Help !! I Got Scammed

[888]

Guys, my moneybookers account just got scammed. All my hard earned $285 AUD is gone now !!!

Do you guys still remember when Carl account got hacked and we all received a PM saying :

Hey, Ross, ive deleted that post, don't worry. I agree with you, aliando should be removed from moderator list, but you are administrator, so only you can do that. I got what you asked for. Heres the download link ;
Let me know when you download it, so i can delete it, someone could accidentally find it.
P.S.
I didn't change login details for Bet365 affiliate, actually old pass works fine for me.. Take care, Carl

I stupidly opened that, and when I see a screenshot file I thought it was some kind of porn or something since Carl is known for one I think. However, after reading an announcement thread about it, I realised its a hacking tools. I formatted my computer straight away. However, thinking that I was safe, I was damn wrong. Just 8 hours ago or so I noticed my account balance on all my moneybookers has GONE. F*CKING CNUT

THE F*CKER EMAIL IS : "gazabroad@yahoo.co.uk"

I'm lodging a report to moneybookers now. Can any1 assists me and point me where is the thread that make this announcement. As I need to prove it to them. HELPPPPPP, any1 in similar situation before ?? Whats my option on recovering my money ? Is it mission impossible ?

[devil tish]

888

the same guy tried to scam me as well m8. i got same file clicked it, went away for a week and when i got back, the guy had got into my ebay/paypal/email and pl. tried to scam my credit card for thousands, luckily for me paypal froze my a/c as the ip address trying to access it was from serbia. silly me had the same pwd for all my stuff doh!.

i did same and ran a reload windows cd, so everything went back to factory settings and ran all spyware/anti-virus etc.


dunno how you are gonna get it back tho, best of luck

mods i suggest you take the link out of post 1, it is a nasty little program that i wouldn't wish on anyone........


tish

[888]

Cheers, for the info. Lucky the f*cker can't access my bank account since it have anti key-logger protection in it. Now I have it suspended. Lucky all the balance was still there. I guess I won't be on the internet for a while. Its only a few hundreds, but still it scare the shit out of me. Never happened before. I lost my primary email accounts too, he had changed the password. I was not quick enough. F*CK !!! Maybe now I will just stick with the good old local wagering where I get a coupon for sh*t odds too

[888]

I have taken out the link mate. Tried it before, it doesnt work anymore. But yeah I'll just remove it for the sake of it. Thx for reminding me.

[aliando]

sorry to hear this

we'll let paul ross know asap mate





has anyone else downloaded this file?

[devil tish]

Change of email address request was made from:
IP Address: 89.146.185.14
ISP Host: 10.11.64.253
Thank you,
eBay

this was the guy's ip address, if you tracert it, it is in serbia. can anyone in the know do anything with this???????????

tish

[Paul Ross]

It won't be his real IP.

Anyway, people just need to not open any attachments unless they are sure it's ok and these things won't happen.

I've done what I can for 888 and what appears to be gazabroad too. We'll see what happens tomorrow.

[pablo74]

Hi all,
I got the same mail a month ago and clicked on the links.
So far nothing has happened to be but how can i prevent anything from happening in the future. I also have paypal, ebay, bank etc accounts on my computer. COuld he strike for my accounts at any time ?
Appollo

[888]

Originally Posted by Paul Ross

It won't be his real IP.

Anyway, people just need to not open any attachments unless they are sure it's ok and these things won't happen.

I've done what I can for 888 and what appears to be gazabroad too. We'll see what happens tomorrow.

I think Gazbroad is in real danger. If my memory serves me right. Moneybookers can only be withdrawn to the bank account that the owner points to. The fker has attempted to login to my bank account before, luckily he was unsuccesful. And I suspect that he might have control of gaz's bank account. Thats why he was withdrawing my money to gaz's moenybookers account which then later followed by withdrawing all gaz's moneybookers balance to gaz's bank and then transfer it to him.

