0

I think someone somehow managed to gain remote access to my computer and was able to log into my ebay account and purchase some stuff. I was noticed the suspicious activity, and yanked the power cord, but I don't know how long they were in there before trying to make the purchases.

The way I understand it, there's no way to be sure they didn't do something else, and my best bet is to nuke it and start over.

  • So the question. How far do I need to go to be sure?
  • It's Windows 10, so can I just do a reset of Windows erasing everything?
  • Should I reformat completely?
  • Buy a new HD?

I have Windows installed on one drive, and most of my important files on another drive, so I don't know if that will affect anything...

Edit:
I was at work, and got a notification on my phone about an ebay order. I checked ebay and saw there was a purchase for gift cards by email. I checked PayPal and there was a charge. I called ebay first and was told it was made though one of my devices. I called PayPal and reported the fraud to stop the payment, and the bank to block it. I checked my email and someone had put a filter in to send eBay and PayPal email to the trash. I have two factor on my gmail, unless it's one of my trusted computers, which means my home or work.

After I figured that out I called the wife and had her yank the plug after looking at the screen. A program I had left open was no longer running.

Also I tried remoting into my home computer from work through teamviewer, but it wasn't available for some reason. I half wondered if someone got in that way.

Improve this question
6
  • What suspicious activity did you notice?
    – Paul
    Dec 10, 2015 at 3:28
  • Without more info, I won't say you were or weren't penetrated, but if an attacker was able to access your machine, they did so in part by installing software, commonly known as a RAS-kit. That means that if you are correct, you will need to back up your data (but no executables), completely wipe the OS and all local partitions, and rebuild from trusted media. Keep in mind however, what you describe is not a normal attack for a professional targeting a normal civilian (they target them 1000 at a time). It is likely someone you know, and equally likely that they were within 500 feet of you.
    – Frank Thomas
    Dec 10, 2015 at 3:34
  • @FrankThomas I added details. Wasn't the wife, she doesn't use iTunes or need $600 in gift cards for it, and the child is 3. Possibly someone over wifi, but we live in the country and someone parked in the driveway would have been noticed.
    – AndyD273
    Dec 10, 2015 at 3:51
  • @Paul added some details
    – AndyD273
    Dec 10, 2015 at 3:52
  • I called ebay first and was told it was made though one of my devices. Did they establish which device? Focus seems to be on the home PC, but you also say I have two factor on my gmail, unless it's one of my trusted computers, which means my home or work. Business networks and work computers are not necessarily immune to hacking. Not saying that's the case, just that technically it's a possibility until provably excluded.
    – dxiv
    Dec 10, 2015 at 5:09

1 Answer 1

Reset to default
1

Removing malware and rootkits

First of all boot into safe mode and use a root kit remover (Such as TDSSKiller from Kaspersky,) to check whether there is any software that will persist across malware scans etc.

Then use a traditional malware removal tool such as Kaspersky's free malware scan to remove more standard malware.

Regardless of whether you do this you should attempt to regain control of your account through customer service and issue charge-backs (Note: This may have repercussions depending on the terms of service.) Then change passwords for any accounts that share the password and check the registered email to see if you have any notices from ebay (Such as password changes.)

Edit

If you want to remove all possible malware running Malwarebtyes won't do it, you may need to run that as well as a root kit remover.

The purchase order coming from your device does indicate that it was compromised. Did anyone else have physical access to the device, does anyone else know your password or are you running any form of remote access such as Chrome remote desktop or SSH?

Edit 2

In reply to Xavierjazz no they will not have card details, accounts only display part of the card number in order to stop this happening, there should be no need to cancel the card.

Improve this answer
7
  • I added the suspicious activity, in case that helps. I'll definitely run those scans. Running Malware bytes in safe mode now and it hasn't found anything.
    – AndyD273
    Dec 10, 2015 at 3:54
  • I do have teamviewer installed so I can remote in and help the wife with stuff. No one else has physical access. Out in the country so anyone trying to get on wifi would need to be in the driveway.
    – AndyD273
    Dec 10, 2015 at 4:23
  • 1
    If someone hacked in, they have the cards and passwords you use. IMMEDIATELY contact your card issuers and tell them what happened.
    – Xavierjazz
    Dec 10, 2015 at 4:44
  • I'm now thinking they got access with teamviewer. I pulled the logs and need to check them. So far no scans have turned up anything suspicious
    – AndyD273
    Dec 10, 2015 at 13:15
  • As a general rule, it is to be assumed that any given anti-malware system will miss at least 20% of current in-the-wild malware, and at times some products have a miss-rate as high as 60%. Many fully installed rootkits run at so low a level in the kernel that they can consistently hide from even the best antimalware, and this is especially true in APT scenarios. If you can confirm an actual penetration, Then burning the feilds, salting the earth, and never looking back are the only way to be reasonably certian that the system is now safe once more.
    – Frank Thomas
    Dec 10, 2015 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .