SOLVED Please help - cannot remove pop up asking for credit card details

[kanna]

Today I tried to login to ebay. After I entered my username and password, a pop up window appeared asking me for my credit card details. Obviously a scam. My ebay login screen becomes a purple shade. There's no way to get rid of the pop up unless I close the whole browser.

I've scanned my computer using MSE and Malwarebytes. MSE picked up a picked up a threat but it was removed. I've rescanned and there are no threats found.

I tried to go back to ebay and the pop up window is still there yet MSE and Mawarebytes are telling me there are no threats.

Can anyone please help?

 

[TrainableMan]

There are reasons eBay could require a credit card ... to be a seller, to browse items in the 18+ section, so you might also call them. Try another computer such as at work or the library ... just be sure to log out if you do get logged on to eBay.

If you really are compromised then ...

Download several versions of RKill (get link HERE)

Then reboot your computer into safe-mode & run RKill. Then without restarting, run a complete scan with malwarebytes.

Unfortunately there are some rootkits that are even tougher than RKill, but it's worth a shot.

 

[Shintaro]

You can try Microsoft Defender Offline Beta: http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offline

The boot device can be a CD or a USB. At any point I would reccomend that you boot off the CD or USB that is created with MS Defender.

Hope this helps

 

[kanna]

Computer has been fixed. Thank you.

 

[TrainableMan]

Could you tell us how? That way if someone comes along with the same issue they will be able to resolve it quicker.

 

[NyRaised]

Could you tell us how? That way if someone comes along with the same issue they will be able to resolve it quicker.

I own a computer repair shop and came across this nasty for the first time today. I used 6 different scanners and it wasn't picked up by a single one. I did find a trace of it using HitmanPro. The way I was able to get rid of it was to run HiJackThis and scan it and scroll down thru the BHO's and anywhere else you see a group of letters and then the.exe (hfgtssnxjj.exe just as an example) and check them and remove them. If the do not get removed on first try, then open the task manager and you will see that in the process list thet file with the .exe Then right click the file(s) and choose end process tree not just end process. Once you stop the process from inside the task manager then go back to HiJackThis recheck and remove those items and then your done.

Moderator EDIT: Removed listing to posters professional computer website/facebook.

 

[NyRaised]

sorry wasnt trying to spam just offer up some free help as I get the emails instant on my phone...trying to be helpul...30 + years in business

 

[TrainableMan]

No worries, I could tell there was some thought in your post and not just the blatant spam "great post" along with an email address.

If you like, you can edit the post above, take out my comment, and just say something like "If I could be of any more assistance please post me a note from my homepage (click on my nick and choose the "Visit NyRaised's Homepage" link)" or something to that effect but please don't insert the link into the post.