My FB account got hacked & The Hacker changed the email address attached

Hey Guys! I manage some fanclub & for that purpose I made FB account plus Fan-Page!.
(https://www.facebook.com/SonamAKapoorFC) my FB account & (https://www.facebook.com/SonamKFanClub) page.

on May.1.2011 I got this message on my FC FB account saying that:

" Police Central May 1 at 8:35am Report
Dear : Sonam K Fanclub
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

Our system has received the reports from the other users about the misuse of your account and that may cause your account will be deactivated.
The user gets this warning because misusing one of our features.

The reason for this is not limited to:
1. Upload photos or images that violate the conditions of use facebook.
2. Identity fraud on your account.
3. Your use excessive application.
4. Copyright infringement.
5. You write content that is not fun (ROUGH).
6. perform actions that interfere with another user and you have been reported by other users.


But if you promise not to do the things that violate the requirements for the second time, our team still give you the
policy.
To confirm your account, please visit:


[You must be registered and logged in to see this link.]


If within 24 hours after you receive this information from us and you do not confirm, your account is automatically deactivated permanently.

Thank you for helping improve our service.


Best regards, Facebook ™ Security
Facebook © 2011 Copyright network Inc."

After filling that form I realized that my account of Facebook and Live [sonamkapoor2008@live.com] can get hacked. I immediately changed my Facebook password and Live account's password as well, But it was too late by the time. The hacker changed the email account which was associated with my Facebook. & I never got any message from Facebook Team with titled ""Facebook Contact Email Change Notification."" I even checked my junk mail folder properly. May be hacker deleted it from my Live [sonamkapoor2008@live.com] account before i could read it, But fortunately I recovered and still have access to my Live [sonamkapoor2008@live.com] account.

Secondly hacker made new account with my same Live email address, same display picture and name. My bad i got the notification from Facebook regarding that & I verified it by mistake.

when i logged onto that new Facebook account i found that i have one friend: [You must be registered and logged in to see this link.] and coincidentally he is friends with my original Facebook account I think he is the hacker. I them immediately detractive that account. As i filled some form from FB people for the recovery of my original account. They said DONT MAKE NEW ID USING YOUR ID WHICH GOT HACKED.

All I done is to fill a form with FB Team and Reported my original account.. please guys help!! me .. I am very upset... its my hard work of 3 years :-((

Can you please tell us to start with ,what, if anything, is the Protection on the one privately- owned -and- only -used- by- you computer to access Facebook ?

Sorry!! i did not get you? its like my account got hacked and I want some helpppp.

hshah wrote:Sorry!! i did not get you? its like my account got hacked and I want some helpppp.

I appreciate that it is a Facebook account that got hacked but it is of use to know what, if anything, is the Protection on the one computer you use to access Facebook...hense the question...

Continue:

[You must be registered and logged in to see this link.]

Sorry!! I could not reply as I never had internet connection all these days. :-((


"Ruby wrote
I appreciate that it is a Facebook account that got hacked but it is of use to know what, if anything, is the Protection on the one computer you use to access Facebook...hense the question..."

Avira Anti Viir is installed on my computer from which I used to access my FB which got hacked :-(( I need it back badly... Please Help!!

Please run these two scans on the affected computer

Taken from Malwarebytes web site
‘Support for Windows 2000, XP, Vista, and 7 (32-bit and 64-bit)’.

Disclaimer; Run at your own risk

Please download [You must be registered and logged in to see this link.] and save it to your desktop.

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes , they may interfere or alert you.

• Make sure you are connected to the Internet to be able to install and update the program
  
  (NB once the program has updated please disconnect from the Internet and run the scan while off- line )
  
  
  
• Double-click on mbam-setup.exe to install the application.
  
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Taken from Superantispyware web site
Compatibility
‘SUPERAntiSpyware.com software is compatible with 2000, XP Home/Professional, 2003, Server 2008, Vista and Windows 7.

SUPERAntiSpyware is provided as a native 32-bit application and a native 64-bit application. The installer will install the proper version for your operating system.

We offer an older version 4.24 that works with Windows 98, 98SE, and ME.’



Disclaimer ;Run at your own risk

Next run Superantisypware (SAS):

Download and scan with [You must be registered and logged in to see this link.] Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates".
  
  
  NB; this program should be run while off-line so once updated please go off- line to run the scan
  
  
  
• In the Main Menu, click the Preferences... button.
  
• Click the Scanning Control tab.
  
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
    
  • Scan for tracking cookies.
    
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
  
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  
• On the left, make sure you check C:\Fixed Drive.
  
• On the right, under "Complete Scan", choose Perform Complete Scan.
  
• Click "Next" to start the scan. Please be patient while it scans your computer.
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes".
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

Run correctly this scan may take up to 8 or more hours to run so be patient

.

Log from first scan:


File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Sunny_Afternoons.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2699136) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Sunny_Afternoons.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2699136) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Sunny_Afternoons.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2699136) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Shumann_Scenes_From_Childhood.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2597760) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Shumann_Scenes_From_Childhood.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2597760) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Shumann_Scenes_From_Childhood.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2597760) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Pachelbel_Canon_in_D.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2979072) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Pachelbel_Canon_in_D.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2979072) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Pachelbel_Canon_in_D.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2979072) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Need_For_Speed.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2700288) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Need_For_Speed.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2700288) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Need_For_Speed.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2700288) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Mozart_Sonata_in_C_Major.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2468736) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Mozart_Sonata_in_C_Major.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2468736) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Mozart_Sonata_in_C_Major.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2468736) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Light_Jazz.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2794752) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Light_Jazz.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2794752) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Light_Jazz.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2794752) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Joplin_Maple_Leaf_Rag.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2386944) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Joplin_Maple_Leaf_Rag.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2386944) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Joplin_Maple_Leaf_Rag.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2386944) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Hawaiian_Saunter.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2699136) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Hawaiian_Saunter.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2699136) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Hawaiian_Saunter.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2699136) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Deck_the_Halls.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2700288) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Deck_the_Halls.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2700288) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Deck_the_Halls.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2700288) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Big_Band_Bash.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2700288) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Big_Band_Bash.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2700288) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Big_Band_Bash.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2700288) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Bach_Two_Part_Invention_in_C_Major.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2732544) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Bach_Two_Part_Invention_in_C_Major.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2732544) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Bach_Two_Part_Invention_in_C_Major.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2732544) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Ancient_Beijing.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2699136) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Ancient_Beijing.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2699136) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\Ancient_Beijing.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2699136) - Low Volume

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\A_Taste_Of_Sicily.mp3
Tag Category : Music
(Start Frame no., End Frame no) (0, 2700288) - No Music

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\A_Taste_Of_Sicily.mp3
Tag Category : Dialog
(Start Frame no., End Frame no) (0, 2700288) - No Dialog

File Name : C:\ProgramData\Adobe\Elements Organizer\8.0\Music\A_Taste_Of_Sicily.mp3
Tag Category : Volume
(Start Frame no., End Frame no) (0, 2700288) - Low Volume

log from second scan:



SUPERAntiSpyware Scan Log
[You must be registered and logged in to see this link.]

Generated 05/18/2011 at 05:51 AM

Application Version : 4.52.1000

Core Rules Database Version : 7075
Trace Rules Database Version: 4887

Scan type : Complete Scan
Total Scan Time : 05:35:17

Memory items scanned : 751
Memory threats detected : 0
Registry items scanned : 15792
Registry threats detected : 24
File items scanned : 135403
File threats detected : 46

