[FletcherJ]

Morning,

I am looking for a bit of advise here, I have an email address (maybe 15 years old) I am finding each morning I have been sent an email from various websites (genuine I always check first) from amazon, epic games, ea, instagram etc saying someone has changed my password, luckily I have been able to recover each account, Instagram provided the login came from Kenya. (I am from England).

I am at a loss as to what is compromised, around 2 months ago I started getting multiple daily spam emails through my email from random bitcoin spam etc (never clicked them always moved to spam and reported the sender). Is it likely my email has been leaked somewhere and now hackers are trying their luck? Or do I have a keylogger on my computer or something that Kaspersky isn't finding?

Any advise, info much appreciated. - I have been changing my email on all these hacked accounts to a new email, I just hope it doesn't start happening with my new email too.

 

Jonathan

[Advertisements]

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Smart Screen, Windows Defender and Avast have all been blocking FRST recently.  It's a false positive so pause your antivirus when downloading or running FRST.  If you get a message saying Smart Screen has blocked it you can click on More Info and you will see an option to Run Anyway.



You might also try MBAR in case there is something going on that we can't see in FRST:

 

https://www.malwareb...om/antirootkit/

[RKinner]

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Smart Screen, Windows Defender and Avast have all been blocking FRST recently.  It's a false positive so pause your antivirus when downloading or running FRST.  If you get a message saying Smart Screen has blocked it you can click on More Info and you will see an option to Run Anyway.



You might also try MBAR in case there is something going on that we can't see in FRST:

 

https://www.malwareb...om/antirootkit/

[FletcherJ]

 

Edited by FletcherJ, 14 June 2020 - 11:32 AM.

[RKinner]

No sign of anything other than 2 programs that are not recommended (peer-to-peer programs are security holes):

 

µTorrent (HKU\S-1-5-21-2796251407-724095397-2531005990-1001\...\uTorrent) (Version: 3.5.5.45628 - BitTorrent Inc.)

Ace Stream Media 3.1.32 (HKU\S-1-5-21-2796251407-724095397-2531005990-1001\...\AceStream) (Version: 3.1.32 - Ace Stream Media) <==== ATTENTION

 

I'd run MBAR and if it comes up clean then probably an old (mail?) server out in the cloud has been hacked.

[FletcherJ]

Thanks for looking RKinner, its very annoying as this morning I had some emails from various places saying "failed delivery" and basically someone/something had tried emailing no reply mailboxes from my email address with 3 attachments on them (probably viruses).

[RKinner]

As long as you don't see them in your Sent file you should be OK.  Forged emails are very common.

[FletcherJ]

Cheers, thanks for your help with this