I've been hacked!!! Help

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
Someone hacked into my yahoo account today and I've changed the password three times and all 3 times it was changed. This has happened on several of my fiance's and my websites over the past several days. Yahoo wants to just "forget" about it but is there some kind of program I need to be aware of that gets passwords for yahoo?

I don't know what to do. I keep changing the password but someone is changing it to something else. I can retrieve it by using the "forgot password feature"

 

Slogun

Platinum Member
Jul 4, 2001
2,587
0
0
Sounds strange that this has happened to several of your and your fiances websites.
Laws of probability are certainly against that.

Could be that either somebody is targeting you somehow or your fiance is playing games.
 

stndn

Golden Member
Mar 10, 2001
1,886
0
0
have you tried changing the password reminder question?
and also, try to make long password that's different from something else....
 

Turkey

Senior member
Jan 10, 2000
839
0
0
Run an anti-virus prog on your PC. You probably have a trojan horse that redirects all your web traffic to an external host before forwarding it to the site you want to visit.
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
Originally posted by: Slogun
Sounds strange that this has happened to several of your and your fiances websites.
Laws of probability are certainly against that.

Could be that either somebody is targeting you somehow or your fiance is playing games.

We actually had something similar happen awhile back and I tracked it down to a person at the Education department in the State of Conn. I contacted their Admin and from what I've heard the person was fired. We run a webforum for parents in their 20s and most of the women on our board are also members of other on Delphi so that was hearsay but ther particular person hasn't been online since the state department e-mailed me to say the situation was resolved. There was also an incident from 2 other of our members and their yahoo accounts yesterday with the same thing happening. One in partucular who lives in England and uses an English ISP. Whoever actually sent the English lady's mother several nasty e-mail from her account. She had to end up contacting her ISP and getting them to wipe out her e-mail and they have started their own investigation. I do believe this is the same person except from their home computer. I guess they just don't "get it" and how much trouble you can be in.

Turkey I do have a virus program and also a firewall so it's highly unlikely that there is a trojan horse on here not to mention the person is not comptuer savvy. The person was a member on our board and other Delphi board so this is how I tend to know a lot about them. All was well until not too long ago she started arguing with other members and I guess just started being nasty.
 

Cybordolphin

Platinum Member
Oct 25, 1999
2,813
0
0
Why not try creating a new password.... and not sharing that password with ANYONE not even your fiance.

Go get a free trial of Moosoft Cleaner. UPDATE FIRST, then run that on your computer. Also download a free copy of ADAWARE, and run that. These should clean up your system pretty well.

 

Dreadogg

Golden Member
Mar 1, 2001
1,780
0
76
delete yahoo form your pc and then reinstall it, they have password stealers for yahoo that will relay the password to a thrid party maybe this is it, also check the path of your icon!
 

percboy

Senior member
Apr 5, 2000
380
0
0
I`ve had all kinda strange things with yahoo mail., others peoples mail would show up in my account , who knows who was reading my mail, haven`t used them since.
 

MainFramed

Diamond Member
May 29, 2002
5,981
1
0
you'v been hacked...you using yahoo......
rolleye.gif
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
Originally posted by: Cybordolphin
Why not try creating a new password.... and not sharing that password with ANYONE not even your fiance.

Go get a free trial of Moosoft Cleaner. UPDATE FIRST, then run that on your computer. Also download a free copy of ADAWARE, and run that. These should clean up your system pretty well.


First off I don't have "Yahoo" installed on my PC. This is the yahoo mail site. It's only used for purchases I make online. Second I've had AdAware installed for months and run this almost daily. I don't think you people understand here. This happened 3 times yesterday. I change the password and within an hour it was changed again. I finally had Yahoo temporarily disable the account. I am behind a firewall but I understand nothing is perfect.
 

Cybordolphin

Platinum Member
Oct 25, 1999
2,813
0
0
Thanks for clarifying.

Now... did you give anyone else your password when you changed it?

Yahoo mail...... well..... my 4 year old son managed to get into their server database and retrieve a list of over 13,000 emails. All I saw quickly were titles with what appeared to be Al Queda. This is/was no joke. I closed down the browser immediately. I did not have my keystroke software installed at the time... so I could not duplicate his efforts. Not that I would have. Got my attention though.... and made me a tad leary of Yahoo mail. I would NEVER use Yahoo email with anything I needed to keep secure.

