Skype Account Hacked

[Ked]

Hi All,

My Skype account was hacked yesterday, many international calls were made and they loaded my account with 30eu of extra credit. Fortunately Skype suspended the account before things got majorly out of control, but the hacker was active in my account for around 8 hours.

Skype refuse any kind of refund in these cases, citing that the probably cause of the hack is an insecure home PC or bad password:

Unfortunately, Skype is unable to refund any money that may have been

lost because of this incident. We urge you to check that your PC?s

security systems are running properly and that they are up to date. In

order to prohibit these incidents, Skype strongly advises you to

regularly update your PC's security software (e.g. firewall, antivirus

etc.) as it is possible that a Trojan/Key logger type of program could

be installed on your computer which sends collected info from your

computer to a third party who uses this information abusively.

I like to think I run a pretty secure setup on my laptop, I use an up to date AVG with nightly scans and windows firewall. I use pretty strong non dictionary passwords with a mixture of alpha numeric characters. So, before I get back to them, I would like to establish whether I really did have some kind of trojan / keylogger infection or if the account was hacked by other means.

To cut to the chase, I ran MBAM, Defogger, DDS and GMER. MBAM flagged the following:

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Fonts\ARIALUNI.exe (Worm.Archive) -> No action taken.

Files Infected:

C:\WINDOWS\Fonts\ARIALUNI.exe (Worm.Archive) -> No action taken.

The other tools didn't flag anything that I didn't recognise as being installed on the system.

This looks like a false positive to me, I can fins no evidence via Google that ARIALUNI.exe is used as an attack vector. Is it being flagged by a generic rule because it has an entry under SharedDLLs in the registry?

Regards,

Ked

[noknojon]

Hello Ked ,Welcome to Malwarebytes.org

We don't work on Malware removal or diagnostics in the general forums. You will need an expert to check your Skype set up -

Please print out, read, and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post. Please be patient as the experts are a bit busy at the moment -

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

Thank You -

EDIT - If you use P2P / torrents (like Pirate Bay etc) , this could also be used as a hacking access point -

[Ked]

Hello Ked ,Welcome to Malwarebytes.org

We don't work on Malware removal or diagnostics in the general forums. You will need an expert to check your Skype set up -

Please print out, read, and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post. Please be patient as the experts are a bit busy at the moment -

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

Thank You -

Thanks for the pointers noknojon

[Firefox]

just to add....

You can submitt the file RIGHT HERE in our false positive section to see if the file indeed is malicious or just a false positive.