RS, MU, and Windows Live account all hacked!!!

mikemaster · 10-19-09 at 07:22 PM

After recently buying a 3 month MU premium membership, my RS account, Windows Live, and new MU account were all hacked within 24 hours. They all have different passwords, but the username is the same for RS and MU. I sent support emails to MU, RS, and Windows live since I couldnt recover the password in any of them. The RS security lock was enabled. Whats weird is that it happened 1 day after I bought the MU account. Hopefully I should get a response soon. Any other tips to get my account back?

**SilentSpartan** · 10-20-09 at 05:28 AM

Def. sounds like a keylogger. Might want to run some scans.

mikemaster · 10-20-09 at 12:45 PM

Quote: Originally Posted by SilentSpartan

Def. sounds like a keylogger. Might want to run some scans.

Thanks dude, it took an awful long time to find it. MBAM, AVast, super anti spyware and spybot found nothing. But then I found a process in task manager called "C.exe", so I used a network data stream analyzer and it decrypted the packets and I found that it sent whatever I typed into any c++ app. Thank god steam wasnt running. So I ended the process, deleted the file and I should be good to go. Also I sent a support ticket to windows live support and within 3 hours my account was back :)

**PhenomIIX4** · 10-20-09 at 02:16 PM

Format your pc and buy antivirus, yes, BUY it and install it. This will fix your problems. If you buy thing on the internet on the computer that got keylogged, you should cancel all your credit cards and paypal account. Another victum of identiy theft.

budthoj · 10-20-09 at 05:20 PM

damn thats pretty messed up..^^werd, get antivirus...glad to hear u recovered everything.

mikemaster · 10-20-09 at 06:15 PM

Oh I've always used antivirus. I use Comodo firewall, Avast home edition, and MBAM for hard removals.

**gun28** · 10-20-09 at 11:47 PM

Something similar happened to me, see: Megaupload - Warning

derived · 10-22-09 at 09:00 PM

Quote: Originally Posted by mikemaster

So I ended the process, deleted the file and I should be good to go. Also I sent a support ticket to windows live support and within 3 hours my account was back :)

I would really recommend either a full reformat, or figuring out exactly what the culprit was so you can do a full cleaning of it. I feel merely deleting the file isn't enough, as it's common for many malware to mutate their process name, 'regenerate' themselves the next time you boot up, etc.

muter0802 · 10-23-09 at 09:39 AM

wow that suked mikemaster

mikemaster · 10-23-09 at 12:09 PM

Quote: Originally Posted by derived

I would really recommend either a full reformat, or figuring out exactly what the culprit was so you can do a full cleaning of it. I feel merely deleting the file isn't enough, as it's common for many malware to mutate their process name, 'regenerate' themselves the next time you boot up, etc.

I coincidentally got sick of hundreds of C++ error messages an hour in 7 x64 so I installed XP. That should take care of any malware :)

**PhenomIIX4** · 10-23-09 at 12:20 PM

Usually 32 bit has less issues.

**Black_Emperor** · 10-24-09 at 01:01 AM

My RS account was recently hacked and some arsehole stole all of my trafficshare over 150GB! I discovered it when I was cleaning out some unused files from my program files directory and noticed a text file named hackhound.txt. I opened it and it had the rs url, my account name and password and IDM as my download manager in it, which I use. I promptly signed in to rs and almost all of my traffic volume was gone I was so pissed! I wiped my drive and did a clean instal of vista and bought a new rs account. Damn thieves. I still have no idea how this happened.