Help - something is wrong with my Internet Passwords

Viruses and worms
1

I would deeply appreciate help.

Problem: My web pages are not remembering my information. Normally I go to Google or Yahoo and I am signed on automatically. Today, I am also getting signed off right away on some account or am not be allowed on.

Question: Is this a trojan?

Possible background: I run Avast antivirus software. I run Windows XP on SP2 and update everything all the time.

I have very little spam trouble with my home server (optimum online) but my work server (BlueHost) lets spam through. Normally, I am smart enough to delete spam.

Last week I opened an e-mail posing as a Blue Mountain Card. Stupid I know but I have gotten these before from a friend.

Since then, I have had my Internet log in problem.

I just ran the avast cleaner (11 May 2007 version). It did not find any infections but gave me the following message.

c:\WINDOWS\SoftwareDistribution\EventCache{89ABA5 CD-343D-4AD9-92F3-3A323EA6F08E}.bin could not open file

Please could someone tell meif this is causing my problem and recommend how I should proceed? I understand some of the basics of computers but not too much so please make this as clear as possible if you respond.

Thanks in advance!

Kelley

2

Some would say that this, remembering passwords is a vulnerability as they have to be stored somewhere, this could leave them open to harvesting. I think it is RoboForm that does this but encrypts the user names and passwords giving a degree of protection, this program is a paid option.

I would say that this is more likely to be a cookies issue as that is often what is used to automatically log on in some sites, if you or a security application disabled cookies then this could be the effect.

I can’t see any reason for any malware to mess with your passwords in this way as it draws attention to itself and that I would suggest is the last thing it wants.

Have you run a boot-time scan and did avast find anything ?
What is your firewall ?

Also the avast cleaner is only designed to look for specific viruses/worms, etc. and the list is on the page where you downloaded it, http://www.avast.com/eng/avast-virus-cleaner.html. avast includes the virus cleaner and if it detects a virus on the list it would run the cleaner.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode.

  1. AVG anti-spyware (formerly Ewido) If using winXP. or a-Squared free if using win98/ME. Or SUPERantispyware Or Spyware Terminator
3

Thanks DavidR,

I actually ran the AVG anti-spyware before logging back on here. It did identify 6 medium risk cookies and two high risk programs in the Windows32 folder. I had the program remove these and we’ll see if that gets me back to normal. I’ll follow up this post later if needed.

Cheers!

4

RoboForm stores (encrypted) up to 10 logins/passwords for free, as far I know.

Do not delete, but send to Quarantine…
Can you post the name/path of the infected file and the name of the infection?
To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com

5

As Tech said, don’t delete as that won’t help avast detections.

Before any action, be that deletion or whatever, first add the file/s to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.

6

Sorry guys,

I screwed up and didn’t capture even the names of the two path/files that were caught by AVG. I could have at least written them down but didn’t. I ran the anti-spyware right off the web and just tood the remove option it gave me.

If there is someway for me to go back and run something to find them again to pass on the info, I’d be happy to try that.

Everything is fine again seemingly.

7

No, the on-line scan doesn’t collect data or save a report or quarantine the file, etc. that is why we give links to downloadable software where you are in control.

The main thing is that your system appears to be OK. I would still recommend you download the AVG-AS or another anti-spyware which can be run in conjunction with avast to provide additional multi-application protection.

Welcome to the forums.

8

Thanks DavidR, I am downloading the AVG-AS. I appreciate your help. I learned a lot today by necessity!

9

Your welcome.