Computer Hope
Software => Computer viruses and spyware => Topic started by: girlinterrupted on September 19, 2007, 09:25:06 PM
-
Hello...I can not sign in to ebay, after putting in user name and password it goes to a blank screen with this https://signin.ebay.com/ws/eBayISAPI.dll?co_partnerid=2&siteid=0&UsingSSL=1 in the address. Can you please tell me what is wrong?
I have windows xp, dell inspiron 1150 lap top. I can log in on my other computer. thank you
-
get ccleaner from www.ccleaner.com
run it and try it. if its still not working then tell me what browser your using.. ie7 or ie6 or firefox etc
-
thanks for your help I ran it, but still can't log in. I belive I am using internet exployer 7.
Also I don't know if this means anything but before I log in I get a Security Alert telling me that the name on the security certificates is invalid or does not match the name of the site. I usually say yes and proceed. Although I don't remember this message popping up before ::)
-
it might try this
if using internet explorer 7.. go to tools internet options and set each tab to defualt and restart internet explorer
-
OK I tired that but now I get this message "The security certificate presented by this website was issued for a different website's address. Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server. " if I continue it goes to that blank screen with "https://signin.ebay.com/ws/eBayISAPI.dll?co_partnerid=2&siteid=0&UsingSSL=1" highlighed in pink. Did a setting get changed, ebay should be a secure sight!! I never had any problem before, of course now that I want to sell something I can't log in. :o
-
try firefox until we can sort this out
-
I downloaded foxfire...but it still won't let me in. The message about the certificate still comes up. I tired to get help from ebay, but since I can log in on another computer they said they couldn't help me...go figure. Any more suggestions before I call geeks? thanks so much!
-
It sounds like your browser is being redirected, start with these 2 online scans then get back to us.
Ewido/AVG Anti-Spyware Online Scan (http://www.ewido.net/en/)
Panda Activescan (http://www.pandasoftware.com/products/activescan.htm)
-
OK I tired those scans and it still doesn't work!! Is there any hope? I still get the certificate message! thanks for all your suggestions so far!!
-
can you take a screenshot of this for us
-
There is a problem with this website's security certificate.
The security certificate presented by this website was issued for a different website's address.
Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
We recommend that you close this webpage and do not continue to this website.
Click here to close this webpage.
Continue to this website (not recommended).
More information
If you arrived at this page by clicking a link, check the website address in the address bar to be sure that it is the address you were expecting.
When going to a website with an address such as https://example.com, try adding the 'www' to the address, https://www.example.com.
If you choose to ignore this error and continue, do not enter private information into the website.
For more information, see "Certificate Errors" in Internet Explorer Help.
I copied and pasted what it says..will that work? Not sure how to get a screen shot.
https://signin.ebay.com/ws/eBayISAPI.dll?SignIn&ru=http%3A//ebay.com/&_trksid=m37
the tab saysCertificate Error: Navigation Blocked
thanks!
-
ok go to windows update do the custom option and update anything there i bet there might be a Certification update. if there is one after the update try logging into ebay. then follow
this guide (http://www.saviour-pc.com/forums/view.php?pg=malware_guide) and then this one (http://www.saviour-pc.com/forums/view.php?pg=win_guide) and see if that helps
-
OK I tried that also cannot still get on! Although on scan said I had a .dll error. I googled it and downloaded a reg scan, which found errors. It fixed some and said I needed to pay to fix the rest. Does this sound like something I need to do? Ok thanks!!
-
remove that program and google eusing registry cleaner, its free
-
OK I tired that...it still does not work I still get blocked :o thanks..is it hopeless??!!
-
lets see what other members have to say ..
when did this start?? have you tried to restore your computer to before this started?
-
It just started the other day. I haven't tried to restore anything. Ebay is my only problem. I can log on or into any other site so far expect for ebay!
-
try a system restore (not a reformat,) you won't lose anything
start>all programs>accessories>system tools>system restore.
restore to a day before it started.
-
I tried that..but it wouldn't let change the date!
