BleepingComputer.com: Virus may have all my financial info and passwords, now what?

Okay, two days ago, I got the whitesmoke virus plus another one called Antivirus Action now and thought I got rid of them both but now I see something called HDD Repair on my desktop and I think it's a malware HDD Plus type thing. Anyway, all yesterday, my pc was acting funky and it was shutting down unexpectedly and the CPU was running full speed, and Firefox was runny glacially then shutting down. I had to do some banking so I tried to sign on to my bank account and then Firefox would shut down sometimes. Once I was able to get into my account and do some online banking ... so I may have given my password away right there. Ditto for a brokerage account. What should I do now? I'm afraid if I change my passwords, the bad stuff on my computer will swipe them as well. Help!

Anyway, I'm going to post my logs and stuff to the logs forum but until things get straightened ought there, what should I do about my passwords and all other manner of other financial info that's on my pc?

Is it possible that Firefox and the rest of my system was so crashy and messy because someone or something was stealing info while I was trying to do stuff at the same time?

Arggg!

Oh, one more thing: I havee a second computer at my house, too, and it's been acting slow and funky too, though not as bad as the one i'm on now, and they both started acting up at the same time. Coincidence? or not?

This post has been edited by linter: 10 December 2010 - 07:47 AM

Hello, here's the best advice.
These infections can allow an attacker to
gain control of the system, log keystrokes, steal passwords, access personal
data, send malevolent outgoing traffic, and close the security warning
messages displayed by some anti-virus and security programs.


I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall


We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

The only other way to remove this is by using this process and it willl take several days.

Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

This post has been edited by boopme: 10 December 2010 - 12:49 PM

well, i want a new laptop anyway, so i might as well go buy one and then clean this one up and leave all important info off. you've scared the trousers off of me, but once i get em back on, it's off to staples I go ...

thanks!

btw/ i did post everyone on the other forum ... haven't heard anything back yet ...

Now that your log is properly posted and replied to; you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.