If you are not giving your password to anyone.... then yes... someone is looking over your shoulder. I would ask what exactly you use your computer for.... have you checked your hardware for keystroke duplicators? Are you on a wireless network or hardware? Do you live in an apartment or a single family home? Have you been a very good boy on the internet? Is Yahoo! on good terms with you?
Have you run a trojan software (like moosoft/cleaner)? Would you ever suspect your fiance of having your computer compromised INTENTIONALLY to follow your online activity (perhaps the investigator is stepping over the line, and has a thing for your fiance - weirder things have happened)? Have you contacted Yahoo? You DID mention that it is happening at several of your visited websites. Not sure what that means.

Anyway.... I would have lots of questions that you would not probably want to answer..... so I would suggest you take apart your keyboard and look for a keystroke logger, check out the back of your computer for a keystroke logger, and very importantly "scan for trojans". Adaware does not scan for trojans (well not all the nasty ones anyway). Even perhaps install a new hard drive and start over. Unless of course you spot either a keystroke logger, or find a trojan. Remember that Keystroke logger programs can be difficult to find. They can hide themselves VERY well.

Do let us know what you find.
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
This is actually happening to my fiance but I just didn't want to talk as the middle man in this situation and the only other person here is our son and he's 14 months so I doubt he's looking over my shoulder ;)

 

Slogun

Platinum Member
Jul 4, 2001
2,587
0
0
Cybordolphin, how would one recognize a keystroke logger if we saw one.

At work, we have a fingerprint recognition log-on device that is attached to our computers via both the parallel port and the keyboard port. I have wondered whether this device could have the capability of keystroke logging.
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
Ok I've run moosoft and it found nothing.

Look all I want to know is are there simple programs that can get passwords for yahoo accounts. No I don't want to use it I want to know how to stop it. We ended up closing the account that was being changed and we forwarded all the mail to an account we setup for her on yahoo. Well within that next hour we believe that person got into the new account as we couldn't log back in. We even wrote down the password when setting up the account. I've been doing this for awhile now but my no means am I an "expert" at a computer but I do know more than the average person. I know when someonething is up. Last night we learned that similar things have been happening since August of '01 thoughout different people on thier webforum community. Again this is a community for parents in their 20's.

The lady in England is sending me the e-mail that was sent to her mother with headers just for my investigation purposes. I am not taking this lightly. I do know that "I" convinced this is the same person who we reported to the State of Conn. Education Department and this is not a funny situation for me nor my fiance. I will prosecute once I get proof of who this is but at this point getting the proof is the problem.

Delphi contacted us back and said they couldn't so an IP investigation without a court order and you can't get a court order without reason or a previous investigation being conducted. I'm a bit miffed about this because we DO pay for the Delphi service and I really believe they have an obligation to at least help us out in this situation. Nothing has happened on our personal forum just because I think the person has at least enough sense to know that if they try this foolishness on my board I'd catch them red handed.

Anyway this is quite frustrating because all that e-mail that she sent to her new yahoo account is locked out and was important e-mail she wanted to keep. Now she did this before I got home from work and now have set her up mail on our domain so no more yahoo. I've been trying to get her to switch guys but she wanted to keep yahoo at the time because thats the addy everyone knew. Anyway enough ranting for now but I'm dead serious about this.
 

n0cmonkey

Elite Member
Jun 10, 2001
42,936
1
0
First drop yahoo!. The ip address of the client should be in the headers of the emails I believe. Report the abuse to his isp.
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
There is the problem. No e-mail has been sent from yahoo. The only e-mail that was sent from the lady in England and her mail isn't yahoo but through an english ISP I believe Asarian but she is sending that to me just so I can look at it and Asarian has also started their own investigation.
 

Dreadogg

Golden Member
Mar 1, 2001
1,780
0
76
At work, we have a fingerprint recognition log-on device that is attached to our computers via both the parallel port and the keyboard port. I have wondered whether this device could have the capability of keystroke logging.
There are both hardware and software keystroke loggers so its probally a good chanch that it is.
 

Cybordolphin

Platinum Member
Oct 25, 1999
2,813
0
0
Ok I've run moosoft and it found nothing.

Good. Did you UPDATE it before running it? Just checking.

Look all I want to know is are there simple programs that can get passwords for yahoo accounts. No I don't want to use it I want to know how to stop it. We ended up closing the account that was being changed and we forwarded all the mail to an account we setup for her on yahoo. Well within that next hour we believe that person got into the new account as we couldn't log back in. We even wrote down the password when setting up the account. I've been doing this for awhile now but my no means am I an "expert" at a computer but I do know more than the average person. I know when someonething is up. Last night we learned that similar things have been happening since August of '01 thoughout different people on thier webforum community. Again this is a community for parents in their 20's.

