Help with hacked account(more of a hacked email address)

Lets start at the begining a few months ago i changed my facebook password after a friend of mine saw me type it in and decided it would be fun to log in as me. Thats were things go wrong.

Unfortunatly for me i had created this profile about 4 years ago? using a very old email address which i do not use anymore. I recently change my primary to a new email account.

A few months ago my status was updated and my password was changed, after asking various of my friends they confirmed that they did not do it( yes, i do trust them and they seemed as shocked) as a result i reset my password once again. All smooth sailing until a month ago. My sister informed me that my name had been changed one morning, after reseting my password once more, i noticed that my primary email was now changed to my old email account!!!

I went to this account, which i expected to be full of spam, to find 26 messages and all my password request links were read. I then looked at the login history i noticed that the last few logins were done from the US!!! (Im in South Africa)!!! I then closed the email account.

Took the nessasery steps to block my profile and I am now in this situation and a summary:
- My old email account was hacked into
-The hacked followed my password reset links into my profile and had fun (my url is : facebook.com\hahahahahaa)
-I closed this old email account down immediatly
-The primary email is the old account
-I have created another account using my previous primary email
-I set my security question 4 years ago!!! therefore, cant remeber the answer!
-When prompted to select 3 friends i get the "You have reset your pw too often.Come back later" screen
-My cellphone number has changed!! so the confirmation code does not come through
-With regards to antivirus programms, I am running AVG '11 it is upto date and i did a complete virus scan the moment this incident occured with no infections, tracking cookies, trojans, worms...
- I am pretty sure it was all as the result of the hacked email address, because i browse facebook via https

Thank you for taking the time read this,
Hope to receive feedback soon.

day 2: no replies?

yeshaav wrote:day 2: no replies?

You may wait for even longer to get a reply if no one who reads the problem want to get involved!!

Try these two scans

Taken from Superantispyware web site
Compatibility
‘SUPERAntiSpyware.com software is compatible with 2000, XP Home/Professional, 2003, Server 2008, Vista and Windows 7.

SUPERAntiSpyware is provided as a native 32-bit application and a native 64-bit application. The installer will install the proper version for your operating system.

We offer an older version 4.24 that works with Windows 98, 98SE, and ME.’



Disclaimer ;Run at your own risk

Next run Superantisypware (SAS):

Download and scan with [You must be registered and logged in to see this link.] Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates".
  
  
  NB; this program should be run while off-line so once updated please go off- line to run the scan
  
  
  
• In the Main Menu, click the Preferences... button.
  
• Click the Scanning Control tab.
  
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
    
  • Scan for tracking cookies.
    
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
  
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  
• On the left, make sure you check C:\Fixed Drive.
  
• On the right, under "Complete Scan", choose Perform Complete Scan.
  
• Click "Next" to start the scan. Please be patient while it scans your computer.
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes".
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

Run correctly this scan may take up to 8 or more hours to run so be patient

.

Taken from Malwarebytes web site
‘Support for Windows 2000, XP, Vista, and 7 (32-bit and 64-bit)’.

Disclaimer; Run at your own risk

Please download [You must be registered and logged in to see this link.] and save it to your desktop.

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes , they may interfere or alert you.

• Make sure you are connected to the Internet to be able to install and update the program
  
  (NB once the program has updated please disconnect from the Internet and run the scan while off- line )
  
  
  
• Double-click on mbam-setup.exe to install the application.
  
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

thank u!!! lol u guys are part of the facebook team? cool il download and scan, im pretty sure theres nothing but u must know more than me ^^

SUPERAntiSpyware Scan Log
[You must be registered and logged in to see this link.]

Generated 06/23/2011 at 09:21 PM

Application Version : 4.54.1000

Core Rules Database Version : 7315
Trace Rules Database Version: 5127

Scan type : Complete Scan
Total Scan Time : 01:00:19

Memory items scanned : 768
Memory threats detected : 0
Registry items scanned : 11770
Registry threats detected : 0
File items scanned : 35538
File threats detected : 20

Adware.Tracking Cookie
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@imrworldwide[2].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@microsoftsto.112.2o7[1].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@content.yieldmanager[3].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@atwola[1].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@atdmt[2].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@at.atwola[2].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@content.yieldmanager[2].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@msnportal.112.2o7[1].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@doubleclick[1].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@advertising[2].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@ad.yieldmanager[1].txt
C:\Users\Yeshaav\AppData\Roaming\Microsoft\Windows\Cookies\yeshaav@tacoda.at.atwola[2].txt
ia.media-imdb.com [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]
media.ign.com [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]
media.mtvnservices.com [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]
media.socialvibe.com [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]
secure-us.imrworldwide.com [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]
[You must be registered and logged in to see this link.] [ C:\Users\Yeshaav\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\GVP00001 ]

Trojan.Agent/Gen-Dropper
C:\USERS\YESHAAV\UNI\2ND YEAR\INF\INF 272 VB\SEM 1\PRAC10 ARRAYLISTS\10\CHALLENGE2\BIN\DEBUG\CHALLENGE2.EXE
C:\USERS\YESHAAV\UNI\2ND YEAR\INF\INF 272 VB\SEM 1\PRAC10 ARRAYLISTS\10\CHALLENGE2\OBJ\DEBUG\CHALLENGE2.EXE

Malwarebytes' Anti-Malware 1.50.1.1100
[You must be registered and logged in to see this link.]

