Online Banking virus problem

northerngeezer

Hi,

I have been using online banking for the last year or so to do all my banking without problems.

But for the last week or so everytime I enter my password and code a new screen appears asking for my full name, address, card pin number, CVV number, full 16 digit card number and postcode.

Obviously I cancel and do not proceed further.

I have phoned both banks (abbey and A&L) but their call centres are of little help.

Is there anyway to detect why this is happening and how to solve it ?

Any help gladly appreciated

Thanks

albertross_2

how are you getting to the site, typing it in, or clicking on a link, or search, or favourites?

do you have a virus and malware scanner installed?

anything unusual in c:\windows\system32\drivers\etc\hosts

http://www.kaspersky.com/virusscanner

if you have gone to a phishing site, you should use someone else's pc to change your banking password asap, or speak again to the helpdesk.

TonyLisaP

Sounds like a hijacked page to me. Open it and paste the URL that comes up in your address bar here.

northerngeezer

https://www.mybank.alliance-leicester.co.uk/login/checkPM5.asp

...but I have just clicked on the link and that is not the page that is displayed asking for all the info..

page that appears is pasted below



Internet Banking Log In

For security reasons, please confirm your details to continue with Online Banking.

Password

Pin

Credit Card Number

Expiration Date
/
CVV2

ATM PIN

Forgotten your security details? Important information

Beware of fraudulent e-mails!

Alliance & Leicester plc will never send e-mails that ask for confidential information. If you receive an e-mail requesting your Internet Banking security details, you should not respond. Please forward it to us at [EMAIL="frauddepartment@alliance-leicester.co.uk"]frauddepartment@alliance-leicester.co.uk[/EMAIL]. If you are concerned that you may have divulged your security details please contact us on 0845 300 2562 (please dial +44 113 220 1505 if calling from outside the UK).
Learn more
Register for Internet Banking

Click here to Register for Internet Banking A&L Credit Card Servicing

Do you have an Alliance & Leicester Credit Card?
Want to service it online? Visit the Card Servicing site

[IMG]http://forums.moneysavingexpert.com/ https://uk.sitestat.com/alliance-leicester/rfs/s?mybank.login.CL1[/IMG]</img>var docform = document.loginform;

TonyLisaP

I suggest you phone alliance and leicester and have a chat with them as this APPEARS to be the genuine webpage. If I goto alliance and leicester homepage directly here then hit login I get the same URL but I would certainly be suspicious of any bank needing all these details to verify your account.

northerngeezer

albertross wrote: »

how are you getting to the site, typing it in, or clicking on a link, or search, or favourites?

do you have a virus and malware scanner installed?

anything unusual in c:\windows\system32\drivers\etc\hosts

http://www.kaspersky.com/virusscanner

if you have gone to a phishing site, you should use someone else's pc to change your banking password asap, or speak again to the helpdesk.

I have ran Spybot, AVG antivirus and Adaware but the problem is still there.

I will try the above and I have also sent the details to A&L fraud department.

withabix

Your PC has been hijacked, not the bank's web page.

Do you have antivirus/antispyware installed? Up to date?

Have you clicked on any emails supposedly 'from' your bank? This is how the virus/executable will have got itself onto your pc.

albertross_2

start, run, cmd

ping https://www.mybank.alliance-leicester.co.uk

what ip address comes up (e.g) [212.137.70.222]

TonyLisaP

albertross wrote: »

start, run, cmd

ping https://www.mybank.alliance-leicester.co.uk

what ip address comes up (e.g) [212.137.70.222]

Do you think there might be an entry in the hosts file?

OP if you goto c:\windows\system32\drivers\etc and open hosts with notepad could you paste the contents here?

northerngeezer

I have just reinstalled Spybot and downloaded the latest files.

Ran it and it removed MyWebSearch and something called Fun...

..and everything seems to be fine

northerngeezer

TonyLisaP wrote: »

Do you think there might be an entry in the hosts file?

OP if you goto c:\windows\system32\drivers\etc and open hosts with notepad could you paste the contents here?

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost