Hacked

I used 4 device in 4years with same sim card,and my question is can a hacker can backup my whole chats from starting( I mean from four years before chats)

Hi bahnum

                    Welcome to the Community..........


bhanum wrote:

Hi,

 

I have installed a trial of Norton 360 on Windows 7 hoping that it would prevent others from seeing my computer screen using some kind of remote desktop or even being able to take control of my computer. The problem still persists. Please help.

 

Thanks


From the very limited info you have provided , we cannot give you a helpful solution to your problem without more information?

   Please advise which version of Windows you are using and your current browser version ? Also which version of your Norton product which can be found by opening your Norton interface and selecting " Support " ...then " About " ...

......the version number is displayed in the "fly out " tab that appears !

 

Can you also clarify the symptoms that make you feel that a "remote desktop " takeover has happened  and any other unusual behaviour that you are aware of ?

 

Can you also confirm wether you have any other Security software installed that may be conflicting with Norton etc? Certain products that have "real time " scanning  abilities can prevent your install of Norton working correctly !

 

The more we know...the easier it will be to help you find a solution ..Let us know the details requested and we'll take it from there :smileywink:!

                                 .........................Thanks..........Ed

i have noticed that remote desktop services has also restarted itself after i have disabled it, does norton 360 v5.2.0.13 need to use the remote desktop services for it to work properly, i am using windows 7 home premium 64 bit the internet browser is internet explorer 9

Hi bleeper24,

 

Thanks for responding so quickly. I hope it will be possible to resolve this problem soon.

 

I am using Windows 7 Ultimate SP1, and the Norton version is : Norton 360, 5.1.0.29.

 

Details regarding the symptoms: I can only say that other people are able to see exactly what is on my screen at any time while I am connected to a network. The only way to stop it seems to be disabling my Wifi drivers in device manager. (They are able to see even if I simply disconnect from the wireless network through systray.)

On a side note: it is possible that they know what my windows and wifi passwords are, if this is relevant

 

They can take control of what I see even by clicking links on the web pages i have open. They are able to do this right now, but for some reason are allowing me to post this. (They tampered with my net for a while, so was unable to respond sooner)

 

I also have adaware internet security 9.6 installed, even prior to norton but it was unable to prevent the attacks

the browsers i use are chrome and ie 9 but that does not seem to make a difference

 

Thanks


bhanum wrote:

Hi bleeper24,

 

Thanks for responding so quickly. I hope it will be possible to resolve this problem soon.

 

I am using Windows 7 Ultimate SP1, and the Norton version is : Norton 360, 5.1.0.29.

 

Details regarding the symptoms: I can only say that other people are able to see exactly what is on my screen at any time while I am connected to a network. The only way to stop it seems to be disabling my Wifi drivers in device manager. (They are able to see even if I simply disconnect from the wireless network through systray.)

On a side note: it is possible that they know what my windows and wifi passwords are, if this is relevant

 

They can take control of what I see even by clicking links on the web pages i have open. They are able to do this right now, but for some reason are allowing me to post this. (They tampered with my net for a while, so was unable to respond sooner)

 

I also have adaware internet security 9.6 installed, even prior to norton but it was unable to prevent the attacks

the browsers i use are chrome and ie 9 but that does not seem to make a difference

 

Thanks


Hi,

What type of security have you set up on your wireless router? It sounds like you need to physically disconnect  it from the Internet and wire connect it to your computer. Then I would make sure I reset it to factory defaults and then create a new password. Make sure that security is turned on. After than you can reconnect to the Internet and get your system back in order. You might want to change your Windows password before reconnecting.

Depending on the amount of damage you feel they have done it may be necessary to visit every place you have a username and password. Change both your password and the answers to your security/secret questions [they are often a backdoor into the account again]

Run live update to be sure 360 is current then run a full scan. Do this once from the desktop and once in safe mode w/networking. If you need a second opinion download, install, update and run Malwarebytes free scanner. It's here:

http://www.malwarebytes.org/products/malwarebytes_free

It's Norton compatible so keep it on the desktop and run it from time to time as a form of insurance.

It is going to take time to do all that is suggested above so relax and keep thinks unpluged until you are ready to start. It will limit the amount of additional damage that can be done.

We'll be here when you need us.

Hi bhanum,

 

How are you arriving at the conclusion that someone has remote access to your PC?  It sounds like it could be malware redirecting your browser, which would not be the same thing as a hacker actively watching you.  Can you elaborate on some of the symptoms you are seeing - what pages you are taken too, and when?  Even if someone had hacked into your network, they would still need to get past the Norton FIrewall to access your PC - not easy to do, especially since an insecure network would cause Norton to lockdown your PC even tighter.  Do you see any unknown devices on the network by looking at the Norton Security Map?


bhanum wrote:

Hi,

 

I have installed a trial of Norton 360 on Windows 7 hoping that it would prevent others from seeing my computer screen using some kind of remote desktop or even being able to take control of my computer. The problem still persists. Please help.

 

Thanks



Please see this message in a thread adjacent to yours:

 

http://community.norton.com/t5/Norton-360/I-got-problems-lol/m-p/659531#M66389 

Hi SendOfJive,

 

I can confirm that remote access is being done because the attackers make sure that I get to know that they have read or seen what is on my screen. The information they collect is distributed to various parties who also do the same. That is as elaborate as I can get on a public forum.

 

They usually do not redirect me to other pages, but I distinctly remember once about a year ago that they clicked on a link to a website's "Privacy Policy" page just to make their point.

 

I am, however, open to suggestions on how I can secure my system and will closely follow instructions posted in this thread and keep you updated.

 

Thanks

Hi dickevans,

 

The wireless security is set to WPA-Personal.

This is how my system is set up:

1 Desktop and 1 Netbook both running windows 7. Norton is installed only on the netbook.

 

The connection to the internet is via DSL on the phone line, The phone line is connected to one router which I got from the phone company. I have extended this by attaching a cisco wifi router. The desktop machine is connected via a lan cable from the wifi router and the netbook only uses wireless.

 

The remote access is possible on both machines.

 

I followed your suggestions of changing the password on both routers and the wireless key but it does not seem to have made a difference.

 

I have not changed my windows password ( the desktop does not have one) and I was connected to the internet the whole time while I was changing passwords on the routers. I will try this again while disconnected.

 

Also, I noted that the router provides the ability to log all incoming and outgoing packets listing ip addresses and ports. Is it possible to figure out if there is some software on the machine that is communicating without authorization? Can I configure norton to only allow those applications to communicate which specifically ask for permission to do so? 

 

I ran live update, will run a scan and post the results shortly.

 

Thanks

 

 

 

 

 

 

 

 

Hi again bhanum

                                 When we asked for more info regarding your system , you stated that you were also running Adawre 9.6 alongside your Norton 360 protection...is that correct ?

I have looked up the info on the Adaware program and it has "real time " scanning engine options which many users of Adaware are reporting as " interfering with other security systems " !

It is a known fact that other similar protection software that is running in "real time " will have a detrimental effect on Norton 360's ability to do its' job correctly ! 

 

An article on the Cnet website said ....

[Quote ]The second new engine, MagmaShield, is proactive. It emulates processor instructions, comparing approved processor-level operations against those that are undefined in the application layer. This means that it aggressively looks at how a file interacts with the CPU and uses that to call out threats faster.[End Quote ]

If you are still running Adaware ......I suggest you temporarily disable it and run a scan with Malwarebytes which lives happily with Norton !  If Adaware is still operating ...this MagmaShield engine may be upsetting things somewhat

 

Have you managed to try  the Malwarebytes scan that Dick suggested yet ? Let us know regarding the confirmation of wether you are still running Adaware or not ....and any log results that Malwarebytes may have produced ?

                                                                                                                                                           Thanks.....Ed

 

 


bhanum wrote:

...the attackers make sure that I get to know that they have read or seen what is on my screen.


How do they do that?  Are you getting emails or something from a hacker telling you this and providing corroborating evidence?

Hi Psyc_man1993,

 

I do hope  you have not been sucked into a scam that we have seen here lately where someone claiming to be from Microsoft rings and tell you that you are infected.  Could you please give us information on how you knew you were hacked.

 

Thanks,  Dave.

Hi MStorms26,

Yes, Malwarebytes and Norton 360 are for the most part compatible and will coexist with little to no issues. It is recommended that you disable its real-time protection, reverting it to the free version and setting it Not to Load at Stat-up and using it only as an on demand manual scanner. However, some folks on here have reported using it with its real time protection active and claim to have had no issues, even though its not recommended.

Malwarebytes Support has a thread discussing it and a list of exclusions you can set to further help ensure there are no conflicts between the two at this link.  Please Note member lmacri notes in this thread for further reference.

Hi JJ
Does the Malwarebytes work in tandem with Norton 360 or will they work against each other?

Hi okie dokie,

She is a computer wiz, she has hacked into my devices

Could you share further information as to what leads you to believe she's hacked into your devices? 

I call Norton LifeLock and the problem is solved

Do you recall What Norton Support did to fix the initial problem?

She has now hacked into my social media accounts. I can no longer make comments on my YouTube channel

Are you having problems logging into your account or are you receiving a notice that your account has been suspended? 

My 16 year old son tried to open his first Facebook account. He can't. We keep getting a message saying. "This account has been disabled, due to violations". He never had an account to be in violation

Facebook cannot disable an account before its been created.  So if hes trying to setup his first account, and receiving a notice its already been disabled, due to violations, the account must have already existed. 

Also, it seems on Facebook, you can easily get someone's account suspended simply by clicking the "Report Post" and marking it as "offensive" a couple of times as my son found out when his ex-girlfriend got mad at him. He's still trying to get his account back. No hacking involved!

When I try to Chat online with Norton LifeLock the hacker won't let me

Do you have any Ad or Pop-up blockers installed?  These can block Norton Chat window from working.  If so, try turning them off before attempting to connect with Norton Chat.

 I can go to the public Library and use their internet and I have no problems

Are you using your personal device or one of theirs at the Library?  Note, I would not recommend this practice as their WIFI is open to public access and any PC you may have used saves your browsing sessions in cache. Anyone using this device after you could snoop through it.

If you're concerned she has access, I'd recommend conducting a Full Norton scan of your PC. If nothing is found, you can also download Malwarebytes and conduct a full system "second opinion scan" just to be sure from this link.

Next, I'd recommend changing your Modem/Router WIFI Password, as well as your Passwords for any social media accounts you use.

 

 

Contact the authorities if you know the perpetrator. Norton can only protect your devices. They cannot protect your social media or any other online accounts.

 

Filename: tch.exe
Threat name: Heur.AdvML.BFull Path: c:\users\djordan\appdata\local\temp\tch.exe
On computers as of: 10/3/2017 at 11:53:31 PM
Last Used: 10/4/2017 at 3:48:08 PM
Startup Item: No
Launched: No
Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.
tch.exe Threat name: Heur.AdvML.B
Many Users: Thousands of users in the Norton Community have used this file.
Mature: This file was released 1 year 7 months ago.
High: This file risk is high.
Source: External Media
Source File: xrdp.v2.1.exe
File Created: tch.exe
File Actions
File: c:\windows\system32\ rdpwrap.ini Removed
Infected file: c:\users\djordan\appdata\local\temp\ tch.exe Removed
File Thumbprint - SHA:
ba91ab389e3219c307980b903d7ed5aba8bbf9f4ec7f389db83d73b7dbab9209
File Thumbprint - MD5:
78d4e9ba8f641970162260273722c887

File name: RDPWInst
Detection ratio: 11 / 65
Analysis date: 2017-10-10

Sorry it took so long, but here is the scan results. Any insight would be appreciated. 

The best AV solution is to not turn the system on in the first place, albeit not a practical one! I'll stop out there tomorrow, get and paste.  Thanks

DSJon:

I have a customer with Norton Security (updated, latest version), had some strange things going on, ie system reboots. In looking into, noticed there was an additional user account created and logged in and the guest account was re-enabled. I disabled guest, deleted bogus account, changed the customer password and started running scans. The full system scan only came up with heur.advml.B, which seems to be a generic hit. My question, how did this get past Norton in the first place? Why is it only seen on a full scan, vs quick scan? I would deem this more of a higher risk that what it's labelled as we have a system breach, with unwanted activity.

Jon

No antivirus is perfect. Can you post the "copy to clipboard" details of this detection?