Please Help

[carnageX]

This is the only way I know how to upload this file to look at the properties. Im not using lastpass, but I can delete webroot.

Not the correct file - it should be a .LNK file (a shortcut link, basically).

Find the .LNK file I mentioned, and just take a screenshot of the Properties window, and then upload those screenshots to somewhere like Imgur or attach them to a new post.

I would delete LP - them password managers suck. only need to hit that one place and BOOM , access to everything!!

I thought the same until I actually started using LastPass because I could never remember all of the varying requirements of passwords (and I don't necessarily have a consistent system). I always had to reset passwords for things I rarely used. My wife is the same way; so I made an account for me and had her make an account as well, just made us make strong passphrases (not just passwords).

Just create a few passwords with first letter of word and a few numbers...

This requirement can vary among systems. Some require punctuation (and only certain punctuation works sometimes) - oh crap, was it a period or an exclamation mark that I added to that password!

 

[1etherer]

we use LP at work (sec dept demand we use it) but my whole team is against it lol

I understand its useful but such a single point of attack which can then breach all systems, just personally hate the idea...

 

[jman1972]

I found the file and clicked on properties and it said it was an invalid shortcut and when I excited it deleted. I took a couple of pictures of it but the only tab that would open was the shortcut tab. all the other tabs said C\users\duham\appdata\local\3c48d5\7dbad9.bat specified in the target section is not valid, make sure the path and file name are correct.
Under the shortcut tab ln properties at the top was the file 6b6bb6, it was a windows batch file with the target location 3c48d5.

 

[carnageX]

Yeah there was some nasty hiding out.

Can you run HJT again for me, so I can see if that entry is gone or if it's still there?

 

[jman1972]

Here is the followup Highjackthis file.

 

[carnageX]

Ok, go ahead and run HJT again, and then when finished, place a checkmark next to the entry:
O4 - HKCU\..\Run: [] "C:\Users\duham\AppData\Local\3c48d5\6b6bb6.lnk"

Then click the "Fix selected" button.

After that, I would also suggest running AdwCleaner once more.

 

[jman1972]

So after everything that has happened, I was forced to change banks because my bank would no longer allow me to dispute the charges. So I got the new bank and the first time I entered my debit card online it happened again 14 charges to Square. The only thing different was I didn't use my laptop I used my ipad and it was on QVC.com which is a very secure website. I called my internet provider and they said it in no way could be my network, which I believe is mistaken, Is there a way that my network could be affected since my ipad will only connect to my wifi. I have changed wifi password and I have the log in for my router. I need help.

 

[carnageX]

Well that's really odd...

Good that you changed your wifi password & admin login for the actual router - was going to suggest that.

Is it possible that you've had your identity stolen?

 

[jman1972]

Im not sure about my identity. It just really frustrates me that this is happening.

 

[1etherer]

Is it possible that you've had your identity stolen?

+1 to this......