Two yahoo ids hacked

[Victorio]

Hi all,

This is my first post here and I hope you gentlemen/ladies can help me. A few days back my yahoo messenger closed with the message that I was logged onto another computer. Then, I could not log onto my yahoo id. Again, yesterday,my another yahoo id collapsed. The details (my postal code)I supply to yahoo representatives are incorrect and until I supply the correct code, I cannot retrieve my ids and I have reason to beleive that the details are also changed. I have years of communication in those ids and they mean a lot to me.No commercial value,though. Yesterday, by scanning each file in my system, I found and deleted five hacker tools. The scans now are clean.

Is there anyway I can regain my yahoo ids? I would greatly appreciate your help and be obliged. Help please.

Best-
Victorio

[Gizmokid2005]

Victorio,

The best thing I can tell you, is if you know the passwords to those accounts and they still work, change them ASAP.

Otherwise, you will need to talk to Yahoo, and try to get higher level managers on the line to explain your situation.

Others may have other ideas.

[jholland1964]

I would bug Yahoo until they make things right and they are totally sick of hearing from you. And from what I have read you WILL have to bug them.
That said, Gizmo's advice is right on...You really should change EVERYTHING...there is no guarantee that the hackers aren't still lurking for you to log in again. You say the scans show clean...those are clean of the files which CAN be found by usual scans. What about hidden things? There are many, many ways they can hide themselves on the computer (make themselves look like legitimate files for instance) and sometimes, without the use of special tools you may not be able to see them.

But you are only thinking yahoo id's and passwords...what else did they take? How long were they on there before the system finally told you "sombody else is here"

You say "No commercial value,though." Sorry, but I have to disagree, they got the keys to the front door, all they then had to do was come on in and look around and take what they wanted..there is a HUGE amount of personal information on your computer about YOU, the people you chat with, your email address book...countless items which ARE be of commercial value to the hacker. Why else would they hack the computer? They are no different than the burglar who enters your house, or steals your wallet, they just did it via a computer. Do you like music, games, do you check sports scores, tv listings, want to buy a shirt, take a trip, check out a local news story, contact your bank, your credit card company, your local government offices, your college alumni association, have a headache, backache, have a rash....all that is there, on the computer for them to find...and then watch out.

I really hope that you will run a HiJackThis scan and post the results here so that we can take a look and be absolutely certain everything is gone.

Take a look at this, very long but very interesting;
http://www.castlecops.com/t124999-Wh...is_Hacked.html

[Victorio]

Thank you very much gentlemen. I appreciate your help and advice. My yahoo passwords do not work and the info I provide do not match,especially the postal code. I live in UK. I do not have a credit card nor my bank details etc, are on my computer. But, as you said, there is a lot of info about me and my friends,relatives etc, and I am scared of causing trouble to others because of this. I shall do as others did on the link you posted. I shall also debug and try to post the scan results here. Kindly,do let me know of the ways of retrieving my accounts. Thanks once again and I appreciate your help.

Best-
Victorio

[jholland1964]

Victorio,
Follow only the steps here;
READ ME Before Posting A Request For Assistance!
Ending up with the HiJackThis scan. Post that log and the log from the AVG Anti-spy here.
As far as getting back the Yahoo accounts I will have to do some searching to find out who to contact in the UK as the telephone numbers given on the link I gave you are in the US. Do the required scans first and I will continue to search for you.
Judy

[Victorio]

Shall do as advised,Judy. I am willing to report this to police or take a trip to London's office of Yahoo's. Shall call them regularly.Accept my thanks for trying to help me.

Best-
Victorio

[jholland1964]

Well, as others have told me...it is difficult to find somebody or somewhere to complain to but did find this address to email complaints. I am still looking for a London telephone number but if it is as hard as it is to find one for the US my search will take awhile. But here is an email address to begin with;
uk-abuse@yahoo-inc.com

Now be sure to run those scans and post back here with the logs so we can be certain your computer is clean. Don't these people really "tick you off!?!"
Judy

Here is a web page. I had no trouble accessing it and I don't have a yahoo id so you should be able to get it. If not, let me know.