Database version: 6930

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

2011/06/23 09:46:41 PM
mbam-log-2011-06-23 (21-46-41).txt

Scan type: Quick scan
Objects scanned: 173655
Time elapsed: 3 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

What did you edit out of the Report? I hope not any line of it?

Do you use some P2P programs on there ?

If you use anything that is not legitimate then your computer security will be compromised and guaranteed to get infected , plus you will be running a computer that may be bypassing corrrect routes to obtain materials...

no just that one url was kinda awkard so i just censored it
no i dont use p2p programs
My windows is updated! and i have almost nothing on this computer except for games and work! strange that it picked up my programming assignment as a trojan :?
Whats the next step from here

I dont use IE is use firefox, thats why i dont have IE 9

yeshaav wrote:no just that one url was kinda awkard so i just censored it
no i dont use p2p programs
My windows is updated! and i have almost nothing on this computer except for games and work! strange that it picked up my programming assignment as a trojan :?
Whats the next step from here

My research on your problem leaves me to ask you.... Because of the risks involved, before we go any further with your Facebook problem I am asking you to get the computer checked out on a specialist forum where more in-depth scans can be run to determine if the computer is or is not at risk .

We need to determine if any programs on there are riskey or not and the only way to do that is on a specialist computer forum

With respect; as a Moderator on here, I am not prepared to allow any Facebook help for you on this forum unless and until we know that the computer has only legitimate programs on there

To that end I hope you will accept my invitation to seek computer hep on a forum that I will link you to via a PM I will send you

Unfortunately I am not prepared to continue help or to allow anyone else on this forum to offer help unless this request is complied with

Please let me know in your next reply

Thanks

okay how do i show you that i have legitimate programms on my computer?
Should i post i complete list of all installed progammms? or print screen my installed files?
I how long is this process going to take :? i understand completly.

Pleas send me the link

yeshaav wrote:okay how do i show you that i have legitimate programms on my computer?
Should i post i complete list of all installed progammms? or print screen my installed files?
I how long is this process going to take :? i understand completly.

Pleas send me the link

I will PM you the links to specialist forums; they have specific scans they want run which you will see in their FAQ section; from those scans they can see what they need to to help you to see if you have problems ( which I think you do )..

That sounds fair to me. Please do send me this link
This process is alot more complicated that actually creating an account :<

FYI; it is noted that you have ( as requested) got help on another site for your computer problems; you need to follow those instructions to ensure your computer is thoroughly checked for infections; unfortunately until that task is competed we cannot help you with any Facebook problem as we need to know that that machine is as clean as it can be

This process is alot more complicated that actually creating an account

If you follow exactly all instructions given to you the process is actually normally very easy!!

As the Help on the other forum is now complete this is moved back to the Main Section


for you to tell, us if you have now managed to log into Facebook ?

Awesome now that that's done, what next?

my internet has been acting up, Here the facebook situation:
I try to long in and it says my account has been temp suspended etc. etc. Continue....
It only gives me the option of verification by mobile phone.
The number displayed appears correct but i dont receive any confirmation code.
I think the + is missing from the number extension.

So thats deadend no.1

Then i tried to reset my password....
same story as above...
No longer have access to these >> enter new address >>> I dont remember the security question answer >>> Recover account through friends >>> You seem to be requesting password resets far too often.
Come back later.

Thats the situation

I am going to go for a very ,very, 'long- shot' here

just on the chance this may work for you

[You must be registered and logged in to see this link.]

I put down details off the new account i created, will this be a prob? (email address)
And under trademark is this my old account name? should i close the new one?

OK; you currently have two difference Facebook accounts ? Yes? You have had one of them completley messed up courtesy of a juvenile prank that has seriously backfired for you ? Yes?

Unfortunately the https you browse with was useless as an individual accessed the system while you were in it ?

I was going to suggest you shut down completley the stupidly compromised Facebook account and try to start afresh ?

I created a new one recently so i could report my old one.
It wasnt a prank it was a very sad person who some how hacked an old old email account
I would LOVE if you close my old account !!! I think Im just going to copy my friend list or is it possible for you to delete this and send a notification via my status of this?

[quote="yeshaav"]I created a new one recently so i could report my old one.[quote]

Have you done so?

I would LOVE if you close my old account !!!

sorry but this Forum does not have the ability to close Facebook accounts

I think Im just going to copy my friend list

you may wish to do that

or is it possible for you to delete this and send a notification via my status of this?

This forum does not have that ability

I suggest you report the now wrong Facebook account and 'start afresh '...

I reported it but its still there, i've been inviting ppl again all week. Thanks for all the help

yeshaav wrote:I reported it but its still there, i've been inviting ppl again all week. Thanks for all the help

Dare one ask if this Report has now been acted on or....