hacked in even with rapportalliance-leicester

chris_m

My hosts file has a darned sight more than that in it - for starters, all the advertising sites I don't want any contact with are pointed to 127.0.0.1 ;-)

StevieJ

Loads of stuff from Spybot.

oldfella

lets try and be more helpful ... is there an entry for alliance-leicester.co.uk

joe134

oldfella wrote: »

I typed in url as he suggested and got taken 3 times to a spoof A&L site

have a look at C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS

it should just have
127.0.0.1 localhost

is there anything else in it ?

Hi, how do you get into it?I presume it,s a file.?

StevieJ

joe134 wrote: »

Hi, how do you get into it?I presume it,s a file.?

Just copy and paste into your internet address box above.

joe134

StevieJ wrote: »

Just copy and paste into your internet address box above.

Hi, Stevie, I did that this morning and got only a web page all about it, nothing appertaining to A&L.I,m still not sure what i,m supposed to be looking for? Is it a download tool to clean up?

masonic

joe134 wrote: »

Hi, Stevie, I did that this morning and got only a web page all about it, nothing appertaining to A&L.I,m still not sure what i,m supposed to be looking for? Is it a download tool to clean up?

Use Notepad. Just select File -> Open and then navigate to the file oldfella posted above.

To be honest, it really sounds like there is something nasty on your system. You should consider backing up your precious data and then doing a complete system reinstall. That's the only way you can know for sure you've got a clean system that's safe to use for internet banking.

joe134

masonic wrote: »

Use Notepad. Just select File -> Open and then navigate to the file oldfella posted above.

To be honest, it really sounds like there is something nasty on your system. You should consider backing up your precious data and then doing a complete system reinstall. That's the only way you can know for sure you've got a clean system that's safe to use for internet banking.

Hi, Apart from A&l I have never encountered a problem with IB. I take on board what you say, though it does seem rather drastic, nothing is showing up on any of my security systems which are all up to date.If there are spoof sites out there. nothing I do with my system will alter that.I must admit A&L has thrown up a probable system compromise which may mean me doing as you say.although I maintain it was A&L ,s problem , you saw their data to me.I will seriously consider your suggestion, thanks,Regrads the file>open. I have no idea where I am supposed to be looking. When I copy and paste that url Sys32. I get a web page not a file, including wikipedia ,about sys32.etc. I am obviously on the wrong track as everyone else, my fault I guess.:

Mikey17

Every time i try to access the first page of this thread i get this warning from my av

Requested URL:hxxp://forums.moneysavingexpert.com/showthread.html?t=2357223 Information:Contains recognition pattern of the HTML/Spoofing.Gen HTML script virusHas someone posted an infected link or something ?

Had to change the http ( not allowed to post links, as a new user )

masonic

joe134 wrote: »

Hi, Apart from A&l I have never encountered a problem with IB. I take on board what you say, though it does seem rather drastic, nothing is showing up on any of my security systems which are all up to date.If there are spoof sites out there. nothing I do with my system will alter that.I must admit A&L has thrown up a probable system compromise which may mean me doing as you say.although I maintain it was A&L ,s problem , you saw their data to me.I will seriously consider your suggestion, thanks,Regrads the file>open. I have no idea where I am supposed to be looking. When I copy and paste that url Sys32. I get a web page not a file, including wikipedia ,about sys32.etc. I am obviously on the wrong track as everyone else, my fault I guess.:

What you are looking for is a file on your computer. It's a text file, so you need to open it using a text editor, such as Notepad. If you load Notepad first, you can then use it to open the file (using File -> Open) and then change the bit at the bottom that says "Text Documents - *.txt" to "All files - *.*". You can then find the file, which is located in the C:\Windows\System32\drivers\etc folder and is called "hosts".

It sounds to me like the link you have in your favourites is taking you straight to the online banking page at A&L (mybank.alliance-leicester.co.uk), but when you type in https://www.alliance-leicester.co.uk, you are getting redirected to the spoof sites, or a spoof login form is being injected into the real A&L page (which happened to somebody else recently here).