Twice, someone tried login into my Facebook from unfamiliar location. Is my laptop infected?

[ithai]

When I tried to log into my Facebook this morning, I received a message stating that my account was locked. The message told me that someone had tried to access my account from an unfamiliar location "using [my] password." This was the second time someone have tried to log into my account within a span of 48 hours. The first from Taiwan and the most recent from Japan. Probably someone is hiding his/her IP. I tried the two factor authentication, but turned it off thinking the previous attempt was nothing. I've checked the "Your Browsers and Apps" from the security settings and have yet to see anything out of place. What worries me was the message indicating that someone was "using [my] password." I had already changed my password multiple times since the first log in attempt. I have also conducted a scan of my computer through Malwarebytes and Avast! Free and found nothing.

 

I am incredibly worried about the fact that someone was able to use my password to log into my account, even after I had changed it. I wanted to ask you guys if you could check and see if my laptop had a keylogger or virus of some sort. I would really like to keep my personal information, not only those found in Facebook, but also my other accounts, safe.

 

Thank you for all your help.

FRST.txt

Addition.txt

[kevinf80]

Hello and welcome,

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

I do not see any obvious malware/infection in those logs. Regarding FaceBook, as that is web based the hacker does not really need any access to your laptop to crack your password..

 

Lets have some scans run, see what turns up...

 

Download TFC  to your desktop, from either of the following links:

http://oldtimer.geekstogo.com/TFC.exe
http://itxassociates.com/OT-Tools/TFC.exe

• 
     
• Save any open work. TFC may close all open application windows.
     
• Double-click TFC.exe to run the program. Vista or Windows 7/8/10 users accept the UAC alert if offered.
     
• If prompted, click "Yes" to reboot.
  

TFC will automatically close any open programs, Possibly including your Desktop. Let it run uninterrupted. It shouldn't take longer than a couple of minutes, and may only take a few seconds.  TFC may re-boot your system, if not Re-boot it yourself to complete cleaning process <---- Very Important

Windows 10 may post an error for the start menu, sign out and back in then re-boot...

Keep TFC it is an excellent, run weekly utility to keep your system optimized, it empties all user temp folders, Java cache etc etc.  

Always remember to re-boot after a run, even if not prompted


 

Next,

 

Please open Malwarebytes Anti-Malware.

• On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
• Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
• Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
• A Threat Scan will begin.
• With some infections, you may or may not see this message box.
  
          'Could not load DDA driver'
  
• Click 'Yes' to this message, to allow the driver to load after a restart.
• Allow the computer to restart. Continue with the rest of these instructions.
• When the scan is complete, click Apply Actions.
• Wait for the prompt to restart the computer to appear, then click on Yes.
• After the restart once you are back at your desktop, open MBAM once more.
  

To get the log from Malwarebytes do the following:

• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click Export > From export you have three options:
  
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
    XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
• Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…
  

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• Double click on Adwcleaner.exe to run the tool.
• Click on the Scan in the Actions box
• Please wait fot the scan to finish..
• When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
• Click on the Cleaning box.
• Next click OK on the "Closing Programs" pop up box.
• Click OK on the Information box & again OK to allow the necessary reboot
• After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...
  

 
Next,
 
Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts. (re-enable when done)
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8 or 10; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.
  

 

Next,

 

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

• Quit all running programs.
• For Windows XP, double-click to start.
• For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
• Read and accept the EULA (End User Licene Agreement)
• Click Scan to scan the system.
• When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
• Close the program > Don't Fix anything!
  

 

Post those logs, also give an update on any remaining issues or concerns..

 

Thank you,

 

Kevin

[ithai]

Thanks for the reply. So far, I am up to the Malwarebytes part and the settings were already there. There were no reports of anything negative on my laptop. Should I continue? I don't feel completely safe about downloading more programs.

 

Also, I have CCleaner. It seems as though TFC does the same thing. Should I keep both? One or the other?

[kevinf80]

TFC is a pure temp file and cache cleaner, it does not make any registry changes, CCleaner does both, not an app i`d recommend...

 

If you are satisfied your system is clean and good to go there is no need to download and run any more scans... We can just clean up as follows...

 

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

• 
     
• Remove disinfection tools
  

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

 

Next,

 

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and bst Practices

Do I need a Registry Cleaner?

Let me know if we are ok to close out,

 

Thank you,

 

Kevin..
 

[ithai]

Thanks! I guess we're done here. I really appreciate all your help!

[kevinf80]

Thanks for the reply with kind words, I appreciate such responses....

 

Take care and surf safe
 

Kevin....

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!