SOLVED Possible Trojan?

[Peta]

I went onto the Saga website this morning and got the following message:

The requested URL was rejected. Please consult with your administrator.

Your support ID is: 18376934452691773957
I have a stand-alone machine.

I have had this before with my old computer and on searching the internet, if I have understood things correctly, this might be a Trojan.

I ran a full computer scan of McFee which brought up nothing and on contacting their helpdesk, they said that Trojans can get under the fence even when up to date. They are offering an on-line service to sort it out at £60.

I then purchased StopZilla and ran a full scan but it didn't find anything. Their helpdesk asked me to send a diagnostic scan which I did but have heard nothing further. I then started getting nasty blue screens with APC-INDEX-MISMATCH so I have deinstalled StopZilla.

I keep re-reading stuff about this "requested URL etc etc" and I think it is a trojan but it seems to be very difficult to get rid of. Anyone met the problem before please and have any suggestions?

 

[yodap]

Download Malwarebytes (free version) and install and update it. Run a complete scan and let us know what you have. Then eradicate it.
http://www.malwarebytes.org/mbam.php

 

[Veedaz]

They are offering an on-line service to sort it out at £60.

They can stuff that !. Go with Yodaps advice and find out what you may have first.

 

[Peta]

Thanks Yodaps. I did as you said and ran a complete scan which took over an hour but no malware was detected. I then retried the Saga site www.saga.co.uk and got the same error message but I think the number has changed.

The requested URL was rejected. Please consult with your administrator.

Your support ID is: 18376934452722532003

so the blighter is still there somewhere!!!!

 

[catilley1092]

Peta, welcome to the forum! What AV do you use? MSE (Microsoft Security Essentials) is a really good AV & malware cleaner, plus it's free, from Microsoft. A scan with that program may reveal and repair your problem.

You don't need to uninstall your current AV to use it, but it's best to disable the "real time protection" that you may have, so it won't bump heads with what you have. Should you need further assistance, feel free to post back anytime.

Cat

 

[Peta]

Still no joy!

Cat: thanks for your advice. I downloaded MSE and ran a full scan which took over 4 hours. Nothing found but still can't get on the SAGA website.

The requested URL was rejected. Please consult with your administrator.

Your support ID is: 18376934452723103234

Note that the number has changed again. Ho hum!

 

[Kalario]

Looks like the issue is not a trojan. I don't know what it could be, but maybe another member has any ideas.

 

[TrainableMan]

From what I have been reading this could be caused by a COOKIE created by google.analytics. Try clearing your cookies and close & restart your browser and then go to the SAGA site. Please post back the results.

 

[catilley1092]

If you have Firefox, there's an add on called Better Privacy. It deletes those tracking cookies that builds up in your system, even the ones that CCleaner can't reach. It deletes them when you close your browser. Everyone gets them, especially eBay visitors, and other online sites that utilize tracking cookies.

If you have IE, then Super Anti-Spyware will do essentially the same, but you will have to scan your system, just as an AV. Really, it's not a bad thing to do, the program finds all kinds of adware and tracking cookies in your system, and puts them in a "chest", much like a virus chest. You can go to them and either restore (or preferably) delete them. Hope this helps.

Cat

 

[Peta]

Clearing Cookies didn't work

From what I have been reading this could be caused by a COOKIE created by google.analytics. Try clearing your cookies and close & restart your browser and then go to the SAGA site. Please post back the results.

thank you for this advice. I did as you said (then had trouble getting back into this site!!!) but the outcome is still the same. Get the same error message for the Saga site but a different number.

I am using IE 8.

 

[Peta]

Clearing Cookies.

I did delete everything when I cleared the cookies - which I am sure is going to drive me dotty for a few weeks! I did not have any saved in a "chest". Thanks again for your help and advice.

 

[TrainableMan]

Other things I found in search think maybe it could be some virus/trojan etc so try running rkill and see if it finds anything. There are several different files available in case it won't let you run it as one name you can try another.

Here is Nibs article on this utility (and see his link) ...
https://www.w7forums.com/kill-persi...ore-running-your-security-software-t6033.html

 

[yodap]

I agree with TM. rkill should be the next step.

Is this the only site that you can't visit? Is this the site for the band Saga? If not, tell us a little more about it. Are you typing the address or using a link or both. Perhaps one of us can post a link to the site or a secondary link from within the site for you to try.

