Rapidshare account hijacked???

steve927

My premium Rapidshare account has been hacked again for the 3rd time. 20 downloads today from, Bangalore, Peru, Poland, Vietnam, Sweden, etc etc. I've changed the password loads of times, its a 15 letter and number combo and i have the security lock activated so i dont know how the **** they're doing it. Its wrecking my head. I thought it may be a keylogger on my machine but i've scanned with all security software and everything appears ok.

I was checking out the locations of the IP addresses that had downloaded through my Rapidshare account and i went onto IP Locator which told me MY IP IS IN POLAND So i thought that it was an error so i went onto speedtest.net and it showed my location as Poland too, I'm in Ireland obviously. The IP address is an Irish one but its terminating in Warsaw.

I rang Irish Broadband and they said "not possible blah blah blah" but he then noticed that he couldnt see me on the network and that was suspicious coz i still had internet access. He reset my connection and now i'm showing up again as being back in Ireland.

So i reckon i've been seriously comprimised on this pc. Nothing is showing up on any scan though and i'm worried coz i've used this machine for banking, credit card stuff etc. Dont know what to do or where to go from here.

Any advice would be appreciated, thanks!!

Username!

Move to Poland?

I would suggest contacting RapidShare and requesting login details, times and dates and IP addresses.

If you then use a program called NeoTrace Pro, you can trace the exact location of the IP itself.

http://www.networkingfiles.com/neotrace/

faoile@n

It sounds like your going through a proxy that is capturing your key strokes. I would be very doubtful that all their after is your rapidshare account. Don't use internet banking or any kind of online shopping on the infected pc. It might also be a good idea to change email passwords and the like from a different pc.

Then try running Malwarebytes, it was the only thing to get rid of a nasty virus i had a couple of weeks ago.

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

neacy69

As posted above sounds like there is something defo wrong with your machine so don't use any sensitive information until you get it sorted....
I presume you have tried all the freebie usuals like:
AVG Free
ADAware
Windows Defender

I use a combination of all 3 of these and usually catch most things....
If all else else then it may be time for a pro or like most people a re-install

steve927

I'm up to speed with all my security and updates and its finding nothing. I know a bit about computers so i'm disappointed that i've been caught out by this. IBB have been totally unhelpful on this issue and i even had to email them a screenshot of speedtest.net showing my location as Poland coz they thought i was talking rubbish. Its been ok today and showing me as being in Dublin and i'm keeping a close eye on it.

Sponge Bob

Well they would think it was rubbish seeing as they have no customers or network in Poland

Reinstall windows is my advice .

steve927

Sponge Bob wrote: »

Reinstall windows is my advice .

Cheers! If i do that what will i lose? Will i have to reinstall all my apps? Will i lose stuff on my hard drive?

Sponge Bob

you must reinstall your apps yes ( do not scrub the machine)

do not install into the default c:\windows directory but into c:\winxp instead

do not use a dell restore cd or you will lose stuff if you do

finally create different usernames to make sure the profiles are not overwritten (becuase that is where most of your data is)

if you log on as steve now log on after the install as stevie

thats all for tonight

dub45

steve927 wrote: »

Cheers! If i do that what will i lose? Will i have to reinstall all my apps? Will i lose stuff on my hard drive?

I would recommend that you always create a 'd' partition and keep your 'stuff' there - documents pics etc etc. That way if you have to do a clean install of windows - reformat 'C' - which is the best way to be sure you have got rid of a virus or malware your 'stuff' is safe.

Moriarty

Nothing to do with broadband, moved to comp/tech.

calex71

OP what software are you using to download rapidshare links? Ive seen a a few that download the files but also steal your password also ;-)

Are you downloading from the same pc all the time or different ones ie college, work or internet cafe?

BigEejit

faoile@n wrote: »

It sounds like your going through a proxy that is capturing your key strokes. I would be very doubtful that all their after is your rapidshare account. Don't use internet banking or any kind of online shopping on the infected pc. It might also be a good idea to change email passwords and the like from a different pc.

Ding,
Almost certainly what happened .... it looks like you have been well and truly jacked. Have a look for "Hitman Pro" nice little app that installs and runs a bunch of different freeware and shareware anti malware apps (adaware, prevx, cwshredder, spybot etc) one after the other.... even if it came back clean in fact ESPECIALLY if it comes back clean assume your machine is still jacked.

Get a usb disk, copy all your pics and documents to it, download drivers for your hardware, download your apps to it and reformat you hard disk, reinstall everything except this time go and get decent antivirus/firewall/malware software.

I have found that AVG has had a few false positives recently that caused some hassle (zonealarm was a pita).... I looked at the reviews and found Kaspersky Internet Security is rated highly so I got it relatively cheap, 12 quid for a year sub on a 3 user license - key only, downloaded the software from Kaspersky and it is ticking all the boxes......

You will never be 100% safe really. Just be careful with your browsing/browser if going to the top shelf websites and the like... dodgy downloads and email attachments and you should be fairly ok though