• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.
  • Welcome to Free PC Help, a free PC Help forum to get help with your computer problems.

    Free PC Help is a community that offers free computer help and support for all users, all ages, worldwide.

    In order to start asking questions or contribute on someone else's post you will first need to register. Don't worry - it's quick and easy and once you have registered you will have instant access to the entire forum.

    If you do decide to join the forums you will not have the option to send Private Messages [ PMs ] or add a Signature until you have made 5 posts or more. This is an attempt to try to stop Spammers using the PM system or adding links to their Signature.

  • Due to the complexity and risks involved our formally trained malware staff will be the only ones allowed to help with malware removal advice. Thank you.

Infected computer that has hacked hotmail and facebook accounts.

johnD

FPCH Member
Joined
Jul 24, 2010
Messages
7
Location
England
PC Experience
Very Experienced
#1
Hi guys,
im using xp home edition.
My partner's facebook and hotmail accounts have had their passwords changed at 3:27 am this morning and it happened a couple of days ago too but we managed to recover them.
Upon checking the ip where the passwords were changed from it gave our ip both times.
i know it would be asked so i'll get it out the way :p the computer was off at this time and its the only pc that accesses the internet here as it connects through a modem atm, waiting for a new router.
I'm pretty sure that its some form of virus that has changed the passwords to a pre defined word and then the hacker can use the accounts without giving up their ip? not sure. any help would be appreciated.
Thanks, JohnD
 

Synapse

FPCH Long Term Member
Joined
Jun 18, 2010
Messages
479
Location
Lincolnshire
PC Experience
Very Experienced
#2
I don't do much infection cleaning these days, but when I did, if I came across one that was confirmed as having active threats as you describe I would wipe it and reinstall.

Cleaning a machine up is a challenge for any security tech, but there is a point where you just cannot be sure all of the system files are clean.

In my opinion you should back up your data, and reinstall.
 

KenB

Administrator
Joined
Oct 19, 2008
Messages
9,077
Location
Wirral UK
#3
I suggest that you ask / wait for Starbuck to advise.
He is the only one here who is up to date with present malware and virus removal techniques.
He knows his stuff :)
 

johnD

FPCH Member
Joined
Jul 24, 2010
Messages
7
Location
England
PC Experience
Very Experienced
#4
okie poke, thanks guys. i wont clean install just yet, but the disc is here if i need it. i'll wait for starbuck for now =]
 

Goku

FPCH Long Term Member
Joined
Jun 6, 2008
Messages
1,570
Location
India
#5
Ah ... and just so that this comes to his attention as soon as he comes online, I will be moving this thread to the Malware Removal Forums. Till then John, you just hang in there and grab a drink! :)

-- Goku
 

Starbuck

Admin & Security Team
Joined
Feb 19, 2010
Messages
4,429
Location
Midlands, UK
PC Experience
Very Experienced
#6
Hi John,

Sorry for the delay.

Ok, let's try and get some idea of what's going on.

Step 1
Download TFC by OldTimer to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

Step 2
Please download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on Download_mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Full Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Step 3
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check
.

.


  • Now copy the lines in the codebox below.
    Code:
    netsvcs
    msconfig
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    CREATERESTOREPOINT
  • right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.


    .
  • Click the Run Scan button.


  • Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

In your next reply, please submit:
MBAM scan report
Both reports from OTL

If the reports are too big to post here, add them as attachments

Thanks.
 
Joined
Sep 19, 2010
Messages
6
PC Experience
Some Experience
#7
Hi,
Looks like the original poster never followed up with the results. I hope it isnt too late to resurect this thread. I had a similar experience with my wife's hotmail account. I've also got a virus requiring manual removal on my computer and I think that it might be related. The virus is backdoor.tidserv!inf and I'm having a hard time getting rid of it. I'd like to follow the instructions above and post the results. Does that work or should I create a new thread?

Thanks,
Shane
 

RandyL

Administrator
Joined
Jan 22, 2003
Messages
4,878
Location
USA, Nebraska
PC Experience
Very Experienced
#8
Hi.
Please create a new thread. It's rare for two things to be identical. Thanks for asking.