E-bay sign in Phishing

[joddle]

On attempting to log on to ebay this morning all was OK until I clicked on "My Ebay" then got this warning.

 

'C:\Documents and Settings\Josh\Local Settings\Temporary Internet Files\Content.IE5\84APX1BH\eBayISAPI[1].htm' contained a virus or unwanted program 'PHISH/Cartasi.Z' [phishing]

 

Of course I went no further and have not put in my account name or password and seemingly no damage to the pc and subsequent scans using ANTIVIR and MALWAREBYTES show PC to be clear. But even with latest Antviir patches the problem persists as I don't want to log on to my account if its going to be compromised - how do I get it sorted? Have aready told AVIRA of the problem but can't seem to be able to contact Ebay without actually signing in - which of course I don't want to do. The strange thing is if I use the ebay Spain sign in page - there is no problem - it only happens on ebay uk.

 

Secondly I can never find the reported file afterwards - so I presume this does not reside on my PC apart from when actually accessing the web page.

Edited April 6, 2011 by joddle

[Starbuck]

Hi joddle

 

It would seem that a few Avira users are getting this at the moment.

Almost certainly looks like a false positive.

To make sure that all Temp Internet files are removed, run this:

 

Download TFC by OldTimer to your desktop

• Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

[joddle]

Got the latest update from Avira today which seems to have sorted everything out - they have not yet confirmed this was a false positive although now it seems highly liklely to have been the case. Thanks for the tip on getting rid of old internet files.

[joddle]

FInal response from Avira

 

This was received from Avira tonightDear Sir,I got the final information for this incident. The virus lab confirmed this asa false positive. So the recent virus definition file solved the issue as itis supposed to do. Thank you for your feedback.Best regardsTarik JaidaneAvira GmbH