Hacked and Banned

[TheRealThor]

So yeah, this happend.
A few days ago i had to remove my 2FA because i had to make a factory reset of my phone.
Guess what, 2 days later i was hacked. I should've added the 2FA straight away, but i hadn't been using 2FA for 3 years before this, and i've never been hacked.
I don't know how Sythe deals with hacked users scamming, but i surely hope we can work something out.

Thor

I appreciate all response and cooperation
Regards (the real) Thor

 

[TheRealThor]

I just realised i didn't even post from my home computer, which might seem suspicious.
I don't know if this will change the matter but atleast now you can confirm it's the orginal user.

reply: Hacked and Banned

 

[Shin]

Hey @Thor. Sorry for the long wait! I can see your account was hacked, but don't see any scams performed by the hacker on your account.

I'll need you to provide pictures of a full virus scan and malwarebytes anti-malware scan. If you don't have any virus software on your account, Microsoft Security Essentials will suffice. In addition, please provide a new e-mail to be set on your account which hasn't been used before.

Also, if you can provide what your current e-mail should be as well as your date of birth, it would be appreciated (I will hide this information).

Thanks!

 

[TheRealThor]

@Shin
Hey, i thought my account had been used for scamming, so hearing that is hasn't is a great relief.
I ran a full system scan through avast and the malware program.
Malware bytes:

Registernøkler: 7
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\MICROSOFT\TRACING\SpeedCheckerService_RASAPI32, , [293acfc70e8c0b2b7598c8f9778c4ab6],
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\MICROSOFT\TRACING\SpeedCheckerService_RASMANCS, , [461d7a1cbedc00364ac3576ab74c24dc],
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\PCSUSpeedTest_RASAPI32, , [ea797422e0ba54e2e22a606162a1c838],
PUP.Optional.PCSpeedUp, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\PCSUSpeedTest_RASMANCS, , [f370dfb724760333f913a31ec63d4bb5],
PUP.Optional.Yontoo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Update Air Globe, , [5c07c1d5e3b776c0dbbaf3ec57ac27d9],
PUP.Optional.Yontoo, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Util Air Globe, , [73f00d89e9b19b9bbfd65b844fb4847c],
PUP.Optional.OutBrowse, HKU\S-1-5-21-1310442037-2225681052-736862652-1001\SOFTWARE\OB, , [263dd1c5a9f1280e2d485856c63d5aa6],

Registerverdier: 3
PUP.Optional.OutBrowse, HKU\S-1-5-21-1310442037-2225681052-736862652-1001\SOFTWARE\OB|monitype19, 3/14/15 0:36:44, , [263dd1c5a9f1280e2d485856c63d5aa6]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1310442037-2225681052-736862652-1001\SOFTWARE\OB|monitype20, 3/14/15 0:36:44, , [7de68d0989111a1c9ed701ad48bb7090]
PUP.Optional.OutBrowse, HKU\S-1-5-21-1310442037-2225681052-736862652-1001\SOFTWARE\OB|monitype38, 3/14/15 0:36:44, , [1251ebab9efc86b04233c4ea00030cf4]

Avast:

I think the email i used was <hidden>, i was born on the <hidden> but i might've written something else. For example i might've written i was born three years before or something.

It could've been an email breach, but my main mail should be secure.
New Email: <hidden>

Thanks for all further help
regards,
Thor

 

[Shin]

Thank you for posting everything requested. I've updated the e-mail address and sent a password request. When logging in, please set a new, unique password and enable 2FA on your account.

Like this post when you're back! Cheers.