Sites request credit card info when logging in Chrome Windows 10

[ccarlsonnh]

When I log into sites like Amazon and eBay using Chrome on Windows 10, I get a request for credit card info.  Does not happen when using Edge or Chrome on Android.  I've reinstalled chrome, reset sync, reset Chrome, run MWB scans multiple times all to no avail.  Since I use Chrome across devices, would like to continue using but very concerned about security.  Seems to be a redirect but I have not found what might be causing it.  Could not get  any info from Chrome user forum.   Any suggestions most appreciated!

[Maurice Naggar]

Hi,      
My name is Maurice. I will     be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.

 

What is the Start page  ( a.k.a. home page ) set to on the Chrome browser  on this Windows 10 ?

Is Chrome set to "re-open" the same page from the last session ?

From which link do you start Chrome ?   desktop link ?   task bar shortcut link ?   or from the Run menu ?  or else from the Start menu of Windows ?

It is possible  ( maybe) that there is some extra "site link"  that has been introduced into the Properties of the shortcut-link you use to start Chrome.

Close Chrome / all of its tab-windows.   Go to the shortcut-link you used and do a Right click on that & right click again "Google Chrome"  & click Properties.

Look carefully & real close at the "target" line & also the "start in" line  and look to see if any website link is shown there following  

chrome.exe"

You need to see what follows the trailing double-quote character.

Is there a site-link there ?

Go real slow and careful.

.

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history" 
Check mark the line "Download history" 
Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue ) 
[   2   ] 
After that, make real sure that Chrome is "NOT" set to reload the pages from the last session 
Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the address bar 
Then look deeper in SETTINGS 
 

 

Make real sure it is "NOT" set to "continue where you left off"

 

Now, while still with Chrome on-screen, press & hold the CTRL key on keyboard & tape the HOME key

What does Chrome now show for a Home page ?

.

Edited September 11, 2020 by Maurice Naggar

[ccarlsonnh]

Hello Maurice and thanks for responding!  My name is Carl

My responses to your post as follows...

 

Hi,      
My name is Maurice. I will     be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.

 

What is the Start page  ( a.k.a. home page ) set to on thic Chrome browser  on this Windows 10 ?  Google

Is Chrome set to "re-open" the same page from the last session ?  It was but I changed it to "new tab"

Form which link do you start Chrome ?   desktop link ?   task bar shortcut link ?   or from the Run menu ?  or else from the Start menu of Windows ? Open from task bar shortcut

It is possible  ( maybe) that there is some extra "site link"  that has been introduced into the Properties of the shortcut-link you use to start Chrome.

Close Chrome / all of its tab-windows.   Go to the shortcut-link you used and do a Right click on that & right click again "Google Chrome"  & click Properties.

Look carefully & real close at the "target" line & also the "start in" line  and look to see if any website link is shown there following  

chrome.exe"

You need to see what follows the trailing double-quote character.

Is there a site-link there ?  Nothing following the double-quote.   

Go real slow and careful.

.

for Chrome, while Chrome is running:
Press & hold SHIFT+CTRL+Del keys  on keyboard to get menu for clearing browsing data:

Check mark the line  "Browsing history" 
Check mark the line "Download history" 
Check mark the lined "Cached images and files"
and press Clear Data button  ( in blue )   DONE
[   2   ] 
After that, make real sure that Chrome is "NOT" set to reload the pages from the last session 
Go into the settings menu of Chrome by first clicking  the control icon of Chrome on upper right of the address bar 
Then look deeper in SETTINGS 
 

 

Make real sure it is "NOT" set to "continue where you left off"  DONE

 

Now, while still with Chrome on-screen, press & hold the CTRL key on keyboard & tape the HOME key

What does Chrome now show for a Home page ?  Opens a new tab

Should I run another scan? Thanks!

 

.

[Maurice Naggar]

Hello Carl.    Your last reply included a bunch of my text and threw me off.

Yes do do a new scan with Malwarebytes for Windows   and attach a copy of that scan run result.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

I would point out, that the 2nd screen capture you had from your 1st post .....was Ebay indicating to you "It looks like you signed in from a different computer".

That is not a message I would expect if I were to simply go visit the front page of Ebay   as just a normal visit.

I need more clarity about all this.   Is the issue only at Ebay  & Amazon ?

Edited September 11, 2020 by Maurice Naggar

[ccarlsonnh]

Hi Maurice... sorry for all that text!   

The only sites I have seen this on so far have been Amazon and eBay and only on Windows Chrome.  

 

No threats were detected in the most recent scan...