For appollo. My best suggestion is suspend all your account asap, get the money out ASAP. Then format your computer. Yes, don't bother trying to find any antivirus that can get rid of the pest. Format is the only way to go. I hope you do it quick, before the fker can take advantage. Change all ur email password asap too. But make sure when you are changing your password, you are changing it via different computer. Like friends or family. Dont use ur computer, because I think he log everything that u have typed.

[The Insider]

I'm sorry for you 888.

Apollo, do what 888 adviced. I'm sure he is waiting for the correct moment to attack you as well.

[Carl]

No trojan programme or anti virus will get rid of this, it works using NETBIOS.
You've to disable it, thats how the hacker got into 'We think my pc' but most peoples are 'open to this attack'
Im still not convinced it was my machine that was hack but we'll never know TBH but it was my PL account that was hacked.

Anyway here you are to disable the NETBIOS.

Goto control panel
open network connections
and select properties of your default connection (your Lan network)
in general tab you should see "tcp IP protocol (TCP/IP) installed"
click on it and go to properties
click advance button near the bottom
select "WINS"
you should select "Disable NetBios over TCP/ip"

[Paul Ross]

Originally Posted by appollo_10

Hi all,
I got the same mail a month ago and clicked on the links.
So far nothing has happened to be but how can i prevent anything from happening in the future. I also have paypal, ebay, bank etc accounts on my computer. COuld he strike for my accounts at any time ?
Appollo

NEVER, NEVER, NEVER, open attachments that you don't 100% trust.

You need to format your hard drive, set up a new email account at hotmail that you have never used before, then proceed to change all your passwords on every account you have, from that email address only.

Originally Posted by 888

I think Gazbroad is in real danger. If my memory serves me right. Moneybookers can only be withdrawn to the bank account that the owner points to. The fker has attempted to login to my bank account before, luckily he was unsuccesful. And I suspect that he might have control of gaz's bank account. Thats why he was withdrawing my money to gaz's moenybookers account which then later followed by withdrawing all gaz's moneybookers balance to gaz's bank and then transfer it to him.

For appollo. My best suggestion is suspend all your account asap, get the money out ASAP. Then format your computer. Yes, don't bother trying to find any antivirus that can get rid of the pest. Format is the only way to go. I hope you do it quick, before the fker can take advantage. Change all ur email password asap too. But make sure when you are changing your password, you are changing it via different computer. Like friends or family. Dont use ur computer, because I think he log everything that u have typed.

I spoke to gazabroad, he's aware of the situation.

Originally Posted by Carl

No trojan programme or anti virus will get rid of this, it works using NETBIOS.
You've to disable it, thats how the hacker got into 'We think my pc' but most peoples are 'open to this attack'
Im still not convinced it was my machine that was hack but we'll never know TBH but it was my PL account that was hacked.

Anyway here you are to disable the NETBIOS.

Goto control panel
open network connections
and select properties of your default connection (your Lan network)
in general tab you should see "tcp IP protocol (TCP/IP) installed"
click on it and go to properties
click advance button near the bottom
select "WINS"
you should select "Disable NetBios over TCP/ip"

I've since found out it probably wasn't using netbios, so I wouldn't even bother doing that, Netbios was a loophole Microsoft closed quite a while ago.

[TheBoyRooney]

Ive changed all most of my passwords now from another computer..and will format my home one ASAP....

Can someone explain to me how the hacker accesses ur computer..is it when u dont use it,when you are using it?? How does he not the passwords etc??

sorry for sounding dumb

[Carl]

IF it was done by Netbios then just google "Netbios hack"
theres plenty of info on the net.

but if Pauls been told that this wasnt the way in than I dunno how he did it as my PC is firewalled up to the arse and Ive never had any problems in the past from hacks etc.

[Trilobite]

Originally Posted by TheBoyRooney

Ive changed all most of my passwords now from another computer..and will format my home one ASAP....

