Gmail Hacked

The_Grandmaster

tronator wrote: »

I always forget that you Windows guys have all these problems with malware and trojans

A typical apple user comment! You get trojans etcetera too!

tronator

The_Grandmaster wrote: »

A typical apple user comment! You get trojans etcetera too!

That's an insult I don't have a single device from Apple

The_Grandmaster

tronator wrote: »

That's an insult I don't have a single device from Apple

Ooh sorry! At least you have some sense not to use apple!
Linux user then?

tronator

The_Grandmaster wrote: »

Ooh sorry! At least you have some sense not to use apple!

Thanks

The_Grandmaster wrote: »

Linux user then?

Yes, for 2.5 years completely. Never looked back...

Got even my GF to use Ubuntu and she has no problem with it. She only uses Windows for one specific program which doesn't run with Wine and the laptop has too little memory for a VM.

ljonski

i have downloaded malwarebytes and done a scan as advised as a precautionary measure. I think i am ok but could so check thanks Lj
Do i still need to download Hijack this ?

Malwarebytes' Anti-Malware 1.46
https://www.malwarebytes.org

Database version: 4159

Windows 5.1.2600 Service Pack 3
Internet Explorer

01/06/2010 07:17:33
mbam-log-2010-06-01 (07-17-33).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 209742
Time elapsed: 2 hour(s), 18 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\John Stewart\Desktop\Setup(2).exe (Adware.Seekmo) -> Quarantined and deleted successfully.

aliEnRIK

ljonski wrote: »

i have downloaded malwarebytes and done a scan as advised as a precautionary measure. I think i am ok but could so check thanks Lj
Do i still need to download Hijack this ?

What makes you think your now ok?

Id advise a hijack log personally

aliEnRIK

may I just ask why your under a different username now?

aliEnRIK

I cant see anything nastyin the log.
You should uninstall ZONEALARM SPYBLOCKER (Which is the ASK toolbar in disguise) - NOT to be confused with zonealarm firewall
id also recommend uninstalling ADAWARE. Its absolutely useless

And AVG 8 is out of date. Though I suggest not touching that until we believe its clean

Assuming you have something along the lines of a keylogger on, then (Hopefully combofix will show it up

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out
If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

ljonski

i have no reason to believe that pc is comprimised-just after reading ops thread - i am bit paranoid ! thx

The_Grandmaster

Sorry not sure which way to read your sentence - are you in the belief that your computer is safe or not? If it's the first I would disagree as infections have been found and would run combofix.