you describe is thus:

        HTML Code:
        <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Untitled Document</title>
</head>

<body>
<img src="../frame1-a.png" width="435" height="505" border="0" usemap="#Map">
<map name="Map">
  <area shape="rect" coords="366,8,389,30" href="PANEL 1" alt="Go to Next Panel">
  <area shape="rect" coords="398,8,421,30" href="EXIT" alt="Close Window">
  <area shape="rect" coords="13,257,31,275" href="PANEL 0" alt="Step 1 and 2">
  <area shape="rect" coords="48,257,66,275" href="PANEL 1" alt="Step 3 and 4">
  <area shape="rect" coords="83,257,101,275" href="PANEL 2" alt="Step 5 and 6">
  <area shape="rect" coords="118,257,136,275" href="PANEL 3" alt="Step 7 and 8">
  <area shape="rect" coords="153,257,171,275" href="PANEL 4" alt="Step 9 and 10">
  <area shape="rect" coords="189,257,207,275" href="PANEL 5" alt="Step 11 and 12">
  <area shape="rect" coords="223,257,241,275" href="PANEL 6" alt="Step 13 and 14">
  <area shape="rect" coords="258,257,276,275" href="PANEL 7" alt="Step 15 and 16">
  <area shape="rect" coords="293,257,311,275" href="PANEL 8" alt="Step 17 and 18">
  <area shape="rect" coords="328,257,346,275" href="PANEL 9" alt="Step 19 and 20">
  <area shape="rect" coords="363,257,381,275" href="PANEL 10" alt="Step 21 and 22">
  <area shape="rect" coords="398,257,416,275" href="PANEL 11" alt="Step 23 and 24">
</map>
</body>
</html>
        please compare yours and additionally, be advised that your virus scanner may have found a false positive.

        I'd send them a huffy letter telling them how much bother they have caused you.

        Comment

          #5
          Thanks.

          OK, so looking on my hard drive in the following place

          C:\Program Files\Actinic v8\Formats\NavigatorSkins\UsingActinicCatalog

          I do not have a file called 1.htm. It goes

          1a.bmp
          1b.bmp
          2.htm

          Is this because my anti virus programme has put the whole file in quarantine Do I go on my Actinic disc and get that file and put it back on? Or will that mess up any of my work/store/customisations?

          Nope, put brain in gear... hahaha. I have gone into my virus software and restored the file back out of quarantine so that I can open it. It does look just like yours. I can't see any extra code. But would it necessarily show as extra or different code?

          Can I copy your code from your post and paste it into a new html file, call it 1 and just put it back, rather than putting back the original file that may be infected. Or do I have to get the proper original file from somewhere?

          You have been very helpful, thanks.

          Jenny

          Comment

            #6
            Why not create a new file by cutting and pasting from above and then virus check just that file. You could also try and virus check the file you've just un-quarantined. If they both fail the check then you know it's a false positive else there's something else wrong with the original file.

            Comment

              #7
              Thanks. I copied the above code into a new file, called it 1.htm and put it back. Neither file were showing as infected when I tested them. Very strange

              Thanks for your help everyone.

              Comment

              Previous template Next
              Working...
              X