 

[Peta]

I agree with TM. rkill should be the next step.

Is this the only site that you can't visit? Is this the site for the band Saga? If not, tell us a little more about it. Are you typing the address or using a link or both. Perhaps one of us can post a link to the site or a secondary link from within the site for you to try.

Thank you for this suggestion. Not the band - but a site for people over 50 for cheap insurance, travel etc. Not very exciting I am afraid! www.saga.co.uk. I am not desperate to go there but I am concerned about the error message I am getting and why! I would hate to think that there is something lurking in my computer which is causing possible damage.

 

[Peta]

Rkill

I agree with TM. rkill should be the next step.

Is this the same as StopZilla? I can't puzzle it out from the web sites. I have tried this software and came up with a zero on a full computer scan. I have since disabled it as I wasn't sure if it was giving me problems for APC-INDEX-MISMATCH which I did not have before and have not had since (touch wood).

 

[yodap]

Okay. Your link works for me. Try this one which came from inside the travel section and let us know.

http://www.saga.co.uk/travelandleisure/features/norway-north-cape.asp

 

[Peta]

Okay. Your link works for me. Try this one which came from inside the travel section and let us know.

http://www.saga.co.uk/travelandleisure/features/norway-north-cape.asp

Nope - that's blocked with the same error message! Different number of course.

But I can get into http://travel.saga.co.uk/holidays/touring-holidays/search/destinations/south-america.aspx which is how I discovered I still had the problem when a friend sent me the link.

 

[TrainableMan]

And here I thought it was Saga the massive multi-player role playing game.

Were you able to download and run rkill to see if it finds anything? Please let us know.

Does this occur on other sites? Maybe your IP or even country (if you are outside the UK) is banned? - {never mind, new inspiration, read on}

OK, if I try to use a proxie server to access the site I get an error message "XML Parsing Error: not well-formed" line 111, column 91. So I am thinking their website is not up to current standards and your browser is set to detect errors and this makes it blow up.

Tools - Internet Options (maybe write down the current settings so you can change back if this doesn't work)
Security Tab: Mine is set the medium-high & "enable protected mode" is checked
Privacy Tab: is medium
Advanced Tab: check "automatically recover from page layout errors w/ compatibility mode", check "disable script debugging (IE)", uncheck "disable script debugging (other)", uncheck "display a notification about every script error", check "enable automatic crash recovery", near the bottom in security check "empty temporary internet files folder when browser is closed"

Close IE, reopen, try the site and if it fails then try the refresh button as well.

 

[Peta]

[
Were you able to download and run rkill to see if it finds anything? Please let us know.
No I have'nt done this yet. The software seems to be the same as Stopzilla which I have run and it made no difference, but if I have this wrong, please could you give me a link to this software and its download.

So I am thinking their website is not up to current standards and your browser is set to detect errors and this makes it blow up.
This is a very respectable company widely used by the over 50s for holidays and insurance and I would have thought that their website was up to speed and as it should be for the silversurfers like me!

Tools - Internet Options (maybe write down the current settings so you can change back if this doesn't work)
Security Tab: Mine is set the medium-high & "enable protected mode" is checked
Privacy Tab: is medium
Advanced Tab: check "automatically recover from page layout errors w/ compatibility mode", check "disable script debugging (IE)", uncheck "disable script debugging (other)", uncheck "display a notification about every script error", check "enable automatic crash recovery", near the bottom in security check "empty temporary internet files folder when browser is closed"

My settings were as you list above apart from the two which I have made into Bold. I did as you said, but no joy - the error is still there.

 

[TrainableMan]

There are at least 5 common browsers and usually at least 3 different release versions of each in use at any given time (this is low balling actually, it could be more like 100 variations). Add to this all the settings which can change amount of memory, whether cookies or java are enabled, flash or silverlight. IE8 is relatively new, under a year, thus the reason it offers a compatibility mode. And programmers are just people, not perfect. If this is the only website that gives you this error then it is extremely likely it is the coding of that site along with your browser and security settings.

Have you tried accessing the site with another browser like Firefox, Google Crome, or Opera? Do you run any anti-malware / script protection that you could disable and then try? Do you block any websites with your hosts file?

You might also try emailing the website administrator.