Have I been hacked?

Kazipoo

Hi guys,

Just wanted to run something by you all.

I have Mcafee complete protection and Rapport software at the recommendation of my bank. I have never had any security problems as far as I am aware.

At the beginning of January, I received an email from a company that I have previously bought something from, thanking me for my order of £86! I had not ordered anything, so emailed them immediately to tell them this. They told me that payment should have been made via paypal, and since it hadn't been made, they were happy to cancel the order. I also told them to delete my details from their system. The order, by the way, was due to be delivered to my home address, not a different one, like you would imagine would happen if it was a scammer/hacker. Anyway, it worried me a little, and I actually posted here on the forums to let people know that a mystery order had appeared with this website, and just to be on their guard.

The following week I logged into my emails fairly early (5am), which is unusually early for me, to notice that two emails were "read". Knowing that I had not read them myself, I immediately suspected that someone was obviously reading my emails. I changed the password and security questions straight away. I then went to my most used websites, which I also (stupidly I know) used the same password for and changed them too. I suspected at this point, that an estranged member of my family was reading my emails, but decided to leave it rather than make accusations.

Yesterday I logged into my email and noticed an email from my catalogue, thanking me for my order. I haven't ordered anything. I phoned them up and cancelled the order immediately (£138). Again the order was to be delivered to my home address. They put me through to the fraud team and we have added additional security measures to my account, and changed the password and security question, however, with this account, not only do you need my login details, but you also need my postcode, so it seems to point to someone that knows me/where I live.

The other thing I have noticed, is that any site that has been compromised seems to be ones that had (all have now been changed) the original password. My paypal for example had a different password, and has not been compromised, neither has my online banking (as far as I am aware). I have informed the bank, paypal, catalogue and even the police about these happenings. Unfortunately for me though, the police have told me that no law has been broken, therefore they will not act on this. My catalogue say it is too costly and not in their best interests to try to pinpoint the IP address, which would give me a definite idea of who this person may be.

As far as I am aware, my computer itself has not been compromised, I have run as many checks as I can and everything seems to be in order. In your opinion, could you advise as to whether you suggest my computer has in fact been compromised, or as the police and fraud departments suggest, a prankster has got hold of my password details and is merely trying to make life a little difficult?

Sorry for the long post btw.

Kazipoo

pcombo wrote: »

Then change your passwords then ;p

Gee thanks for that, if you read the whole post you would see that I have already done that!

aliEnRIK

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the COMPLETE log here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

fiddiwebb

So no access to your bank/cc cards then just the info in your email account.

Kazipoo

fiddiwebb wrote: »

So no access to your bank/cc cards then just the info in your email account.

Yes just email account, catalogue, another website, all using same password.... I am really convinced it is an estranged family member, messing around, trying to wreak havoc if you know what I mean, but obviously I want to rule every possibility out before I can safely say it is someone who has got hold of my password.

Kazipoo

aliEnRIK wrote: »

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the COMPLETE log here AFTER youve deleted everything it finds


reboot

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

Thanks for that, spent the last hour odd doing the scan, and here are the results:

Malwarebytes' Anti-Malware 1.44
Database version: 3644
Windows 6.0.6000
Internet Explorer 7.0.6000.16982
27/01/2010 13:15:04
mbam-log-2010-01-27 (13-15-04).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 288774
Time elapsed: 1 hour(s), 33 minute(s), 10 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)

Kazipoo

Did the other one you suggested too, but it won't allow me to create a log file, so I don't know how to copy it over to here!?!

aliEnRIK

when you REMOVE selected it will automatically open the logfile

Kazipoo

Am I trying to remove something? Do you want me to select everything, there's loads of stuff in a list!

aliEnRIK

Remove the lot then post the results

Kazipoo

Will it mess up the computer? It says not to remove anything unless you know what you are doing.