1

A fake bank page appeared as i was trying to acess my bank account. The support attendant from the bank told me that i might have a trojan on my notebook and net.

  • I think it might be a phishing🐟 attack .Linux viruses are very rare. Can you give me the URl of the fake bank page? – Suici Doga Feb 16 '16 at 6:47
  • Sure, no problem: the url is bb.com.br/pbb/pagina-inicial#. It's in portuguese, sorry for that. as I enter my internet password it leads me to a page askinf for my account password. Now i always insert the wrong password to check if it's the real page. So you think i don't have a virus in my notebook? That's a relief. I know its very rare, thats why i was surprised. No need to format my notebook then? Thanks a lot. – Pilar Leminski Veiga Feb 17 '16 at 14:51
4

Are you running wine? If so, try clearing out your virtual C drive. If you have one, it's incredibly unlikely it's anything but a Windows virus hijacking a wine installation. Linux viruses are exceptionally rare and those that do exist typically target the larger server based distributions rather than smaller desktop distributions.

I would say more than likely, you were the victim of a phishing scam. Ensure you only ever enter your bank log on information into the site if you've typed the site's URL directly into your browser and never when linked to it from another page or email. For more information, research the topic "online phishing".

  • Thanks for your help. As i answered in the comment above, as I enter my internet password it leads me to a page askinf for my account password. Now i always insert the wrong password to check if it's the real page. I installed clamAV and ClamTk and it has found i lot of potentially harmful itens. I'm a newbie in Linux, so there's a lot i don't even understand how they work. So thanks again for your help. – Pilar Leminski Veiga Feb 17 '16 at 14:58
  • But now, even when i type the site's URL, i can't acess: it appears another page alerting me that the site is not safe. What is this fishing scam and how do i remove it? – Pilar Leminski Veiga Feb 17 '16 at 15:06
0

If you are using Firefox , go into the preferences tab , then go safely tab and disable the last two boxes. This should solve your problem.

  • Would you be able to list what those last two boxes are, they are likely to change in the future. – Lewis Goddard May 17 '16 at 22:36
0

First what comes in mind when correctly entered URL leads to a fake page is DNS settings. Did you check if the same behavior is present when you're trying to connect to your bank URL from other devices on the same LAN? I'd check DNS settings on the router, modem and laptop to see if they were altered by someone.

Also don't ever trust green padlock next to your site URL - when connecting to something such important as a bank account I'd always check the server certificate and the issuer. Believe me, I experienced it myself at work where employer installed his own root CA to sniff encrypted communication... and there is always famous Lenovo scandal with SuperFish ;)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.