Virus checker stopping unothorised Visa up-load
 

My Virus checker Trend pccillin keeps coming up with a warning window, stopping Visa up-load. Is someone trying to hack my details and should I strengthen my security on other items. I have my browsers set so that all private data is password secured and is deleted everytime I leave the net. Am I still vulnerable.

I am still having this problem, I have the warning window come up 3 time in the last two hours. Do I have anything to worry about.

Sorry, Christine. No idea what's going on for you but I hope someone answer you soon.

Suggest you run a full virus scan of your computer and see what it comes up with, post your results when you have them. You could also try installing a Spyware program like Webroot SpySweeper and see what that comes up with.

nirofo.

nirofo I have run a virus check this morning, it came up with nothing, not even malawhare. Its getting a worrying as I buy things of the net and even though I delete all private data after, and reboot I it is still coming up with the warning.

Try downloading and installing Webroot SpySweeper, it often finds things on my computer that my antivirus and firewall have missed.

Here's a web link to their download page, you can run a free scan from there also.

http://www.webroot.com/uk/downloads/

nirofo.

Suggest as well as nirofos SpySweeper, try Spyware Blaster from
http://www.javacoolsoftware.com/spywareblaster.html
and

Spybot Search and Destroy
http://www.spybot.info/en/index.html

Hope this helps.

Duncan

nirofo I downloaded the program and run it and it has found 4 spy cookies.
bs.serving-sys cookie
2o7.net cookie
serving-sys cookie
a cookie
These 4 are in the status as found and another 27 which mustn't be important.

Saphire;
You can google the found malwares to see what each do. It seems the second and third could be responsible for what you experienced. Check this link or likewise:
2o7.net cookie
Among the suggestions for spyware your best bet are:
Spybot
Adaware
Both free to use. I can't live or leave pc without these 2 that have saved a lot of trouble in past. BTW you need to have both as they are complimentary to one another, finding the malwares that the other one wont recognize.

Having that said, remember, spayware recognition softwares are very different from antivirus softwares so you need both of them separately and need to run them periodically that way. You have your antivirus so I wont get even there.

Well still you are not completely secure. That is missing the 3rd part. A very important part indeed, which is a firewall. You need this to allow what comes in and what goes out. In other word, in particular, nothing goes out without your knowledge.
"ZoneAlarm"
is the king of this part. Beware that this can be very distracting when run at full secure way, asking you every thing for being safe after an "Enter" bottom is pushed.

After all these if you need my advise. Have the general precautions, the common sense ones, all the time. Have a whore PC (Excuse my language) that is used for any thing virtually and gets reformatted and reinstall with OS etc once in while. This assures a very fast PC all the time, you disappoint a lot of potential hackers and cookie makers. Then another one for your important stuff, paying bills, buying on line, etc. Make sure Chris is not hearing this or I can not play anymore Mac Joke with him, I use a mac for this part. This one never surfs the web for fun or by anyone else (Hopefully as teenagers are sort of creatures that can not be thought at home and I have one).

Well to sum up what you are still missing is the firewall.

Windows Vista has made a lot of security issues integrated and is told to be a lot harder to get into. So may be you want to have some plan for near to mid-far future.

Hope this helped.

Thanks for your help sassan I already have adaware and spybot installed but it didn't find those cookies. Would zone alarm run alongdide my other firewall pccillian as that is the one that is giving the warning.

It sound to me that you have too many utilities doing the same job.
It is not a good idea to run more than one anti-virus or firewall program as they can stop one another working correctly. Also they are all actively running at the same time, which can be counter productive.

I use AVG from Grisoft which can be down loaded free at http://free.grisoft.com/doc/1
The ZoneAlarm firewall is another free piece of software which is very good, it can be downloaded at http://www.zonelabs.com/store/conten...eeDownload.jsp
Since using both of these products I've not had a virus or PC invasion.

Adaware is a useful program to detect spyware, I prefer this to most others as it seem to detect more and I also use Spybot, between them my pc seems to run un-invadered.

Another useful utility is HiJackThis which when run tells you exactly what programs are loaded at boot-up. You then have the option to stop programs which you think can be malicious from being loaded.
This is probably better in the hands of the more experienced user.

