Gmail account breached through suspicious app on computer

[Orlin5300]

Hello, today at 8:37PM my gmail account was breached and then I was told by gmail that I got signed out in order to be protected because a malicious app in my device has led to the breach of my account. 

Image: https://imgur.com/a/4ZS4A2N

[kevinf80]

Hello Orlin5300, Lets grab some logs and see whats going on, continue with the following: If you do not have Malwarebytes installed do the following: Download Malwarebytes version 4 from the following link: https://www.malwarebytes.com/mwb-download/thankyou/ Double click on the installer and follow the prompts. When the install completes or Malwarebytes is already installed do the following: Open Malwarebytes, select > small cog wheel top right hand corner, that will open "settings" from there select "Security" tab. Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Close out the settings window, this will take you back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes quarantine any found entries... To get the log from Malwarebytes do the following:   Open Malwarebytes Click on the Detection History tab > from main interface. Then click on "History" that will open to a historical list Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options: Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply   Please use "Text file (*.txt), then name the file and save to a place of choice, recommend "Desktop" then attach to reply Next, Download AdwCleaner by Malwarebytes onto your Desktop. Or from this Mirror   Right-click on AdwCleaner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users) Accept the EULA (I accept), then click on Scan Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Quarantine button. This will kill all the active processes Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status... If English is not your primary language Right click on FRST/FRST64 and rename FRSTEnglish/FRST64English   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans"   Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Let me see those logs in your reply... If our tools do not run because of windows smart screen or your security, consider the following: Disable smart screen if it interferes with software we may have to use: https://support.microsoft.com/en-us/microsoft-edge/what-is-smartscreen-and-how-can-it-help-protect-me-1c9a874a-6826-be5e-45b1-67fa445a74c8 Please remember to enable when we are finished.... Next, Disable any Anti-virus software you have installed if it stops software we may use from working: https://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/ Please remember to enable AV software when we are finished running scans.... Thank you, Kevin....

 

[Orlin5300]

Here you go, please tell me if anything is not there.

FRST.txt Addition.txt AdwCleaner[C00].txt malww.txt

[kevinf80]

Have you set the following tasks:

Task: {78C277E0-BE71-4009-8A54-359FB46C19DF} - System32\Tasks\stop => shutdown /s /f /t 0
Task: {BCD43129-79AA-4316-9506-2AD22673CAE9} - System32\Tasks\Shutdown => shutdown /s /f /t 0

[Orlin5300]

Yes that's me, I did that earlier this year in order for the pc to shut it self down after a specific time on it's own.

[kevinf80]

Hello Orlin5300, Thanks for that update, continue: Uninstall the following outdated versions of Java... Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle) Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle) Next, Turn of SandboxieControl... Next, Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from. NOTE. It's important that both files, FRST or FRSTEnglish, and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone. Run FRST or FRST64 and press the Fix button just once and wait. If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart. The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply. Note: If the tool warned you about an outdated version please download and run the updated version. NOTE-1: This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The following directories are emptied:   Windows Temp Users Temp folders Edge, IE, FF, Chrome and Opera caches, HTML5 storages, Cookies and History Recently opened files cache Flash Player cache Java cache Steam HTML cache Explorer thumbnail and icon cache BITS transfer queue (qmgr*.dat files) Recycle Bin Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix. The system will be rebooted after the fix has run. Next, Download "Microsoft's Safety Scanner" and save direct to the desktop Ensure to get the correct version for your system.... https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download Right click on the Tool, select Run as Administrator the tool will expand to the options Window In the "Scan Type" window, select Full Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\msert.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time... Let me see those logs in your reply... Thank you, Kevin.

 

fixlist.txt

[Orlin5300]

Here you go. Thanks.

 

 

msert.log

[kevinf80]

Can I see the log from FRST fix..?

[Orlin5300]

Here you go

Fixlog.txt

[kevinf80]

How does your system respond now, any remaining issues or concerns..?

[Orlin5300]

Well my system was doing fine since the start, however now I assume most of the possible threats/malicious stuff that might have led to my gmail being hacked are dealt with. However, I still want to ask you what procedures should I follow if my account is hacked and I can't access it in any shape or form?

[Orlin5300]

This is what I get :

https://imgur.com/VBDS4tc

Then this :

https://imgur.com/NbqJwbN

Edited August 18, 2021 by Orlin5300

[kevinf80]

Can you access your account from a different PC or a smart phone, then changing the password should help. When you`ve done that try again on this PC that you are replying from...

