Hack Forums
[Infected] Think I might be ratted/keylogged (Need some assistance) - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Think I might be ratted/keylogged (Need some assistance) (/showthread.php?tid=5472690)

Pages: Pages 1 2


Think I might be ratted/keylogged (Need some assistance) - smartwhip - Nov 23, 2016

I keep getting login attempts on my gmail, my skype was also hacked. A little paranoid right now about the whole situation so could do with some help.


* - SIM-2502833 - Nov 23, 2016

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.





* - Shaq - Nov 23, 2016

Before you fix anything you need a foundation to rebuild on. Here's what I'd recommend:
  1. Tell your bank to watch out if something weird hits your account.

  2. Go on your phone and make a new email. Do not link this to any other email. For recovery, you can put your real phone number. This email only has one use: LastPass.

  3. Purchase LastPass Premium (it's like $13/year, way worth it) and use your new email when signing up. Do NOT use lastpass to store that email's password.

  4. Download the LastPass app on your phone and login.

  5. Enable LastPass Authenticator (2-factor auth, like Google Authenticator) You may be able to use Google Authenticator with this as well.

  6. Enable LastPass Credit Monitoring (there should be a help article on this). This will help if whoever hacked your stuff got your SSN.

  7. As you secure your accounts, use LastPass to generate and store their logins. This way each one has a separate password.

  8. Store your security questions/random answers in a LastPass Secure Note. I use dinopass.com to generate random answers.





* - SIM-2502833 - Nov 23, 2016

(Nov 23, 2016 11:31 AM)NTFS Wrote:  Before you fix anything you need a foundation to rebuild on. Here's what I'd recommend:
  1. Tell your bank to watch out if something weird hits your account.

  2. Go on your phone and make a new email. Do not link this to any other email. For recovery, you can put your real phone number. This email only has one use: LastPass.

  3. Purchase LastPass Premium (it's like $13/year, way worth it) and use your new email when signing up. Do NOT use lastpass to store that email's password.

  4. Download the LastPass app on your phone and login.

  5. Enable LastPass Authenticator (2-factor auth, like Google Authenticator) You may be able to use Google Authenticator with this as well.

  6. Enable LastPass Credit Monitoring (there should be a help article on this). This will help if whoever hacked your stuff got your SSN.

  7. As you secure your accounts, use LastPass to generate and store their logins. This way each one has a separate password.

  8. Store your security questions/random answers in a LastPass Secure Note. I use dinopass.com to generate random answers.



I feel like this is largelty unnecessary, using 2 facto authorization (I prefer lastpass 2 facto auth) and having the app on your phone is more than enough.
Been using lastpass for years
http://prntscr.com/dax7om


* - GruntStyl - Nov 23, 2016

What scans have you run, if any? And was anything detected. I would continue following MrMcShroom instructions and go from there.


* - Shaq - Nov 23, 2016

(Nov 23, 2016 11:34 AM)MrMcShroom Wrote:  I feel like this is largelty unnecessary, using 2 facto authorization (I prefer lastpass 2 facto auth) and having the app on your phone is more than enough.
Been using lastpass for years
http://prntscr.com/dax7om

Which part is unnecessary? In order to have the app on your phone you need premium..


* - ka$h - Nov 23, 2016

Skype got hacked, what do you mean by that?


* - smartwhip - Nov 23, 2016

(Nov 23, 2016 11:24 AM)MrMcShroom Wrote:  Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

  • Press Scan button.

  • It will produce logs called FRST.txt and Addition.txt in the same directory the tool is run from.

  • Please copy and paste the logs back here.



frst - http://pastebin.com/tDHTykCL

addition - http://pastebin.com/JKF4ummR


* - ankok81 - Nov 23, 2016

If your Skype was hacked, and you are getting third party attempts on your Gmail, there is no further question whether you are hacked. Now, you need to find your recovery media [if it is not built in], and factory reset, or manually format ALL drives. This is the only way to assure you are no longer compromised. If you state your OS, I can direct you to the appropriate information to assist you with this process.


* - GruntStyl - Nov 23, 2016

I'm assuming if he's coming here he is wanting to avoid a factory reload. Of course that would ensure he would be clean for the most part. However if he's being ratted/keylogged it shouldn't be to hard to remove the infection.


* - smartwhip - Dec 14, 2016

100% am infected with a keylogger or rat, change my password pretty much twice a week and somehow someone is getting access to my accounts, Need help asap


* - ka$h - Dec 14, 2016

(Dec 14, 2016 02:00 PM)North Face Wrote:  100% am infected with a keylogger or rat, change my password pretty much twice a week and somehow someone is getting access to my accounts, Need help asap


Do you know what keylogger you installed and/or what file you installed it from?


* - smartwhip - Dec 14, 2016

(Dec 14, 2016 02:02 PM)Ka$h Wrote:  Do you know what keylogger you installed and/or what file you installed it from?

I dont have a clue, been getting sign in attempts for awhile now but I 100% know something is on my computer


* - ka$h - Dec 14, 2016

(Dec 14, 2016 02:08 PM)North Face Wrote:  I dont have a clue, been getting sign in attempts for awhile now but I 100% know something is on my computer

What have you done up to now just so we know


* - smartwhip - Dec 14, 2016

(Dec 14, 2016 02:16 PM)Ka$h Wrote:  What have you done up to now just so we know

ran a malware bytes scan, nothing found , that is all