Steve

I agree with Steve as basically his suggestions are exactly what I do too. Including the use of AVG that I find as one the best antiviruses out there and for long, for free.
The last advise is not really needed as you always you can go to:
Start>run>type: msconfig>startup bar (Last option on the right top) and you see all the programs running at start up. I would check any suspicious name (The one that I am not familiar with) on yahoo or google, unselect all not needed (A good time to say good bye to a lot of harmless ones that just occupy the memory for no good reason). As Steve said be careful in doing so (Definitely do it at your own risk) as it is so easy to mess up the entire system here if you are not sure of what you are doing. Backing up the registry before doing any change is a definite step you want to undertake before going any further.

Steve2005, I haven't made myself clear all I have running at one time is Trends pc-cillan which is an all in one package firewall and Anti spyware tool. Its is stopping any info being up-loaded to the web and is normally good at preventing downloads. The only thing I can think of something new was downloaded in between updates which is done every day. The other programs Adaware and spybot are not automatically loaded at start up and kept in memory. I just run them once a week to check everything is okay
None of the program other than the one nirofo recommended have found those files because its only a demo it doesn't delete them what also is strange when I rerun the program it didn't find the files the second time.

Hi Saphire

I'm afraid you're not running one of the best pieces of protection software, PC-cillin is known to miss the parts that others find ? A good and well respected protection package is by Kapersky, you can download trial versions at the following web address.

Hope this helps.

http://www.kaspersky.com/uk/trials

nirofo.

Thanks nirofo I have just renewed my subscription to trend.:( I found it to be much better than and Norton and a few other well known brands. It had all the best writeups as well.

Christine
I would download and run HiJackThis as it will give you a complete run down of everything which is loaded. Sassan is right that you can use msconfig but this will not show everything.
You maybe able to detect the adverse programs which you have already identified through nirofo's recommended program and prevent them from running again.
Steve

Hi Saphire

Are you actually running a new installation of Windows Vista on a new or updated computer or XP on any computer, if you are running Vista then this is just Windows dialling home in an attempt to download the latest Bill Gates spy rubbish, if the thing pops up again, right click on it it and click stop (disable) download, this is a known event with windows downloads. One sure fire way to stop it is to disable windows update, you dont need it anyway, you can download the updates from various places without going anywhere near Microsoft. If you are using XP then I suggest you do the same as for Vista. I'm sure it's not a serious threat or you would see more action from your protection software. Webroot SpySweeper is extremely good at what it does and is well respected throughout the trade, it detects most attempts at changing the web addresses it has not been authorised to change, it also stops any new startup programs that have not been authorised. You need to make sure you run and update it regularly.

nirofo.

Thanks everyone for your suggestions I am running XP its was a new installation in Dec and up until last week I never had a problem. Its possible I have everything set up tight and thats why its coming up with more warnings and asking to allow the connection which I don't. I have just about checked everything, Hijack hasn't come up with anything suspicious I had forgotten about that program so thanks steve2005 for the reminder. I have even done a complete search for my any credit card No that could be hidden in a file and found nothing, which is a relief.

Why bother with trials when you can get the product this cheap?
http://www.aria.co.uk/Products/Softw...roductId=24067
£6.70 + £3.99 P&P

Bit of a bargain if you ask me.

Hi Saphire

Like I said, it is likely, especially as your XP is a new install, that Windows update has logged on to Windows updates web page to find the latest updates for your XP and is trying to download/install them, it does this in the background and only lets you know when it has what it thinks is updates you should have. If this is so you should see an icon appear in the bottom right of the taskbar, if you right click this icon there should be something in the menu to disable the update. If I were you I would disable windows automatic updates altogether, most of the stuff you don't need anyway!

Try this link for a utility to download Windows updates independantly.

http://www.softpedia.com/get/Interne...wnloader.shtml

nirofo.

Thanks nirofo I have switched off windows update and downloaded the above. I had a close look at one of the log files in Trends PC-cillan it seems the error only occurs when I do a refresh either on here or birdforum strange.