-
ummm... post a hijackthis log for me, it might take more than one post to fit it all
-
sorry don't know how to do that
-
http://www.saviour-pc.com/forums/view.php?pg=hijackthis
make a folder on your desktop for hijackthis and put it in there.. open it and create a log and copy and paste it here it might take more than one post
-
OK here it is
Logfile of HijackThis v1.99.1
Scan saved at 5:24:30 PM, on 9/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\inf\Apache2.2\bin\httpd.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\WINDOWS\inf\Apache2.2\bin\httpd.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\inf\svchost\svchost.exe
C:\WINDOWS\inf\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Forte Systems\Chiro8000\FileServer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Michele\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Chiro8000 File Server.lnk = C:\Program Files\Forte Systems\Chiro8000\FileServer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apache2.2 - Unknown owner - C:\WINDOWS\inf\Apache2.2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: SQL Server (MSSMLBIZ) (MSSQL$MSSMLBIZ) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
thanks
-
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
O2 - BHO: (no name) - {8CA5ED52-F3FB-4414-A105-2E3491156990} - (no file)
gett rid of those
give spybot search and destroy a shot
-
so I just select and delete? or select and click "fix checked". then go to google and find spybot and run it? sorry just want to make sure!!
-
select and click "fix checked". and goole spybot and go here (http://www.atribune.org/content/view/24/2/) dl the program and follow those instructions and same for this program (http://www.geekstogo.com/forum/How-to-remove-Winfixer-Virtumonde-Msevents-Trojan-vundo-ATLDistrib-t91765.html) and post the log it talks about
-
Spybot told me I have 484 infection but need to pay before they will fix. I tried to log in to ebay, but still I get the message... ::)
-
Here is the free version of Spybot Search and Destroy (http://www.saviour-pc.com/forums/downloads.php?do=file&id=15).
You need to be logged in to download it...
If you're already logged in...just go to the Downloads page and do a search for Spybot...you'll find it there.
-
How did you set IE to it's defaults?
Was it something like the following?
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Security tab
6. Reset all 4 security zones to Default
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Privacy
6. Restore 1 Default button
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Advanced
6. Restore 1 Default button
You may need to do the following as well
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. General tab
6. Remove cookies, temporary files and history
Kudos to Raptor.
-
OK I did the spybot and also changing and deleting cookies. I still can't log in. So I don't know I guess geeks it is!! :'( thnks for all your help and suggestions!!
-
These two files are in your running processes...
C:\WINDOWS\inf\svchost\svchost.exe
C:\WINDOWS\inf\svchost.exe
I don't know if they're related to your problem, but you should get rid of them. Reboot into Safe Mode, enable hidden files and folders, and delete those two files. Don't get them confused with C:\WINDOWS\system32\svchost.exe, which is legit. If you have any problems deleting those files (you may need the help of Killbox (http://www.bleepingcomputer.com/files/killbox.php)), let me know. You should post a new HijackThis log so I can see if we're making any progress.
-
I deleted..still not working. I have questions I am no pro but..maybe I deleted that dll file thats let me share? Is it possible to download that dll file? (hey I don't even know what a dll is so I could be total off based! ::)). I am just desperate since most geek/tech stores are closed.
-
It's possible that a missing file could be causing problems, but I think it's unlikely. However, we may be able to find out. Do you have an official Windows CD for your computer? Do you have trouble logging into other sites, or just eBay? Also, have you tried contacting eBay to get their opinion?
I'm still interested in seeing a new HijackThis log.
-
OK last time here...do I go to another forum to start as a new hyjack? ::) I did ask ebay and they said since I can log on from another computer that is my laptop not their problem. Last night Dell logged on to my computer..basically did what everyone told me here to do and still couldn't fix it (they tired for about 2 hours!)..he said it was ebay's problem, since I only have a problem with their website!! I really don't want to pay someone big bucks to tell me the same thing and not fix it. Any other suggestion would be greatly appreciated!!
-
no you can post it in this topic, it might just take more than one post to get the complete thing posted
-
How did you set IE to it's defaults?
Was it something like the following?
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Security tab
6. Reset all 4 security zones to Default
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Privacy
6. Restore 1 Default button
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Advanced
6. Restore 1 Default button
You may need to do the following as well
1. Start
2. Settings
3. Control Panel
4. Internet Options
5. General tab
6. Remove cookies, temporary files and history
Kudos to Raptor.
Yes or no would be helpful, did you use the 6 default buttons?
-
yes