- Sep 13, 2022
- 4
Hey,
I know it is not the most descriptive title, but I will go into more detail here. Definitely got a virus as Bitdefender (BD from here on in) popped up quickly after it detected it, and removed that one, but after that, I noticed some things that were off, one being that whenever I logged into my account on my PC, the touch keyboard also appeared and wanted me to use the 'easy' sign in (I think Windows Hello). I have never had that appear since getting Windows and do not have that setup. I tried to do a scan with BD and it stopped midway through (said due to user stopping it, which I did not). Had a few more problems with that so I removed Bitdefender and reinstalled it, thinking that the library of threats had been modified. Then I booted into safe mode (no network) and figured out how to run a scan using BD while in safe mode which came back clean. Then I booted back in, let things be, and a couple days later, noticed my Facebook was hacked on the 11th (I noticed on the 12th). In addition to this, my Gmail had a login from an IP in another state.
Once I got FB back under my control and changed my Gmail password, I reset my PC (keeping my personal files) in hopes that would get rid of whatever may or may not be there. Since then, I have run a full scan and an on boot scan with both BD and Avast, while also doing a scan with Malwarebytes. All came back clean. Finally, I used Wireshark to see if there were any suspicious packets, which based on my semi limited knowledge on it, nothing super suspicious came back. I checked DNS, HTTP, and TLS protocols. I had a few HTTP/XML POSTs that were...interesting, but seemed legit (source was AsusTekC and Destination was SeikoEps). I checked all the TLS client hello ones, and ran through the JA3 hashes, but didn't find anything there, used a site that had malware hashes, but could produce false positives. I downloaded and ran FRST and have attached them per the preparation guide. I think my PC is clean, but would like a second opinion. Also if the malware compromised my accounts, is it likely that other accounts would be compromised? I use 1Password for everything, so I only type that password when logging into things (and most things on my PC are just remembered) and I use 2FA/MFA if able.
Sorry for the short story and appreciate any assistance!
RBD
I know it is not the most descriptive title, but I will go into more detail here. Definitely got a virus as Bitdefender (BD from here on in) popped up quickly after it detected it, and removed that one, but after that, I noticed some things that were off, one being that whenever I logged into my account on my PC, the touch keyboard also appeared and wanted me to use the 'easy' sign in (I think Windows Hello). I have never had that appear since getting Windows and do not have that setup. I tried to do a scan with BD and it stopped midway through (said due to user stopping it, which I did not). Had a few more problems with that so I removed Bitdefender and reinstalled it, thinking that the library of threats had been modified. Then I booted into safe mode (no network) and figured out how to run a scan using BD while in safe mode which came back clean. Then I booted back in, let things be, and a couple days later, noticed my Facebook was hacked on the 11th (I noticed on the 12th). In addition to this, my Gmail had a login from an IP in another state.
Once I got FB back under my control and changed my Gmail password, I reset my PC (keeping my personal files) in hopes that would get rid of whatever may or may not be there. Since then, I have run a full scan and an on boot scan with both BD and Avast, while also doing a scan with Malwarebytes. All came back clean. Finally, I used Wireshark to see if there were any suspicious packets, which based on my semi limited knowledge on it, nothing super suspicious came back. I checked DNS, HTTP, and TLS protocols. I had a few HTTP/XML POSTs that were...interesting, but seemed legit (source was AsusTekC and Destination was SeikoEps). I checked all the TLS client hello ones, and ran through the JA3 hashes, but didn't find anything there, used a site that had malware hashes, but could produce false positives. I downloaded and ran FRST and have attached them per the preparation guide. I think my PC is clean, but would like a second opinion. Also if the malware compromised my accounts, is it likely that other accounts would be compromised? I use 1Password for everything, so I only type that password when logging into things (and most things on my PC are just remembered) and I use 2FA/MFA if able.
Sorry for the short story and appreciate any assistance!
RBD
