Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Search in Amazon/eBay redirects to their online banking screens


  • This topic is locked This topic is locked
6 replies to this topic

#1 Dennis_B

Dennis_B

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 12 June 2011 - 08:30 AM

This problem started about 2 weeks ago. Whenever I perform a search on the Amazon or eBay home page I get a popup screen claiming to be for Amazon or eBay's online banking and requiring personal data to be entered. I don't deal with either of these company's at this level and immediately became suspicious. What's strange is personal information is already displayed on the screen even though I haven't signed-on yet (see attached pdf as an example). Clearing all cache, save form data, history, etc does not help. This happens in both IE8 and FF4.0.1. I have performed a full virus scan with Avast and Norton, also malware scans with Spybot & Malwarebytes -- all found no issues. I did run Norton power eraser and it indicated that xcpip.sys and xpsec.sys were bad. The removal failed so I renamed both files to ".old", however this still did not fix my problem.

I'm sure I'm infected somewhere but I just canít seem to locate the issue. Thanks for your help.

Attached Files



BC AdBot (Login to Remove)

 


#2 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:31 AM

Posted 15 June 2011 - 08:35 AM

Hello Dennis_B and welcome to BC. :)

Sorry about the delay, do you still need help?

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#3 Dennis_B

Dennis_B
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 15 June 2011 - 09:37 AM

After much searching I found someone with the exact same problem I had in the Avast forums. You can see the thread here "http://forum.avast.com/index.php?topic=77444.0" Basically I had a rookkit infection and was finally able to remove it with aswMBR. Thanks.

Dennis

#4 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:31 AM

Posted 15 June 2011 - 10:07 AM

Meaning we can consider this topic as resolved, right?

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#5 Dennis_B

Dennis_B
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:31 PM

Posted 15 June 2011 - 11:46 AM

Yes, you can close this topic, thanks.

#6 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:31 AM

Posted 16 June 2011 - 07:19 AM

Thank you for letting us know.

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 


#7 sempai

sempai

    noypi


  • Malware Response Team
  • 5,288 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:3 stars and a sun
  • Local time:05:31 AM

Posted 16 June 2011 - 07:22 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

~Semp

btn_donate_LG.gif
You can help me continue the fight against malware by making a donation, Thank you.

If I am helping you and I didn't reply within 48 hours... Please send me a private message.
Topics that are not replied within 5 days will be close. Please don't PM asking for support, post on the Forums instead.

Member of UNITE (Unified Network of Instructors and Trained Eliminators) 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users