Have a buddy that asked me to help solve an issue he's been having with his computer(s) and his yahoo email in general... I stopped doing this work years ago, so I just don't know what's out there as far as malware and cleaning software/techniques to be trusted.
He started by texting me asking if I could remove "some mal ware virus" from his computer. He said it was called torpig, and that "It's on everything I have - they said". I asked who "they" was and he said he called yahoo because he can't log into his email.
So I go over and start looking at things. His yahoo account cannot be accessed by any device other than this one laptop he has. Even my own phone, it says the password is incorrect and if I try to reset it, I am given one option - to send an account key to an email address that had belonged to a now deceased family member - it is simply not an option. If I click "I do not have access to this account", yahoo pretty much says "Uh-oh...Looks like we can't recover your account online. " Apparently he has no phone numbers listed, and answered no security questions, although he says he did at one time.
From one of his computers running Windows 7 and Chrome, we can access the account. The password is saved in his Chrome password manager, and when I view it in there, it is exactly the password he told me earlier that is declined on other devices. The account looks normal, he says he's noticed nothing unusual in regards to it, and his online banking etc.
I have a feeling he really might actually have had his account taken over, they have set their own password, and this all possibly works in unison with malware on his laptop to make things look perfectly normal. The machine seems perfectly normal, his updates are current, Windows Defender finds nothing. Obviously, I know these things can be pretty damn clever these days, and purposely work in the background to make everything seem hunky-dory on the surface.
All of the tools I used 10 years ago like Spybot, Adaware, etc look quite commercialized and I'm just not sure they're the real deal anymore.
I'm pretty damn sure the number he called was not actually yahoo, as they told him all of his stuff was infected by "torpig" and that those people had control of his machines and accounts, that there was nothing they could do until things were cleaned. He says they then gave him a handful of recommendations of people/companies/sites or whatever that could clean things. All paid services, and one $300 some bucks. Uhhhh, NO.
Unfortunately, I'm almost afraid to touch the machine and risk locking him out entirely - he'd be pissed even though his current access is likely extremely risky. I think he needs to contact yahoo via a method I've verified first and fix the password properly, and I'll have him do that. But, I'm wondering if you guys think my suspicions that his system is infected and allowing a seemingly flawless access to the account, and what methods I might use to clean it up in the end (I rreeeaaalllyy just want to do a restore, we'll see).
He started by texting me asking if I could remove "some mal ware virus" from his computer. He said it was called torpig, and that "It's on everything I have - they said". I asked who "they" was and he said he called yahoo because he can't log into his email.
So I go over and start looking at things. His yahoo account cannot be accessed by any device other than this one laptop he has. Even my own phone, it says the password is incorrect and if I try to reset it, I am given one option - to send an account key to an email address that had belonged to a now deceased family member - it is simply not an option. If I click "I do not have access to this account", yahoo pretty much says "Uh-oh...Looks like we can't recover your account online. " Apparently he has no phone numbers listed, and answered no security questions, although he says he did at one time.
From one of his computers running Windows 7 and Chrome, we can access the account. The password is saved in his Chrome password manager, and when I view it in there, it is exactly the password he told me earlier that is declined on other devices. The account looks normal, he says he's noticed nothing unusual in regards to it, and his online banking etc.
I have a feeling he really might actually have had his account taken over, they have set their own password, and this all possibly works in unison with malware on his laptop to make things look perfectly normal. The machine seems perfectly normal, his updates are current, Windows Defender finds nothing. Obviously, I know these things can be pretty damn clever these days, and purposely work in the background to make everything seem hunky-dory on the surface.
All of the tools I used 10 years ago like Spybot, Adaware, etc look quite commercialized and I'm just not sure they're the real deal anymore.
I'm pretty damn sure the number he called was not actually yahoo, as they told him all of his stuff was infected by "torpig" and that those people had control of his machines and accounts, that there was nothing they could do until things were cleaned. He says they then gave him a handful of recommendations of people/companies/sites or whatever that could clean things. All paid services, and one $300 some bucks. Uhhhh, NO.
Unfortunately, I'm almost afraid to touch the machine and risk locking him out entirely - he'd be pissed even though his current access is likely extremely risky. I think he needs to contact yahoo via a method I've verified first and fix the password properly, and I'll have him do that. But, I'm wondering if you guys think my suspicions that his system is infected and allowing a seemingly flawless access to the account, and what methods I might use to clean it up in the end (I rreeeaaalllyy just want to do a restore, we'll see).