Hacked account, FB & hotmail password changed again...

Hi guys and gals, i'm having some serious issues with my Dad's FB account...

Firstly his password was changed, so spyware and virus scanned his PC and eventually got it back - all's ok for 2 days, then the same again. So i completely formatted it, installed a fresh copy of XP along with AVG etc etc, but 2 days later the same thing again...

Now am i completely pi**ed off with this happening. Whats the most likely cause of this happening? A PC virus? Virus attached to FB maybe? Any ideas please?

HELP!!!!

Thanks Chris..

I note you say this has been reformatted etc but please tell us all of the Protection on the computer so we can eliminate a clash of programs !!

Is the XP licence key his own or ..what?

Are you doing any P2P stuff on it? ( Lime Wire etc)

Thanks for quick reply!

I installed AVG Free (which i have been using on my PC for years now with no issues) and Windows defender, which i later un-installed as they clashed.

The pc had only been running for a day when this last password change happened. He didn't save the last password in Google Chrome either just incase a Trojan etc was getting from there.

There's no p2p stuff at all, basically its a FB/eBay/email PC has thats about the limit of his capabilities!!

Firstly; is the Computer fully updated with SP3 from Windows Microsoft site?

Let's throw these two programs at it

Taken from Malwarebytes web site
‘Support for Windows 2000, XP, Vista, and 7 (32-bit and 64-bit)’.

Disclaimer; Run at your own risk

Please download [You must be registered and logged in to see this link.] and save it to your desktop.

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes , they may interfere or alert you.

• Make sure you are connected to the Internet to be able to install and update the program
  
  (MB once the program has updated please disconnect from the Internet and run the scan while off- line )
  
  
  
• Double-click on mbam-setup.exe to install the application.
  
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  
  
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

then

Taken from Superantispyware web site
Compatibility
‘SUPERAntiSpyware.com software is compatible with 2000, XP Home/Professional, 2003, Server 2008, Vista and Windows 7.

SUPERAntiSpyware is provided as a native 32-bit application and a native 64-bit application. The installer will install the proper version for your operating system.

We offer an older version 4.24 that works with Windows 98, 98SE, and ME.’



Disclaimer ;Run at your own risk

Next run Superantisypware (SAS):

Download and scan with [You must be registered and logged in to see this link.] Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
  
• An icon will be created on your desktop. Double-click that icon to launch the program.
  
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates".
  
  
  NB; this program should be run while off line so once updated please go off line to run the scan
  
  
  
• In the Main Menu, click the Preferences... button.
  
• Click the Scanning Control tab.
  
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
    
  • Scan for tracking cookies.
    
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
  
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  
• On the left, make sure you check C:\Fixed Drive.
  
• On the right, under "Complete Scan", choose Perform Complete Scan.
  
• Click "Next" to start the scan. Please be patient while it scans your computer.
  
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  
• Make sure everything has a checkmark next to it and click "Next".
  
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  
• If asked if you want to reboot, click "Yes".
  
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
    
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

Run correctly this scan may take up to 8 or more hours to run so be patient

.


Try that and let us see how they go for you !!

Thanks again...it is running SP3 too.

I will try those 2 when i'm next over at his house, and report back - although i've just been googling at read about the koobface virus - could that be the problem?

Thanks again...

mazz wrote:Thanks again...it is running SP3 too.

I will try those 2 when i'm next over at his house, and report back - although i've just been googling at read about the koobface virus - could that be the problem?

Thanks again...

I hope not!!
Once the scans have been run that should give us a better idea of what may or may not be happening !!

Ok, fanks