Exploit blocked on bank login

[JohnnyCyprus]

When I login to may bank account MWB reports that it has blocked an exploit.  See attached report file.

Is this a real threat?

 

HSBC Malware.txt

[TheMalwareDiscoverer]

1 hour ago, JohnnyCyprus said:

When I login to may bank account MWB reports that it has blocked an exploit.  See attached report file.

Is this a real threat?

 

HSBC Malware.txt

Hi as I can see from the log file you put in this discussion the threat isn't on your bank website but on your browser (Internet explorer) so the problem isn't the access to the bank but the browser which starts an apparently malicious VBscript; if you change browser malwarebytes block again the exploit on the site?

[JohnnyCyprus]

I only use IE, as I have doubts about the other browsers.  Could I not simply identify and delete the script?

[JohnnyCyprus]

I have discovered that this message seems to be caused by the password management application called "Lastpass".  It includes an add on to IE that I suppose runs a script of some sort.

I have now deleted my bank account site from the Lastpass Vault and the blocking message has gone away - I can login manually without triggering a warning from MWB.

The Lastpass application has caused all sorts of problems in the past and I am in the process of getting rid of it anyway.  I would recommend that people avoid these password generators, as they rarely work on bank account and other financial websites and waste a great deal of the users time.

I don't think that MWB can be at fault in this matter, although a bit more help with my query would have been appreciated.

[Rsullinger]

Hello,

 

The main issue with the suggestion of trying other browsers is Johnny will not run into that issue on another browser. Google and Firefox for example do not use client side vbscripting.

 

However, it is not uncommon for websites with a portal to use a vbscript to load it in IE like banking websites or e-mail clients. Unfortunately from the log I won't be able to tell if its malicious or not since we block the action that it is doing not the script itself. The script could be perfectly fine and we just block the first instance of it. So if it is something the bank website is doing, it should be able to continue the log in so you can navigate your bank like normal. Just to confirm as well, it is only this bank log in correct? You don't get it from going to any other site?

 

One thing you can do to see if it is something in IE is just restore IE back to default. 

 

[JohnnyCyprus]

Thanks RSullinger - your post arrived after my own latest posting.

I believe that I have resolved the issue by deleting the bank website from the Lastpass Vault. Lastpass doesn't really work on Bank accounts due to the application of two stage logins, secure key devices and random characters requested from passwords, so it is no loss.

With respect I don't like using different browsers - it is bad enough to have MS selling my activity.  I have experienced problems with Chrome anyway and  found IE to be best of a bad bunch.

Thanks for the suggestion - I could have lived with the message, but wanted to know if there anything sinister going on.  I do get various glitches from other bank logons, mainly caused by poor website development or the dreaded Lastpass, hence my decision to ditch it.

[Rsullinger]

Hey Johnny,

 

I always hate when that happens, just 1 minute behind yours. But that makes sense that lastpass interference with it could be causing that issue. Let me know if you run into any other issues!