Can someone explain to me how the hacker accesses ur computer..is it when u don't use it,when you are using it?? How does he not the passwords etc??

sorry for sounding dumb

Basically,

The Virus/Trojan is a program like any other, only it is installed without you knowing, and it is running from start-up without you knowing.

If its a key logger it will record every time you press a key on your keyboard and any websites you visit etc and so will record any passwords you might have typed.

Then it will try various ways of sending the details to a website/e-mail address.

To get by any firewall it will sit and wait till you use your legit mail client and hook into it , some even try to disable the firewall !



If you can remember a longish (16 long ) number for your passwords then it would be wise to get into the habit of inputting the second half of the password first, then with your mouse click at the beginning of the text you have just typed, and then type in the first part of the password.

This method will mess up the Key-logger Virus/Trojan function, as the little chav that receives your password wont know from the key-logging text that it is the wrong password as he will see it as second half of password as the first half.

In fact he will try to use it and when it doesn't work he will think you have changed it already and will move on to the next infected person .


If the Trojan is a client/server type then the chav can sit at his pc and see everything on YOUR pc just as though he was in the room with you !

Get a dedicated Trojan Monitor/Scanner AND a Virus Monitor/Scanner, and keep the database/definitions upto date, as they can only detect what they know about !

And a good Firewall.

[Paul Ross]

Originally Posted by Trilobite

Basically,

The Virus/Trojan is a program like any other, only it is installed without you knowing, and it is running from start-up without you knowing.

If its a key logger it will record every time you press a key on your keyboard and any websites you visit etc and so will record any passwords you might have typed.

Then it will try various ways of sending the details to a website/e-mail address.

To get by any firewall it will sit and wait till you use your legit mail client and hook into it , some even try to disable the firewall !



If you can remember a longish (16 long ) number for your passwords then it would be wise to get into the habit of inputting the second half of the password first, then with your mouse click at the beginning of the text you have just typed, and then type in the first part of the password.

This method will mess up the Key-logger Virus/Trojan function, as the little chav that receives your password wont know from the key-logging text that it is the wrong password as he will see it as second half of password as the first half.

In fact he will try to use it and when it doesn't work he will think you have changed it already and will move on to the next infected person .


If the Trojan is a client/server type then the chav can sit at his pc and see everything on YOUR pc just as though he was in the room with you !

Get a dedicated Trojan Monitor/Scanner AND a Virus Monitor/Scanner, and keep the database/definitions upto date, as they can only detect what they know about !

And a good Firewall.

Great post, thanks.

[Trilobite]

Something quick for all to check if any vulnerable ports are open (no firewall blocking them) is Shields-up here:

https://www.grc.com/x/ne.dll?bh0bkyd2

[pablo74]

Hi all,
I found that link on another forum ( not as good a forum as PLF of course ) and ran it.
Results came back saying that my computer was running in full stelth.
exact readings was.....

Attempting connection to your computer. . . Shields UP! is now attempting to contact the Hidden Internet Server within your PC. It is likely that no one has told you that your own personal computer may now be functioning as an Internet Server with neither your knowledge nor your permission. And that it may be serving up all or many of your personal files for reading, writing, modification and even deletion by anyone, anywhere, on the Internet!

Your Internet port 139 does not appear to exist! One or more ports on this system are operating in FULL STEALTH MODE! Standard Internet behavior requires port connection attempts to be answered with a success or refusal response. Therefore, only an attempt to connect to a nonexistent computer results in no response of either kind. But YOUR computer has DELIBERATELY CHOSEN NOT TO RESPOND (that's very cool!) which represents advanced computer and port stealthing capabilities. A machine configured in this fashion is well hardened to Internet NetBIOS attack and intrusion.

Unable to connect with NetBIOS to your computer. All attempts to get any information from your computer have FAILED. (This is very uncommon for a Windows networking-based PC.) Relative to vulnerabilities from Windows networking, this computer appears to be VERY SECURE since it is NOT exposing ANY of its internal NetBIOS networking protocol over the Internet.

.
Appollo_10