The password scanners would normally have to be run off your computer, or a computer that has hacked Yahoo! (the later is not likely). Yes you can get a password scanner. If someone has compromised your computer, it is possible for them to scan for all of your passwords. More likely they would have installed a keystroke logger, and then it is a very simple process of reading whatever you have typed on your computer (passwords, email, chat, websites visited, credit card information, personal information, etc.). Once again keystroke loggers are hard to detect (software type). The hardware type are easier to spot. Generally they will be attached at the back of the computer where the keyboard attaches to the back of the computer. Some hardware keystroke loggers are placed inside the keyboard itself. This would require taking apart the keyboard. If you suspect a Keyboard keystroke logger it might be better to just buy a new one (I like the $6-$12 Chicony - internet board), if you don't know what to look for. Keyboard keystroke loggers are getting smaller and smaller. But a hardware keystroke logger would have to be installed on your fiances system.... either while she was at work, or not home, or in bed asleep, etc..

I meant "looking over your shoulder" as a figure of speach..... not litterally. ;)

Have you tried opening up other free email accounts? Try opening up accounts at MAIL.com. See if you have the same type of problems. However....keep in mind that if you have a keystroke logger on your system... the person can read these correspondence if you are typing from the compromised computer. You may want to do your research from a different system. Otherwise they could lay low for awhile to throw you off. Further... you can try opening up other email accounts from a different computer, and see if you still experience the problems (from same location). I know you are going to get mad at me for saying this..... but most of the time errors like what you describe are user error with regard to CAPS on, faulty keyboards, bad memories, etc..... when entering passwords. I am not saying this is the case.... you may in fact have someone/something on your computer.

Also... are your passwords used for the email also being used for YAHOO chat identities? Are you using a webcam or voice communications while chatting? A Java dump can reveal IP's etc., to all those involved in voice communications logged into certain sites. This can allow someone to NUKE you, or force you off the net. You would know this were happening if you were suddenly disconnected from the net. Repeatedly. Again.... this is probably unlikely. It WOULD give the intruder enough information to begin a hack on you though.

You may want to try some other things. Like using a different computer from the same home.... and see if you experience the same problems. Once again.... do you live in an apartment or duplex? A naughty neighbor may be playing games with you... if they have tapped into your internet line. What type of internet service do you have? Dial up, Cable, DSL, wireless, networked?



The lady in England is sending me the e-mail that was sent to her mother with headers just for my investigation purposes. I am not taking this lightly. I do know that "I" convinced this is the same person who we reported to the State of Conn. Education Department and this is not a funny situation for me nor my fiance. I will prosecute once I get proof of who this is but at this point getting the proof is the problem.

Keep in mind.... that many ISP will not investigate.... if they suspect that the culprit has used many different servers, or has emailed through someone elses system. It is common for folks to send virus's without ever knowing it..... with no malicious intent for instance. It does not hurt to report offenders though. It is also possible to send emails that appear to be from someone else.

If you are really serious about protecting yourself.... I would change all my passwords from a CLEAN off premise system. Off premise in a trusted environment. Keep the suspicious computer offline until you locate and eliminate any threat. What kind of firewall do you have? Hardware or software? "Zone Alarm" (software firewall), will allow you to see what try's to access the net from your computer..... giving you the oportunity to block its access.... as well as in some cases revealing the program that is residing on your computer trying to get out. You can also have your computer and its ports scanned by going to "sheildsup" on the internet. They have a scan utility that will scan your computer over the net for you.... and give you the results. This might help to see if you have any ports open.

If someone was figuring out my passwords.... I would first off suspect a key logger or trojan on my computer, OR on my network. I would IMMEDIATELY take my system offline. I would keep it offline until I found out I was clean without a doubt. I would use several different scanners to try to weed out the trojan. I would replace my keyboard if I did not know what to look for. I would also look at my computer and see if there is anything there that should not be (hardware keystroke logger), I would scan for a software keystroke logger. There are specific ways to find the software keystroke loggers. They can be difficult to find.
Keep in mind that if there is a keystroke logger on the system..... someone will still have to view this information. If not from your computer or network... then from a trojan over the net.

If I was not able to locate a trojan or find a keystroke logger, and I still "felt" unsure... I would replace the computer.... or install a new hard drive and recreate a safe system, after I was sure that my network was clean.

Normally the only way a person could do what you think they are doing.... is to send you an email with an attachement that included a trojan. Or give you a download or removable disk that had the trojan software on it. You would then unknowingly open the file or execute/install the trojan software. This would allow them to access your computer to install a software Keystroke logger, password scanners, et.. A diligent scan with several trojan scanners will normally catch these trojans. Make sure you have the "OPTIONS" set up correctly when using the trojan scanners.... and MOST importantly... make sure that after you download the trojan scanners YOU UPDATE them before running.

