Internet banking security

becky4131

Hi,

Last week i had 1750 pound taken from my bank account (fraud), thankfully i have it back but lloyds advised i run a virus scan on my laptop. Ran a scan with norton but it didn't detect any problems, after reading some threads on here i decided to try malwarebytes. After running a full scan it detected 12 problems/infections and promptly cleared them.

The problem i have is that when i log onto my internet banking it is still asking for me to enter my full memorable information (this is how the fraudsters got my money). I don't know how to stop this as this is obviously a fake site i am getting directed to. How can i stop this happening?

I will download other anti virus software and uninstall my norton as it doesn't seem to have kept me secure!

Any advice appreciated

closed

see section 3 for scanners, and post a hijackthis log - section 1

https://forums.moneysavingexpert.com/discussion/2436849

You could also try rapport if your bank offers it.

bengalknights

Check your pc for a DNS hijack easiest way is to rigght click on your wifi symbol (if using wifi) or network card symbol in taskbar near the clock select status and then support followed by details to see if there is anything filled in.

becky4131

Here is the result from the scan:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5842
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702
22/02/2011 21:01:52
mbam-log-2011-02-22 (21-01-52).txt
Scan type: Full scan (C:\|E:\|)
Objects scanned: 233414
Time elapsed: 1 hour(s), 15 minute(s), 37 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\Rebecca\local settings\Temp\svchost.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\documents and settings\rebecca\start menu\programs\startup\vlkdqtum.exe (Spyware.Zbot) -> Delete on reboot.
c:\program files\HPQ\hp wireless assistant\hp wireless assistantmgr.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\program files\nfsqgtlv\vlkdqtum.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0052895.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0053108.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0053183.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0053325.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0053537.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0056037.exe (Spyware.Zbot) -> Quarantined and deleted successfully.

bengalknights

becky4131 wrote: »

Here is the result from the scan:


c:\documents and settings\Rebecca\local settings\Temp\svchost.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\documents and settings\rebecca\start menu\programs\startup\vlkdqtum.exe (Spyware.Zbot) -> Delete on reboot.
c:\program files\HPQ\hp wireless assistant\hp wireless assistantmgr.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\program files\nfsqgtlv\vlkdqtum.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0052895.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0053108.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP46\A0053183.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0053325.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0053537.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
c:\system volume information\_restore{d5341f9c-33f7-43cf-8bd2-1ae937c9ba1b}\RP47\A0056037.exe (Spyware.Zbot) -> Quarantined and deleted successfully.

There in was the problen just run another scan with malware bytes, search and destry and your anti virus to make sure it fully gone

Sedated

becky4131 wrote: »

Hi,

Last week i had 1750 pound taken from my bank account (fraud), thankfully i have it back but lloyds advised i run a virus scan on my laptop. Ran a scan with norton but it didn't detect any problems, after reading some threads on here i decided to try malwarebytes. After running a full scan it detected 12 problems/infections and promptly cleared them.

The problem i have is that when i log onto my internet banking it is still asking for me to enter my full memorable information (this is how the fraudsters got my money). I don't know how to stop this as this is obviously a fake site i am getting directed to. How can i stop this happening?

I will download other anti virus software and uninstall my norton as it doesn't seem to have kept me secure!

Any advice appreciated

The same happened to me a few days ago. I was on the Halifax online banking, logged in went through the memorable dropdown pick 3 letters/numbers then unusually was asked for my memorable word. I just (maybe with hindsight foolishly) suspected it was another new security question seeing as when you log onto the Halifax they are always advertising changes to make online banking safer!
Any how I woke up to emails confirming I had successfully created a fast (or is it quick) payment to *****. The fraudster had moved a lump some money from my ISA to my Current account and within 2 minuits had taken 3 lots of £450 to his account. The Halifax are now hopefully sorting it.

Since then My PC has been redirecting me to other sites when clicking on say google searches.
Also When opening IE not only is my homepage opening but so is a search engine. Either Google or random ones Ive never head of, plastic,slendid?
These are hidden behind the home page. Tab behind but as if it was the first page opened..

[SEARCH][HOMEPAGE]__________________
,<<<<<<<<<,HOMEPAGE SHOWING.>>>>>>>>

Ive run McAffe it picked up 4 trojans also Malwarebytes another 5 trojans. I still get the redirecting but nothing pops up in scan reports (and Ive done loads!) and I wont use the PC to sign into anything till I get it sorted. I think it needs flattening and a complete reinstall before I feel safe enough.

JustPassingBy

becky4131 wrote: »

The problem i have is that when i log onto my internet banking it is still asking for me to enter my full memorable information (this is how the fraudsters got my money). I don't know how to stop this as this is obviously a fake site i am getting directed to. How can i stop this happening?

Easy. If you type in the URL of your bank or use a bookmark of the URL there is no chance of your going to a fake site.

Sedated

JustPassingBy wrote: »

Easy. If you type in the URL of your bank or use a bookmark of the URL there is no chance of your going to a fake site.

I tryed that but I still get redirected, same happens if I type google directly into my browser. If I go directly to google by that method I then type say "Go Compare" a list of searches shows as per normal. Click on the Go Compare link Im redirected to another search engine or Car insurance site.



I

becky4131

Sedated wrote: »

I tryed that but I still get redirected, same happens if I type google directly into my browser. If I go directly to google by that method I then type say "Go Compare" a list of searches shows as per normal. Click on the Go Compare link Im redirected to another search engine or Car insurance site.



I

Mine was doing that too. In the end i had to do a complete reboot of my computer and wipe the system as if it was a new laptop. Lost all documents on system and programs but i wasn't bothered becauses there wasn't anything important. Since then my laptop has been fine and not had anymore problems. The virus scans don't seem to pick up the problem.

closed

scan with links in post 2, and check contents of your c:\windows\system32\drivers\etc\hosts file

macman

Sedated wrote: »

I tryed that but I still get redirected, same happens if I type google directly into my browser. If I go directly to google by that method I then type say "Go Compare" a list of searches shows as per normal. Click on the Go Compare link Im redirected to another search engine or Car insurance site.



I

First thing to do is uninstall McAfee, run the McAfee Removal Tool and then use a decent AV program. Avira, Avast or MSE are all free and do a much better job.