IE corrupted to steal info

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

DonnF - 08 Jul 2008 06:07 GMT

Monday I tried to sign on to my stock broker with IE same as always. The
home page went to the sign-on page okay but after I entered my user name and
password, the next page was called "Client Info" and wanted all sorts of
confidential data. I exited and called the broker. That page wasn't theirs!
This was IE6 on XP PRofessional.

I cleared all temp data and cookies, ran several mal-ware programs, updated
to IE7 and did a system restore to an ealier time when things were okay,
Nothing changes the hijacking. Graphics look good and the security icons
seem okay. The home page seems to be correct as it changed a little when I
deleted cookies as it should. Then sign-on as before. Then bogus. The
broker is looking into it.

It doesn't do this when I try with a Firefox browser. Also, trying to
access Windows Update from the tool bar crashes IE. I think it did when 6
was running and I know it does with IE7. Seems to coincide with this problem
as I have used it fairly recently.

I would really appreciate ideas on how to clean it out and/or keep it from
recurring. It scares me a lot about what might be stolen. It doesn't seem
like one can uninstall IE and reinstall it clean. If only.

Thanks much,

Donn

Reply to this Message

PA Bear [MS MVP] - 08 Jul 2008 06:54 GMT

Judging from similar posts here in the past month or so, the behavior may be
due to a Vundo-ZLOB-SDBot infection, all of which is protected by a rootkit.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a thorough check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

==========================================

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/default.aspx?gprid=6527

Support for Windows Update:
http://support.microsoft.com/gp/wusupport

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

> Monday I tried to sign on to my stock broker with IE same as always. The
> home page went to the sign-on page okay but after I entered my user name
[quoted text clipped - 25 lines]
>
> Donn

Reply to this Message