Anyway..... I have lots of questions.

Be very sure that you are not at fault. User error is sometimes the only problem. Make sure your keyboard is not screwing up when you are typing the passwords. How old is the keyboard? Have you checked the keyboard to be sure it is performing properly? Accessing the email accounts from a different location would also help to narrow down the problem. If you are able to access the email accounts from a different location for instance, that would mean your problem could be your keyboard malfunctioning. Is it wireless, and if so are the batteries needing replaced? Have you created an email account at Yahoo!, and tried to access that email account from a different location? Does the password not work from the other locations as well?

Let us know what you find out.

Oh.... also... what operating system are you running... and have you made sure to update with the latest critical updates/security patches?
 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
Lord that was detailed. :) I do appreciate the time you took thinking of all of this.

Quick rundown. I'm on broadband (cable) using firewall, virus scanner, and now the moosoft proggy. Yes I did update before running moosoft.

I'm 100% positive that no one uses this PC except me and her. Keyboard is fine about 1 month old. USB MS Multimedia.

Like I said I'm 99.9% positive I know who the person is it's just getting them caught redhanded is the problem. This has only happened to a select few people who are members of our board and a few other boards they are all memebers of. The person has not sent us an e-mail for at least 3 months and I've gotten a new HDD since then. Nothing has happened for about 12 hours now on ANYONE'S account or site so we'll see.

If you want to e-mail me with any detailed questions you don't want to post here just send me one hereIt's in my profile.

Thanks
 

Cybordolphin

Platinum Member
Oct 25, 1999
2,813
0
0
What software firewall program are you using? You don't have to answer that here. BUT..... If you don't have a firewall software program.... get one. A hardware firewall is great (or passive like WINXP), but these do not let you see/ block OUTGOING communications.

I'll assume you are hardwired with your cable access (not running a wireless cable router). If you are living in an apartment or duplex, be sure that no one has tapped into your cable (getting free cable). Might even go out to the telephone pole in the back of the house to see if all looks well there. Look for a splitter. You could even call the cable company out and tell them you want them to check things out for you. Explain you suspect that a neighbor may be accessing your cable.

I don't think that Yahoo! has been hacked. We would all be hearing about it. Therefore I think the only way that someone is accessing your password(s) is via your computer or network (including cable), quite possibly you have a trojan, or a keystroke logger. As mentioned it could be even a neighbor tapped into your cable. Normally a neighbor would not be so bold. As they would want to remain stealth. They want to keep their free cable, and don't want to get caught. Most criminals are idiots... so don't rule this one out.

When you scanned for trojans... did you have the scanner software setup to fix automatically? This may have cleaned your system without you even seeing it done. I believe that "Cleaner" will still show a trojan was found even if you have it set to automatically fix/clean. You should try another scanner program or even two to be safe. And you should still be aware that trojan scanners will not eliminate or even find keystroke logger software, in many cases.

If you don't believe that you have a trojan, you don't have a wireless network, nor find out you have a really stupid neighbor..... I would have to say.... the problem is a friendly. "Friendly" being a screwup or user error.
(I know you don't want to hear that).

Do keep us posted.




 

kantonburg

Platinum Member
Oct 10, 1999
2,975
1
81
On a wired connection using firewall through router. Was using ZoneAlarm before router.

We are in a single family home and in a VERY small town. I had moosoft ask me before doing anything but it didn't find anything.


Like I said I'm positive i.e. 99.9% I know who is doing this but proving it is the hassle right now. Tomorrow will be a day we'll find out more. I get updates from everyone who was, so to speak, hacked into the other day. There have been 3 yahoo accounts so far, 1 account was fiance's. 3 webforums that we know of, 2 others maybe (all Delphi), and this was all in the past 3 days. I'm not worried about my PC to be honest. I just want to know how all the accounts (mail and forums) are getting accessed. Too much has happened in too little of time and too many things point to the same person in Conn. who we contacted their company about.
 

Turkey

Senior member
Jan 10, 2000
839
0
0
What is the "forgot password feature?" It may be that the person is also using the "forgot password feature" and getting your password then changing it.
 

element

Diamond Member
Oct 9, 1999
4,635
0
0
I was going to mention one of those wireless video cams when someone suggested "looking over your shoulder" even though it was figuratively, but I see you're leaning away from that. Also cordless phones broadcast all your phone conversations all around the neighborhood. In case you may have spoken the password over the phone or something. I'm just reaching at straws here but you get the idea. Cell phones are also tappable but requires a bit more effort than cordless, as scanners have those frequencies locked out by defualt, course this can be overcome. Good Luck.