If your Yahoo password no longer works tell us so we can start the account recovery process.
http://add.yahoo.com/fast/help/us/security/cgi_feedback

yahoo security pages

http://help.yahoo.com/l/us/yahoo/security/

[Victorio]

Hi Judy,

This is the HJT log of my 'puter.

http://hjt.networktechs.com/parse.php?log=290154


Today, I received an online costumer satisfaction survey from Yahoo and I did convey my dissatisfaction. I receive the same message again and again in response to my mails to Yahoo. It's like an automated response with a person's name at the end of it. I am not letting it go. The only thing missing is the zip code and it's not matching.Let me see where it takes. I am contemplating of registering a police case and send a snail mail to Yahoo in UK.

Thanks for helping-
Victorio

[jholland1964]

Hi Victorio,
Your log doesn't look bad really. There is a sign of a previous malware infection which may have caused all the trouble to begin with, though I would still keep at yahoo because they should certainly fix the problem on their end.
There are a few fixes I would recommend with the log, nothing major just clean up really.

Run HJT again and place a checkmark next to these entries;

In the US these Yahoo.rd listings are usually OK but in the UK these can sometimes be an indication of a minor malware which is not really Yahoo but a click through search engine, so go ahead and fix these R1's and also the R3 which has no file associated with it.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

This one below is the indicator of a previous malware infection. It is/was Adware.WebDir an Internet Explorer Browser Helper Object that will modify specific URLs to include an affiliate ID.
O2 - BHO: CvgraphObj Object - {12355F3E-90C3-41AA-8705-15969AF7F210} - C:\WINDOWS\vgraph.dll (file missing)

This one is one I really wonder about. The first IP beginning with 192 is an unknown to me. The second one beginning with 202 is identified as Videsh Sanchar Nigam Ltd - India. Now if this is your ISP then leave it alone, but if it is not then fix this one too.
O17 - HKLM\System\CCS\Services\Tcpip\..\{49CAF0DE-207D-44EF-88E8-F5BDC4FFD8EA}: NameServer = 192.168.10.51,202.9.145.6

Once you have placed the checkmarks next to those entries above then click the FIX button in HJT.
Exit HJT and reboot.

What do you mean by this?

The only thing missing is the zip code and it's not matching

Give me the zip code you are talking about.

[Victorio]

Merry Xmas Judy. Hope you and yours had a nice holiday.

This morning, when I opened my gmail, it wouldn't. I immediately asked for a password sent to my secondary email address and did get the password and opened it.Two of my new emails were read and two new emails below them unread. The hacker was in the process of going through them? I immediately scanned my laptop with all the software I have, I changed my password etc, and I tried to login again after an hour. I couldn't. I requested a new password and it wouldn't come to my secondary email.I tried asking for my id and the that wasn't associated with my secondary email anymore!It only means that the hacker changed the details on my gmail account.

Immediately, I followed all the measures suggested at the top of this page i.e safe booting,scanning with assorted anti-spyware,anti-virus softwares etc. This is the HJT log after I went through the cleaning process.

http://hjt.iamnotageek.com/parse.php?log=290551

Re the 192.168.10.51,202.9.145.6 IPs, my IP address starts with the first one. That means, that IP falls in my service provider's list. The Videsh Sanchar Nigam Ltd - India IP, I have no idea about. I deleted them later.

I have been looking into this thing keenly and I just discovered that an unsecured wireless network in my neighbourhood gets connected into my system along with mine. I also use a wireless network. Is there a possibility that someone from the other network getting into my computer and hacking things? The newly installed Zone Alarm firewall prevented a couple of computers from getting into my system (one I noted down is 192.168.254.106 - TCP port-1056, TCP flags.S.A few ips with similar ips ended with 84,96 etc) If yes, is there a way of finding this out?

Now, I called up the police this evening, the very polite Bobby,over the phone, expressed his doubts about the law being of much help.I think he must be thinking it's a simple case of ids getting lost through malwares etc. Tomorrow, I plan to go to the police station and explain my situation.

This makes me feel I am being victimised by the hacker for whatever reason. This is going beyond email id theft to deliberate tormenting. Please help. I am afraid of even touching my computer now or log onto any website. I would greatly appreciate your help.I hope I am not over burdening you with my problems. I appreciate and value the time you spend(t) on this.

Re the zip, All the details with my yahoo email ids match save for the zip codes and they are insisting on them. Let's see whether my police complaint and documentary support helps.

Best-
Victorio