Windows attack can steal your logged-in username and password

Cliff S · 16 Aug 2016

simrick said:

Thanks for following up on that Cliff.

You're welcome:)

scop8 · 22 Sep 2016

simrick said:

Hi.
Was your computer talking to you as well? It usually does with this sort of scareware.
Tweaking.com is not a tool for this.

Run RKILL.
Then run TempFile Cleaner.
Then run JRT (Junkware Removal Tool).
Finally, run ADWCleaner.
You should be good to go after this.
p.s. When you run Malwarebytes, be sure to check the option for Rootkits, as it's not selected by default.

EDIT: Site scans clean?
https://www.virustotal.com/en/url/14...is/1470716879/

FREE Online Website Malware Scanner | Website Security Monitoring & Malware Removal | Quttera

https://sitecheck.sucuri.net/results/cinplex.com

Hello, once again another one of these pop-ups that freezes Chrome and gives a phone number to call popped up. I ran through everything, and in AdwCleaner there were 4 things to delete. "Tracing" keys being deleted has nothing to do with key-logging... right?

simrick said:

I suppose, there is always the possibility that a script could have grabbed your current login cookie sessions. Unlikely, but it does happen. That's not grabbing your login credentials, just your cookie session, which could theoretically be used to pretend to be "you" in another browser.

If you're really paranoid, you could change the passwords of whatever you were logged into at the time on the system.

Could you please (or anyone else knowledgeable on this matter) explain what happens when a script grabs a current login cookie session? How can that be used to be "me" in another browser, and how is that damaging?

As to changing passwords, the main one is for Chrome itself. Does that mean I should be changing it? How about for Facebook (I believe I was logged in at the time?) It's a bit frustrating to be revisiting this issue again, but I appreciate the help, thank you.

jimbo45 · 22 Sep 2016

Layback Bear said:

I'm really not sure why a 20 year old hack was not fixed in a brand new operating system.

Hi there

Probably forgotten about in the annals of history -- how many offices can you go into these days and readily pick up something that's even 4 years old !!!!!!.

In any case the Windows OS was so different 20 years ago (at least it should be- surely the whole art of software has improved over 20 years -- at least I hope it has !!!) that the old exploit probably was deemed as non applicable to newer OS'es.

I still think though after all these years - and I've been using Windows ever since Windows 3 -- that Networking still remains a mega problem with Windows -- all my networking is done via LINUX servers and my Windows systems are merely clients - so unless I'm messing around with VM's this type of problem doesn't exist for me --and I'm usually using Firefox as my main browser anyway.

Cheers
jimbo

simrick · 22 Sep 2016

scop8 said:

Hello, once again another one of these pop-ups that freezes Chrome and gives a phone number to call popped up. I ran through everything, and in AdwCleaner there were 4 things to delete. "Tracing" keys being deleted has nothing to do with key-logging... right?

Again? UGH!

How I hate these scumbags!
You can see the developer's documentation here for an explanation of what the tool does.
ToolsLib - [EN] - AdwCleaner documentation - Forum
Tracing has to do with the network.

scop8 said:

Could you please (or anyone else knowledgeable on this matter) explain what happens when a script grabs a current login cookie session? How can that be used to be "me" in another browser, and how is that damaging?

It's called Session Hijacking and you can read about it here:
Session hijacking attack - OWASP

scop8 said:

As to changing passwords, the main one is for Chrome itself. Does that mean I should be changing it? How about for Facebook (I believe I was logged in at the time?) It's a bit frustrating to be revisiting this issue again, but I appreciate the help, thank you.

What I would do is make sure you are logged out of all other sessions. For instance, in Facebook (somewhere - I don't use it much), there is a place to see what all browsers you are signed in on. You can can select to delete all sessions. If anyone has stolen a session cookie from you, that will disconnect them.

Not sure how Chrome works, as I don't use it much.

Honestly, these things can get in from infected webs sites, infected ads, exploits of Flash or Java, unpatched browsers, etc. I use Firefox for my main browser, as it is the most customizable and therefore safest browser. I have browser add-ons (like Flash and Java) set to "ask to activate", I have another add-on which shall remain unnamed (per forum rules), I use WOT to evaluate web-searched sites for safety, I use OpenDNS DNS servers on my NIC to prevent navigating to known bad sites, I use LastPass Password Manager and only log into it when needed, I do not login to the browser to "sync" anything, and I have MBAE for zero-day browser exploit mitigation. All this, plus anti-virus, anti-malware, anti-spyware and CryptoPrevent. Knock wood, I have never had one of these on my system yet, and I do a lot of searching in order to answer threads on this forum.