Maybe a good idea to uninstall anything related to P2P, uTorrent etc.. Also do not try to access Google accounts through a VPN if you still have issues signing in...

[Orlin5300]

Still get the same message, very weird although there is a 90% chance it got hacked since the password is changed, I just tried with my phone on 2 different net connections but got the same answer.

[kevinf80]

Thanks for the update, try the following:

Open an elevated command prompt, at the prompt copy/paste or type net user administrator /active:yes select enter.

reboot when that is compete...

That cmd activates the hidden admin account, when you reboot that accoun should be available to you... Can you access your Google account from there...?

If that fails open an elevated command prompt again, run this command:

net user administrator /active:no

Reboot to close that account....

Next,

Try to access Google account from Clean Boot mode, full instructions at the following link:

https://support.microsoft.com/en-gb/kb/929135   Thanks....

 

[Orlin5300]

Well I tried that, but it didn't work. However I wanna ask you, are you sure there wasn't a keylogger present in my pc? Because it was very weird how my gmail got hacked, and since I'm considering getting that account back on my own ( kali ), I want to know if I still have any spywares/RATs in my pc.

Edited August 19, 2021 by Orlin5300

[kevinf80]

Run the following please:

Please download the correct portable version (32-bit or 64-bit) of RogueKiller for your system and save the file to your computer Desktop. https://www.techspot.com/downloads/5562-roguekiller.html https://m.majorgeeks.com/files/details/roguekiller.html   Right-click on the RogueKiller file and select Run as administrator to start the tool. Click Yes to accept the UAC security warning that may appear. Click Accept to agree with the EULA (End User License Agreement) and close the browser tab it will open. Now click the Scan blue button and under the Standard Scan (recommended) click on the Scan button. When the scan is complete, click on Report button. NOTE: DO NOT delete any found entries. All listed entries will be carefully analyzed. Then click on Report button. Click Export button and select "Text file". Give a name to the file such as RKlog.txt and save it to the Desktop or in a location where you can easily find it. Click the Finish button and close RogueKiller window. Copy and paste the entire contents of that log into your next reply.

[Orlin5300]

Done.

RKlog.txt

[kevinf80]

Can you run RogueKiller again, this time select and remove all found entries.... See if that makes any difference.

[Orlin5300]

Hopefully. I'm assuming you did your best to help me, thanks for that!

RKLog.txt

[kevinf80]

Do you have access to your gmail account..?

[Orlin5300]

Still get the same answer on my gmail account, tried everything with no success.

[kevinf80]

I half expected that reply.. I see from FRST logs that your default browser is Firefox, as the current issue is with your gmail account I did expect Google Chrome to be your access point. 

Can you confirm which browser you use to access or try to access your gmail account...

[Orlin5300]

Well I've been using Firefox for the past year n a half but I just tried chrome and the problem seems to be consistent.

[kevinf80]

Hiya Orlin5300,

Thanks for the update, just found some advice which has worked on similar situations to yourself. Try through firefox..

The following quote is advice given by KeithR (The Sweeper) at GMail help;

Please check for access to your account as follows.  Hopefully you might find the culprit in the records.  Note that a "suspicious app" might be a perfectly acceptable app that is accessing your account from an unusual location or a relatively harmless app that hasn't yet met Google's current security standards.

 

Direct access to Gmail: Click on Details under Last account activity at the bottom right of the Gmail page.

 

General access to your account: open https://myaccount.google.com/security#activity then go to step 4 or, in Gmail, follow the steps from 1.

1. Click on your avatar at the top right of the page
2. Click on Manage your Google Account
3. Click on Security
4. Scroll down to Recent security events and click on Review events
5. Click on any event to see more detail and take any recommended action
6. Click on the back arrow just left of "Recent security events"
7. Scroll down to Your devices, then click on Manage devices
8. Click on the pane for any event to see more detail including a REMOVE button (this will not appear if the device is not still connected to your account)
9. Click on REMOVE if the device is not yours
10. Click on the back arrow just left of Your devices
11. Click on Manage third party access to the right
12. Click on the pane for any app that you don’t recognise to see more detail including a REMOVE ACCESS button.  The entry will disappear immediately.
13. Close the tab when complete

If you find and remove any unrecognised connections, then make your account secure by working through the security checklists at https://myaccount.google.com/security-checkup and at http://gmailaccountrecovery.blogspot.com/#security.

 

When using your account on a shared computer, always make sure that the browser is not saving your password and always sign out at the end of your session, do not just close the browser.

Let me know if that information helps...

Thank you,

Kevin.