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 9/11/20
Scan Time: 3:23 PM
Log File: 4183169e-f464-11ea-80b6-780cb88718d2.json

-Software Information-
Version: 4.2.0.82
Components Version: 1.0.1036
Update Package Version: 1.0.29699
License: Premium

-System Information-
OS: Windows 10 (Build 18362.1082)
CPU: x64
File System: NTFS
User: WINDOWS-NPLJFU8\Carl Carlson

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 341532
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 6 min, 21 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

 

Thanks!

Carl

[Maurice Naggar]

Had you done some prior "unique" step at one or the other of those sites?

Q2:   If you use the EDGE browser & just simply go to the normal front page at Amazon,  does the oddity happen then ?

 

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.
Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan.
Adwcleaner  detects factory Preinstalled applications too! 

Please download  Malwarebytes AdwCleaner https://downloads.malwarebytes.com/file/adwcleaner

 
Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it.
At the prompt for license agreement, review and then click on I agree.

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).
Then click on Dashboard button.
Click the blue button "Scan Now".

allow it a few minutes to finish the Scan.   Let it remove what it finds.
NOTE:  When it comes to the section "
Pre-installed applications

You can skip that.
Please find and send the Adwcleaner "C" clean report.
In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".
Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

That C clean report will be the one with the most recent Date and time at folder  C:\AdwCleaner\Logs
Thanks.  Keep me advised.
 

 

[ccarlsonnh]

No prior "unique" step at either site.   Using EDGE I do not get oddity on either Amazon or eBay.  I will do the ADW and let you know.  Thanks!

[ccarlsonnh]

Attached is the log file from ADWCLEANER

 

Thanks,

 

Carl

AdwCleaner[C00].txt

[Maurice Naggar]

Thanks.   Let me suggest following up with these 2 different scans.

[    1    ]

The Microsoft Safety Scanner  is a free Microsoft stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system. 
The download links & the how-to-run-the tool are at this link at Microsoft 
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

  
Let me know the result of this.
The log is named MSERT.log  
the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is
C:\Windows\debug\msert.log
Please attach that log with your reply.
 

[    2    ]

I would suggest a free scan with the ESET Online Scanner
Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.

When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan

Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
Click The blue “Save scan log” to save the log.
If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
Press Continue when all done.  You should click to off the offer for “periodic scanning”.

[ccarlsonnh]

Hi Maurice,

I've attached the MSS log.  It  appears that 2 trojans were detected.

Thanks so much for all your help... I would have had no idea where to start with this!

Carl

MSSlog.txt

[ccarlsonnh]

Now I can log into the Amazon and eBay sites without the redirect asking for credit card info.  I now wonder whether I should be running scans in addition to  Malwarebytes since that did not find or correct these two trojans?  Or, is it something I need to do in my settings for MWB?   Thanks so much!

Carl

[Maurice Naggar]

Good morning.   What were found & removed were

C:\Users\Carl Carlson\AppData\Roaming\{8E7A0271-A38E-3912-8686-BC28D54673A0}\Icqibo2.exe    classified by MS as  Trojan:Win32/IcedId.DBX!MTB

& C:\Users\Carl Carlson\AppData\Roaming\MusiCalm_setup.exe classified by MS as Trojan:Win32/Doplik.B

You should run the scan outlined below.    And also look on your system for anything named "Musicalm".

.

This is to insure that Windows File Explorer is set to show all system folders & all hidden folders & files:

lets make sure that Windows File Explorer is able to show all folders, including any Hidden ones.

 Use the Option Two as in this article at Tenforums

https://www.tenforums.com/tutorials/9168-show-hidden-files-folders-drives-windows-10-a.html

.

I would suggest a free scan with the ESET Online Scanner
Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

 

It will start a download of "esetonlinescanner.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.

When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan

Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.

Click The blue “Save scan log” to save the log.

 

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
Press Continue when all done.  You should click to off the offer for “periodic scanning”.

[ccarlsonnh]

Thanks again, Maurice!  No "musicalm"  on my PC.  I ran the ESET scan and at the end I only got a screen saying "some detected items were found" rather than a specific number.  Also, no button for "view detected results."   Perhaps I missed something along the way.  Hopefully, the ones found have been deleted.  

Should I run MSS and ESET regularly to reduce probability of future infection?  Was hoping MWB would be enough but guess the scammers are too smart for that :-(

 

Have a good evening!

 

Carll

[Maurice Naggar]

You should run scans with your Windows 10 Windows Defender Antivirus, as well as scans with Malwarebytes for Windows.

If you have the Malwarebytes Premium then it would do a daily scheduled scan.

As to ESET,  you can if you wish do a future scan.    You would just need to be sure that you do a new download of the scanner tool.

You can if you wish do scans with the MS Safety Scanner, just be sure that you do a new download of the tool.

I am glad that the original issue is done away it.

I wish you all the best.    🤑

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you