ihh
|
posted on January 22, 2009 02:25:53 PM new
Stone--that is NOT a real ebay page. The address bar should be green (that's what color mine turns to when on a secure site) and there should be a lock icon next to the address bar.
|
pixiamom
|
posted on January 22, 2009 06:41:55 PM new
I guess it's possible that eBay and PayPal were hijacked and that their pages are being redirected - spooky thought. Keep us updated.
|
hwahwa
|
posted on January 22, 2009 07:35:23 PM new
Is English not your first language?
That so called sign in page is so poorly written that a first grader wouldn't fall for it.
/////////////////////////////////
I guess STONE is from MARS ! AND MAJOR IN Latin!
*
Economic Reform act of Chairman Obama of the socialist States of America :
10 ounces of meat per month,half a yard of cotton per year per adult.
Hellilujah!
|
vintageads4u
|
posted on January 23, 2009 05:24:27 AM new
There is an article on bleepingComputer.com about this phish and how to get rid of it using Dr Web-Cure it.
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t171869.html
I would probably do everything this guy did and then use Dr Web.
good luck Stone, Hi Tom
Beth
http://shop.vendio.com/vintageads4u
|
neglus
|
posted on January 23, 2009 05:59:21 AM new
Hi Beth - that looks like the solution! What I don't understand is how Stone's neighbor happened to have the same ebay redirect but I guess it's possible they are both infected.
It seems like AV is pretty much useless in preventing and solving these kinds of attacks!
Stone keep us updated!
-------------------------------------
http://stores.ebay.com/Moody-Mommys-Marvelous-Postcards?refid=store
|
glassgrl
|
posted on January 23, 2009 06:20:08 AM new
QUOTE: "I never used shortcuts or go to my favorites when going to either site. I always type in the url address."
Here is how his neighbors computer *looked* infected.....
my guess is Stone will never tell us the rest of the story.
|
ggardenour
|
posted on January 23, 2009 08:34:01 AM new
Have forwarded it to
[email protected]
I would also send the PayPal email to
[email protected]
they will be able to tell you if in fact they are for real.
gg
|
neglus
|
posted on January 23, 2009 08:39:33 AM new
GG - there is nothing to forward. This was not an email. This is what happens when he tries to log in to PP and eBay typing in the correct Url.
-------------------------------------
http://stores.ebay.com/Moody-Mommys-Marvelous-Postcards?refid=store
|
ggardenour
|
posted on January 23, 2009 09:18:45 AM new
Hmmmm.... my bad. I wondered why nobody had come up with that one LOL. Sorry stone that all I got.
|
glassgrl
|
posted on January 23, 2009 10:08:53 AM new
edited to add he/she because I still think Stone is a girl and I said his up above.
anyway we don't know that Stone is typing in www.ebay.com as an url.
|
deichen
|
posted on January 23, 2009 01:06:44 PM new
Stone is a man, posted pixs a few months ago of himself and kids.
|
stonecold613
|
posted on January 25, 2009 08:39:51 PM new
Yes, I know how to type in the url. I have been doing it for nearly 10 years now.
Ok, I have concluded that it is a virus. Thanks to everyone for your patience in convincing me of that.
So far, I have done all of the steps suggested here and many others that the links from Google have taken me. I did find some trojan horses that the regular anti-virus did NOT pick up. However, this has not fixed the problem as of yet. I will try some more tomorrow to see what happens.
I have read about a few other steps that are quite involved and time consuming that I will be trying, not to mention the time consuming steps that I have already done.
I will give everyone here a warning though. It appears that this virus isn't just exclusive to ebay and paypal. It also searches for bank and credit card info as well. Meaning if you do online banking, you could be at risk.
|
neglus
|
posted on January 25, 2009 08:44:28 PM new
Good luck Stone. I hope you don't have to reformat. Hang in there!
-------------------------------------
http://stores.ebay.com/Moody-Mommys-Marvelous-Postcards?refid=store
|
pixiamom
|
posted on January 25, 2009 08:45:46 PM new
Really sorry it hit you, Stone. Viruses are not fun. Edited to add, I don't know why the common AV software we all depend on can't detect these viruses. Sure, they pop up fast but we detect them on Vendio long before they are picked up by the AV software we pay for. Something is not right,
[ edited by pixiamom on Jan 25, 2009 09:00 PM ]
|
glassgrl
|
posted on January 26, 2009 12:03:37 PM new
It seems almost more like a keylogger than a virus to me, wouldn't you think?
I don't know about you but I would format that hard drive in a heartbeat. There's no way I would feel safe until I did.
|
neglus
|
posted on January 26, 2009 12:18:28 PM new
It seems like the guy in Beths post directing you to:
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t171869.html
At the very end he tries Dr Cure It and that seems to have done the trick. Did you get that far Stone?
-------------------------------------
http://stores.ebay.com/Moody-Mommys-Marvelous-Postcards?refid=store
|
otteropp
|
posted on January 26, 2009 12:51:07 PM new
I was hit with this too!
Every program we used to scan for virus showed that it was just fine.