Adware.HBHelper
(x86) HKLM\Software\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\InprocServer32#ThreadingModel
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\ProgID
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\TypeLib
(x86) HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}\VersionIndependentProgID
(x86) HKCR\URLSearchHook.ToolbarURLSearchHook.1
(x86) HKCR\URLSearchHook.ToolbarURLSearchHook.1\CLSID
(x86) HKCR\URLSearchHook.ToolbarURLSearchHook
(x86) HKCR\URLSearchHook.ToolbarURLSearchHook\CLSID
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\0
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\0\win32
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\FLAGS
(x86) HKCR\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}\1.0\HELPDIR
C:\PROGRAM FILES (X86)\HYPERCAM TOOLBAR\TBHELPER.DLL
(x86) HKU\S-1-5-21-2553278828-234743043-1780000738-1003\Software\Microsoft\Internet Explorer\URLSearchHooks#{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(x86) HKU\S-1-5-21-2553278828-234743043-1780000738-1003_Classes\Software\Microsoft\Internet Explorer\URLSearchHooks#{CA3EB689-8F09-4026-AA10-B9534C691CE0}

Adware.Tracking Cookie
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@adtech[2].txt
C:\Users\Ali\AppData\Local\Temp\Low\Cookies\ali@atdmt[1].txt
cdn1.static.pornhub.phncdn.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
d8.zedo.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
ia.media-imdb.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
ictv-tf-ec.indieclicktv.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
media.bstdownload.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
media.mtvnservices.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
media.scanscout.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
secure-uk.imrworldwide.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
secure-us.imrworldwide.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
static.mediaworks.co.nz [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
timesofindia.indiatimes.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
trackin.affiliserve.com [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
[You must be registered and logged in to see this link.] [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
[You must be registered and logged in to see this link.] [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
[You must be registered and logged in to see this link.] [ C:\Users\Ali\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\JX9XVG4R ]
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@adform[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@adtech[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@doubleclick[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@msnportal.112.2o7[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@statcounter[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@statse.webtrendslive[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@track.adform[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\ali@yadro[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@ad.yieldmanager[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@ads.indiatimes[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@adserver.adreactor[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@apmebf[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@atdmt[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@chitika[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@content.yieldmanager[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@content.yieldmanager[3].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@doubleclick[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@doubleclick[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@epaper.timesofindia[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@fastclick[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@imrworldwide[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@legolas-media[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@netspiderads2.indiatimes[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@sonyglobalvaio.112.2o7[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@sonyglobalvaio.112.2o7[2].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@statcounter[1].txt
C:\Users\Ali\AppData\Roaming\Microsoft\Windows\Cookies\Low\ali@tribalfusion[2].txt
C:\Windows\Temp\Cookies\ali@statse.webtrendslive[2].txt

Browser Hijacker.Deskbar
(x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
(x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\ProxyStubClsid32
(x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib
(x86) HKCR\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}\TypeLib#Version

Can you please tell me how long this procedure will take? and should I keep my hopes hight? I mean will i get it back or they are still chances that I would not :-((

Where is the Report from the Malwarebytes scan ?

Ruby wrote:Where is the Report from the Malwarebytes scan ?

Sorryyy!! its here



Malwarebytes' Anti-Malware 1.50.1.1100
[You must be registered and logged in to see this link.]

Database version: 6599

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

5/18/2011 12:00:31 AM
mbam-log-2011-05-18 (00-00-31).txt

Scan type: Quick scan
Objects scanned: 165573
Time elapsed: 5 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Ali\AppData\Local\Temp\hfl3l7us.dat (Rootkit.MBR) -> Quarantined and deleted successfully.
c:\Users\Ali\downloads\extractimages.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

Moved from Hacked to Technology

From what I have seen I would be far happier for you to get the computer thoroughly checked out on a specialist forum where far deeper and more rigorous scans can be run as I believe you are infected ...

Please let me know if you are agreeable to this and if you know of a forum where you can get cleaned or if you wish me to recommend some forums for you ..

Yup!! kindly please let me know about those forums? but what about my facebook account? how can I get it back?

hshah wrote:Yup!! kindly please let me know about those forums? but what about my facebook account? how can I get it back?

Sorry but unless you can access a computer near you that only you use and that is not connected to the present one ? Then forget Facebook for the time being

The health ( or not) of the computer is paramount

I will send you some info on Forums where specialist help can be obtained

No report back as to if this has had help elsewhere or not so...to Prevent duplication etc

Locked

Sent to abandoned