A little help please.

carrie483

Superantispyware log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/20/2009 at 04:30 PM

Application Version : 4.26.1000

Core Rules Database Version : 3853
Trace Rules Database Version: 1805

Scan type : Complete Scan
Total Scan Time : 00:48:10

Memory items scanned : 496
Memory threats detected : 0
Registry items scanned : 6899
Registry threats detected : 2
File items scanned : 29654
File threats detected : 1

Adware.MyWebSearch/FunWebProducts
HKU\S-1-5-21-2969302126-4026353310-1886354327-1007\SOFTWARE\FunWebProducts

Rogue.Component/Trace
HKU\S-1-5-21-2969302126-4026353310-1886354327-1007\Software\Microsoft\FIAS4057

Adware.Tracking Cookie
ads.revsci.net [ C:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\hotnjox2.default\cookies.txt ]

macman

carrie483 wrote: »

Whilst i'm doing this, i just got an email to say my ebay password had been changed. I've reset it now though but i guess it just got hacked?

No, it was a phishing email! I hope you did not reset it via the link in that email, because if so you have given away your real password to a false login site.
If your password had really been reset, you would not have been able to log in to reset it again.

carrie483

macman wrote: »

No, it was a phishing email! I hope you did not reset it via the link in that email, because if so you have given away your real password to a false login site.
If your password had really been reset, you would not have been able to log in to reset it again.

The email said if you did not change your password then to send a blank email to password@ebay.com I deleted the email and then loaded ebay up in a new webpage, i tried to log in with my old password and it said it was incorrect so i done the 'forgotten password' link and had to set another one.

carrie483

Just doing the malwarebytes full system scan, half hour in, fingers crossed (no infections yet)

macman

carrie483 wrote: »

The email said if you did not change your password then to send a blank email to [EMAIL="password@ebay.com"]password@ebay.com[/EMAIL] I deleted the email and then loaded ebay up in a new webpage, i tried to log in with my old password and it said it was incorrect so i done the 'forgotten password' link and had to set another one.

When you say, you 'loaded eBay in a new web page', do you mean you clicked on a link in the email and it opened a new web page? If you did that then you've been phished. If you went to the eBay log in page by opening your web browser and typing it in or using a Favourite, that is fine.
It sounds like your account was hacked, so I don't understand how you could reset your password. I suggest you immediately change all your password hints/memorable information etc.

carrie483

I didnt click on any links on the email. I'm hoping i caught it before they had a chance to do anything. I've changed all my other passwords now too. I'll change the memorable stuff now.

carrie483

The email (which is in my ebay) does give me the ip address of the first password change which is different to the second one (which i did)

carrie483

Malwarebytes' Anti-Malware 1.36
Database version: 2009
Windows 5.1.2600 Service Pack 3

20/04/2009 17:47:50
mbam-log-2009-04-20 (17-47-50).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Objects scanned: 210485
Time elapsed: 1 hour(s), 9 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

carrie483

aliEnRIK, you're a genius! Many thanks

aliEnRIK

Make sure your NEW ebay password is a very good one

Id suggest using FIREFOX with the NOSCRIPT plugin to be safer in the future

Download FIREFOX
http://www.mozilla-europe.org/en/firefox/

NOSCRIPT
https://addons.mozilla.org/en-US/firefox/addon/722


NOSCRIPT works by blocking ALL website scripts (Which is how dodgy websites infect your computer ~ the easiest way to catch a virus after downloading). So you need to UNLOCK all websites you use for them to work properly (Like this one for example)
It also prevents 'page hijacking' (clicking to goto a BANK page for example and being redirected to a BOGUS page which would give scammers your login details!)
I personally set it so that it DOESNT show messages about blocked scripts. Then all you need to do is use common sense. Think to yourself 'does the site work ok'? If so it doesnt need touching. But if you wanted to watch a video on youtube say, youd need to unlock parts of it. Look bottom right, If theres ANY red on the 'S' symbol, then something is being blocked.

(You will also need the other addons like FLASH etc)
http://www.google.com/tools/firefox/toolbar/FT5/intl/en-GB/index.html
https://addons.mozilla.org/en-US/firefox/browse/type:7