My DH has been practically living in the Den for the past three days fixing it for me!!
He has built all of our computers and is a 'geek' and yet during this episode there has been 'blue air' coming from the Den and I have stayed away except to offer the occassional cup of coffee or food!
He also took the opportunity to get me a new hard drive and other parts that will make my life easier!
I am struggling along on the laptop and it is driving me crazy...I will be so glad to have my own machine back.
In all the years I hav been using oomputers I have never had anything as stubborn as this virus.
|
ChristopherCS
|
posted on January 26, 2009 01:28:59 PM new
There is a program available called 'hijackthis' that works extremely well for getting rid of the nastier viruses out there.. It can also help point out spots in your registry that you may need to address manually to get back going again.
You have to be really really careful with it though, as if you make the wrong changes to your windows registry you may not be able to boot up again without having to reinstall windows from scratch.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
|
vintageads4u
|
posted on January 26, 2009 03:39:11 PM new
Hijack this was great when computer cops was still on the internet. You could post your log and they would tell you what to delete. I'm not sure if computer geeks does that or not.
Hope it works out OK
Beth
http://shop.vendio.com/vintageads4u
|
stonecold613
|
posted on January 26, 2009 04:52:06 PM new
Neglus,
I did find that thread about the Dr. Cure. I downloaded it and ran it. So far it found three problems, but I had to leave work before it finished running. That was after 7 hours. Have a 130 Gig hard drive on that computer. I will see what happens in the morning. It was kind of a bummer though. I didn't have use of that computer at all as you have to have it in Safe Mode to do the scan. Our work requires internet access with Java capabilities and in safe mode, it won't let us in.
|
glassgrl
|
posted on January 26, 2009 04:59:48 PM new
Do you have XP? If you do, you might want to try the Reimage thing. They found two things on my computer that were not malware but legitimate programs they recommended removing they didn't recognize. One was message tag that I use for Outlook so that I know when someone has opened their email. The other was a reminder program.
edited to add - I didn't PAY them to fix anything, I just let them scan it and they tell you what they find. You can take it from there on your own.
[ edited by glassgrl on Jan 26, 2009 05:01 PM ]
|
stonecold613
|
posted on January 27, 2009 07:30:59 AM new
Success.
Just a few updates on the situation. First, Google search didn't fix anything. However doing a Yahoo search did. I found this thread http://www.bleepingcomputer.com/forums/lofiversion/index.php/t171869.html and if you scroll down about 3/4 of the way, it does explain what to download and how to scan. It did miss one step however. After you complete the scans in safe mode, you need to reboot and then run the scan in normal mode.
Then reboot again and then you are good to go. Now the computer is running great. All my pages are loading like a brand new machine.
To get the download at:
http://www.freedrweb.com/cureit
I recommend it highly.
SC
edited to fix link.
[ edited by stonecold613 on Jan 27, 2009 12:28 PM ]
|
neglus
|
posted on January 27, 2009 07:42:52 AM new
I am glad it worked. Otteropp, if DH hasn't solved the problem yet you might direct him here.
Stone - your link didn't work. Here's one:
http://www.freedrweb.com/cureit/
-------------------------------------
http://stores.ebay.com/Moody-Mommys-Marvelous-Postcards?refid=store
|
deichen
|
posted on January 27, 2009 11:20:15 AM new
Thanks for the update, stone. Now I am paranoid! I have SBC DSL and they just made me download McAffee, do you have any idea where you got this virus from? Does anyone know if Microsoft has issued anything to fight this? I had an automatic update last week. Also, does anyone know if McAffee or Norton has anything to update on this virus? I use ad-aware and it always finds a few not so bad things.
|
otteropp
|
posted on January 27, 2009 01:36:32 PM new
stone...good to hear that you are clear now.
Neglus
I had DH reading this thread and he used a lot of the ideas.
Looks like my computer is now up and running and he is re-loading all my info from the external hard drive that he had put it on just before he started his demolition derby with my machine!
I'm thinking that the 100 cups of coffee and some nice snacks and dinners that I provided helped too!!
deichen: I have no idea where mine came from as I very rarely just 'surf'. I use Outlook Express Mail, eBay, Vendio, Auctiva and PayPal.
My first clue was that if I did a Google search I got the usual search results page but each time I clicked on the link to a page I was re-directed to a page offering to search for cheap hotels!
After a couple of days of that I would highlight the website in the result and paste it in to the toolbar.
On Day 3 the computer slowed to a crawl. We ran several different virus scans that showed no problems....we knew there were and the demolition began!
|
stonecold613
|
posted on January 27, 2009 08:27:53 PM new
I wish I knew for sure where the virus came from. At work, it could be from any of the 50+ computers. They are all in a network. The antivirus there is suppose to be a complete network AV. The neighbors computer is another story. The only thing I can figure is it must have gotten through via e-mail somehow.
|
pixiamom
|
posted on January 27, 2009 09:10:59 PM new
You don't need to open an email or download anything to get a virus anymore. Merely visiting a malicious site via a search on Google can do it.
|
