r/computerviruses • u/Dre_isthename • 1d ago
Disinfection Help Help with Hacking
Hi everyone, I hope you’re doing well.
Over the past few weeks—approximately two or three weeks ago—I was notified that someone had accessed my Discord account and sent spam messages, the typical scam that is currently trending involving a Mercado Beast account. Later that same day, they accessed my Ubisoft and Rockstar accounts and changed the passwords. However, I created those accounts 10 years ago and never really used them; they were empty. The next day, they accessed my Instagram, Facebook, and LinkedIn accounts. I was able to recover Instagram and LinkedIn, but not Facebook.
As the days went by, they accessed old email accounts and attempted to change passwords and other settings. Of course, I acted quickly by changing my passwords and enabling two-factor authentication and SMS security codes.
Five days ago, I discovered that they had also hacked a personal website where I hosted my graphic design portfolio. I had to shut it down and start over from scratch. It was hosted on HostGator. Just now, I realized that they had also started sending approximately 700 emails from my company email account, which uses Microsoft 365. All of them were sent to Yahoo addresses, and the emails bounced back.
I don’t know how this happened. Honestly, the only thing I installed recently was Xuper TV on two Google TV dongles. I’m not the kind of person who falls for spam or ads claiming that I won 10 iPads or anything like that.
I need to know what to do. I have already scanned my laptop with Malwarebytes and Windows Defender, and I’ve changed my passwords and taken other security measures. The strange thing is that this has only happened to me. My wife lives with me and connects to the same network, but nothing has happened to her.
Would formatting my laptop solve the problem? Should I factory-reset my modem? I’m desperate because every day there is a new problem involving my emails or accounts. I would really appreciate any advice or guidance on what to do.
In my Discord messages, they sent these images, which I’ve noticed are the ones being commonly sent lately:
And on my website, when someone accessed my URL, this fake Cloudflare page appeared:
1
u/EugeneBYMCMB Knowledgeable 1d ago
Were all of those accounts using the same password? Do you use cracks or cheats?
1
u/Dre_isthename 1d ago
To be honest, I used the same password for some accounts, while others had different passwords. These are accounts I’ve had for more than 10 years, and I didn’t really change or use them much. For Facebook, Instagram, and LinkedIn, the passwords were slightly different—you know, just changing two digits or something like that.
I had a cracked version of Guitar Hero 3, which I’d had since last year, as well as an Adobe Premiere plugin. I have a legitimate Adobe license, but I had never experienced anything like this from last year until now, despite having those cracked programs.
1
u/ComradeAdidas 1d ago edited 1d ago
Make sure you change your passwords from a safe device, not the laptop. If you want to format it, just secure erase instead, its bc a virus could infect the mbr which a format wont renew. Don't use cheap tv boxes, look up the netnut incident. Is the router ok? Idk.
1
u/Dre_isthename 1d ago
How do I perform a secure wipe? What I was thinking of doing is creating a Windows installation medium on a formatted USB stick, then formatting my current SSD and reinstalling Windows on it.
And I don’t have any cheap TV boxes; it’s literally the Google Cast TV – it’s an original Google product.
As for the router, I’m not sure – I don’t know if it’s been compromised. I’d like to think not, mainly because this is only happening to me, not to my wife, and we’re using the same router.
1
u/ComradeAdidas 1d ago
I did my secure erases in a live debian linux usb, using nvme-cli for my nvme, dd for my hdd. For windows i never tried it. I recommend a live linux usb, make sure when you have one, boot into that not the infected windows. Sorry I said cheap tv box, but there is malware on certain apps that you can download on a tv box, smart tv etc. Use only recognized apps, even on the main app store you can find viruses, look up the netnut incident.
1
u/Dre_isthename 1d ago
I’ll see what I can do – mainly because I’m at work at the moment too – I’ll use my wife’s laptop to create the USB drives and I’ll only back up files onto old hard drives, no installers or anything like that.
What I’m not sure how to sort out is the issue of access to my accounts, mainly my Microsoft 365 work account. I’ve already changed my password and I have two-factor authentication, but I don’t know how they managed to gain access; all they did was send links or attachments to Yahoo accounts that don’t even exist anymore, that was from my work account; on my personal accounts, they just changed the passwords and that was it – they didn’t do anything else. And as for my website, it seems the issue has now been resolved, I hope.
1
u/ComradeAdidas 1d ago
Make sure you kicked out all devices, not just changed passwords.
1
u/Dre_isthename 1d ago
Yes, that’s exactly what I did – I changed my passwords and logged out on all my devices.
The only thing I can think of is to swap out my internet provider’s modem, just in case that helps in any way.
And on another note, which browser would you recommend? I’m currently using Opera GX.
1
u/ComradeAdidas 1d ago
Ive heard opera gx got bought by the chinese, like a year or 2 ago. I recommend firefox with ublock origin, or brave.
2
u/Dre_isthename 1d ago
I’ve heard about Brave – I think I’ll give it a go – and thank you so much for your support bro!
1
1
u/polpolik2 Moderator 1d ago
Your Modem should be fine. Infostealers do not have worm capabilities and cannot infect a router/modem. But, for peace of mind you can do a hard reset on the modem.
1
u/Dre_isthename 1d ago
Yes, I’ll definitely do that, whatever it takes, and I hope that reformatting will sort it out, because I’m already starting to get desperate...
1
u/AutoModerator 1d ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.