Hi Saphire

Not sure what would cause that unless birdforum and worldphotography forum have some sort of embedded adware or spyware, it could be it invokes Windows update to run when you do a refresh ?????

nirofo.

Nirofo it won't allow me to post the error out of the log file it blocks me and kicks me off the site.

I have just tried again by removed some of the words like http and .com of WPF and it still wont post.

At least its telling me its blocking anything to do with the word visa in it.

Might I suggest that if this is a constant worry to you, that you format your drive and do a complete reinstall of Win XP, I assume you've already tried restoring your computer to a time before you started to have this problem and that didn't work. Do you have an XP installation disk, not one of those useless boot you back to square one disks.

nirofo.

Nirofo. I don't want to have to reformat again I have only just finished getting everything back as it is. I did a backup of everything before I re-formated and it didn't save the most important files of all my settings so have had to slowly reinstall everything one by one. I have a 20gb partition just for the system files the rest on the other partition. I have tried going back to when I first installed but it still keeps coming up. When I go on the net to buy anything I empty my cash and private data then close down and reboot I never save any of my settings so have to log back into everything when I restart. I think I am fairly safe but its just a bit disconcerting when you think someone is trying to get in through a back door.

What web browser are you using?

walwyn, I am using firefox.

Assuming that the sypware and antivirus programs are correct and that there is nothing on your machine perhaps the firewall is getting confused over the data that firefox sends when you refresh a page. Can you check if its browser related, what happens if you do the same with IE?

I have done a screen capture of what I am getting. Today it seems to be everytime I leave the machine idle.

Just a thought, why not restore the system to a date before the problem started?

Hi Saphire

Looks to me like your Firefox web browser is trying to access a Google web link, maybe to install one of their many toolbars. I guess you must have installed some software recently which craftily leads you into ticking (or not ticking) a box that allows this download, you've really got to be on alert for this subterfuge these days. Only thing I can suggest is to fully uninstall your recent software (one at a time), restart your computer and see if you still have this problem. Also, go to the Start Menu, click on Run, type in msconfig and press return. Click on the Startup tab at the top of the box that appears, carefully go down the list of programs that automatically start when you start Windows, if you see one that looks like Google or Firefox, untick it and restart your computer. Dont untick any others at this stage !! If you see any others that look iffy but don't have Microsoft Windows attached to them you can untick these also one at a time, restart computer after unticking each one. If you find that some of your programs don't work after you have unticked a certain program just retick it and restart the computer.

Hope this helps.

nirofo.

Looking back over my old log files it has been going on for months in the background, but this past week these have been the first warnings. All the logged ones before then were being passed as sent.

This is what I have in startup at the moment, I can't see anything untoward.

Hi Saphire

This is what is displayed when the web page address is accessed.

Looks to me like it's trying to invoke some sort of E Banking, there's mention of PayPal, Visa and various world bank web addresses.

NOT SURE WHAT ALL THIS MEANS, IN YOUR SHOES I WOULD DO A COMPLETE SYSTEM WIPE AND REINSTALL> MAKE SURE YOU BACK UP YOUR PERSONAL FILES AND PHOTO'S FIRST !!

nirofo.

I would totally agree with nirofo, having just visited a couple of the sites.
Firefox tells me, with no uncertainty, that these sites are attempting web forgery.

Ooh! that looks nasty. I never save my visa No when I have bought online and I always clear private data and reboot, I have a place secured in the virus checker called visa which has nothing in apart from the last 4 digits.Should I do a seach for the whole Number on my computer and delete if I find any or would they be hidden.

Would I have to totally re-install everything or would or would the new install recognize all programs.

I'm afraid a new install would need you to reinstall all your software as new, windows will not associate with any previous software installs. You need to do a complete format to be sure you removed everything before re-installing Windows XP. However, if you have more than 1 hard drive in your computer, (not separate partitions on the same drive), then you can locate all your personal files and photo's etc on the spare drive. Make sure you backup your e-mail cache also, you can sift through these later without accessing them.

Don't chance a repair, you'll never be sure you totally cleared the trojan / malware / spyware / virus etc.

nirofo.