Live Chat & Podcast at 1:00PM Eastern on Sunday!
There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
General Security
Tag Cloud
access acer asus bios bsod computer crash desktop dns driver drivers error ethernet excel freeze gaming graphics hard drive hardware hdmi internet laptop malware memory monitor motherboard network printer problem ram registry repair router slow software sound trojan ubuntu 11.10 uninstall usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless
Search
Search for:
Tech Support Guy Forums > Security & Malware Removal > General Security >
Solved: Internet security issue

Reply  
Thread Tools
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
02-Jun-2009, 12:31 AM #1
Solved: Internet security issue
I've got a very annoying security issue that I can't seem to figure out. Some guy in indonesia (according to an ip trace. thank you gmail) keeps changing my gmail password every couple of nights. Its easy enough for me to change it back, I can just reset it using an associated account, but its a pain nonetheless. My problem is that I cannot figure out how its being done. I've tried several different anti virus programs, none of which found anything. I've used a key encrypting tool that encrypts every key stroke as its entered, I've tried reinstalling firefox, I've tried using google chrome for a few days. this started when I was connected at college, but its continued since i've moved home for the summer, so its not something with that network. I've started using LastPass to manage my passwords, and every time i have to reset the password I randomly generate one. I tried signing out and clearing all private data every time I accessed the account. None of this changed a thing. The password continues to be changed. However, my associated account never gets an unintended password reset email, and for the first 24 hours, that is the only way it can be reset.

If anyone has any ideas, I would love to hear them.
..and sorry for the wall of text.
lunarlander's Avatar
Computer Specs
Senior Member with 3,491 posts.
 
Join Date: Sep 2007
02-Jun-2009, 02:18 PM #2
Please visit this page :
http://mail.google.com/support/bin/topic.py?topic=12914

click on "I cannnot access my account" Then select
"my account has been compromised"

and then fill out the form.
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
02-Jun-2009, 11:45 PM #3
I've done all that before. That was what I used to do to get my account back. I've changed accounts since then and set up the secondary email to get it back faster, but I continue to have the same troubles.
occiput's Avatar
Computer Specs
Junior Member with 16 posts.
 
Join Date: Jun 2009
Experience: intermediate,or ++
03-Jun-2009, 01:11 AM #4
Quote:
Originally Posted by coywolf View Post
I've done all that before. That was what I used to do to get my account back. I've changed accounts since then and set up the secondary email to get it back faster, but I continue to have the same troubles.
Somebody has access to your ip address ( like everybody else) when you are surfing. Install GeSWall (freeware), a browser envelope or Sandboxie, a much superior browser protector( shareware) and see how things change. If your computer is still compromised, get back and we'll talk about masking your ip!
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
06-Jun-2009, 03:47 AM #5
well, installing GeSWall might have done it. I think I'll wait a couple more days before I mark this as solved, just in case, but thanks for the tip.
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
07-Jun-2009, 07:29 PM #6
Alright, as I kind of figured, it happened again. Now, I WAS on my laptop the other day, wirelessly connected to my router. Could that have messed it up? The program wasn't installed there. However, I was only using firefox. I never logged into the account.

And something I was curious about, even if this person had access to my ip address, how could that be used to retrieve my password?
lunarlander's Avatar
Computer Specs
Senior Member with 3,491 posts.
 
Join Date: Sep 2007
07-Jun-2009, 09:36 PM #7
Is your wireless router set up with WAP encryption? Without encryption, things send over the air can be sniffed out, like your gmail password.
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
08-Jun-2009, 01:51 PM #8
Its set up with..I think WEP Personal. And even so, the IP address I pulled from gmail said this guy was in indonesia. And also, my desktop is connected directly to the router.
lunarlander's Avatar
Computer Specs
Senior Member with 3,491 posts.
 
Join Date: Sep 2007
08-Jun-2009, 06:51 PM #9
Did you also change your Gmail's secret question + answer ?
Vaqxine's Avatar
Junior Member with 2 posts.
 
Join Date: Jun 2009
Experience: Advanced
08-Jun-2009, 10:40 PM #10
If he can manage to get your password every time, I'm guessing your system contains some form of malware. Keyloggers are common now, and that would be a reason for him knowing your password each time.

I suggest you post in the Malware Removal & HijackThis Logs forum with a HJT log if you think this may be the case. It would be wise to atleast scan your computer with an anti-virus right now, but do not remove anything just yet.
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
10-Jun-2009, 10:49 AM #11
lunar lander: Yes, I usually change the security question when I reset the password

Vaqxine: I've run scans with Kaspersky, BitDefender, and Avira, which is what I'm actively using now, and none of them came up with anything.
Vaqxine's Avatar
Junior Member with 2 posts.
 
Join Date: Jun 2009
Experience: Advanced
10-Jun-2009, 01:04 PM #12
Have you been picking a strong password? e.g. $3xamp1e%
And security questions that nobody could guess?

If you have, then you must be infected with something.
I'd suggest checking your netstat log.
For Windows XP, go to
Start -> Run -> CMD and type in Netstat -nb
It will show all the processes that are connecting to the internet, check if any of them are suspicious.
sdikevin's Avatar
Member with 228 posts.
 
Join Date: Jun 2009
Experience: Advanced
10-Jun-2009, 01:10 PM #13
The indonesia IP really doesn't mean anything. Anyone can do a whois and then run an IP Spoof to cover their real IP. If you ask me, someone was running some kind of packet sniffer tool or something on the college network. It seems like they got the password for both your email accounts, and are doing the same thing you are when they change it on you. They then log into the other account and delete the email sent to it about the password change. Try this go to friends house that you can trust, create a new account on their computer and link it with the others. From that PC change all 3 account passwords agiain.
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
10-Jun-2009, 03:43 PM #14
All my passwords have been auto generated, things like EQw9l6p3

I checked the netstat log, nothing seemed suspicious. At the moment, it was all firefox, xfire, and jucheck.exe

sdikevin: i'll get started on trying that
coywolf's Avatar
Junior Member with 22 posts.
 
Join Date: Aug 2007
24-Jun-2009, 03:22 AM #15
Alright well, sorry I haven't posted in a while, but I wanted to give this some time to confirm it. It looks like changing my password from my friends computer might have done the trick. Haven't had it changed back in..I guess about a week at least now. Thanks for all the suggestions.
Reply

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 09:28 PM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.