Possibly hacked laptop

Hi

 

I'm reaching out for help because my laptop seemed to have been hacked. Can you please take a look at this log? Your help will be greatly appreciated. I have attached the aswMBR log as requested.

 

 

Thanks

As far as seeing something in the logs, nothing there.
We will run a few scans to see if anything can be picked up.
Where have you used your credit/debit card other then on the computer? example….out to eat, shopping, groceries? or an iffy/unsecured online shopping site?

You need to call (or go there) your financial institution and have that particular credit/debit card cancelled and a new one issued.

you should always keep vulnerable programs like Adobe Flash Player, Adobe Shockwave Player, Java, Silverlight, Google Chrome, Mozilla Firefox, VLC Media Player, etc. updated to their most recent version (even better, you don't have to install them if you don't use them). Programs like 🖼Click to load external image (eF2jhaz.png)UCheck, UCheck is a software updates manager, able to list your installed software and tell if an update is available.
If it is the case, UCheck gives the ability to install the update either manually (download/run installer) or automatically and with or without bulk selection.
~~~~~~~~~~~~~~~~~~~~~~~~~~`

Do you have an active antivirus on your computer?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`

[external image: RQKuhw1.png]RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

~~~~~~~~~~~~~~~~~~~~~~~~~~`
[external image: zcMPezJ.png]AdwCleaner

• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean & Repair button. This will kill all the active processes
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

Your next reply(ies) should therefore contain:

• Copy/pasted RogueKiller clean log
• Copy/pasted AdwCleaner clean log

created by Aura

Still need help?

Yes i do. Sorry for the delayed response. I was under the weather.

Rogue report

 

Adware clean scan found this…23 threats

 

Adware cleaned log after reboot

 

I'm also concerned by some of the items that appeared on my desktop from the last time i requested help. Thinking I may have inadvertently saved some WTT tools and logs to my desktop. Can I delete them now?

We can remove those tools and quarantine folders easily.
Let's run one more scan to check for remnants first.

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

created by Aura

EEK Scan

 

Now that we were able to do some cleaning, are you still receiving confirmation emails?

I finally caught the perpetrator who was using my Amazon account. I left home on yesterday. My 8 years old granddaughter was doing the ordering. Thank God it was all free purchases.

I need to work on organizing my desktop now. What do you suggest I do for the WTT tools and logs?

 

 

Thanks for all of your patience and great help

I finally caught the perpetrator who was using my Amazon account. I left home on yesterday. My 8 years old granddaughter was doing the ordering. Thank God it was all free purchases.

Oh my gosh!!
They learn how to do so many things now, and so young at that!

The below will remove the tools and quarantine folders.



[external image: BWuhenj.png]DelFix
Follow the instructions below to download and execute DelFix.

• Download DelFix and move the executable to your Desktop
• Right-click on DelFix.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Check the following options :
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
    
    
• Once all the options mentionned above are checked, click on Run
• After DelFix is done running, a log will open. Please copy/paste the content of the output log in your next reply