MSN Messenger hijacked - Please help - [FIXED]

Hi everyone, I'm new on here, but I am a bit of a loss what to do next. Here's the problem:

My girlfriend's son's messenger account is being hijacked ( we suspect by someone else from his school given the content of the messages sent by the hacker posing as her son). Simply put when he goes online, within seconds he is logged out and when he tries to go back in it says he is logged on another computer, then his password gets reset. Vile and disgusting messages are sent to the other contacts on his list as if they were from him. More over we have gone on and ‘chatted’ with the hacker who is pretending to be him, when we say that we know it is not her son the hacker becomes abusive writing thoroughly disgusting messages about my girlfriend. He has gone back in and changed his password three times to random sequences of letters and numbers and still within minutes he has been logged out again. He even tried creating a new messenger account and it happened with that to (which I presume suggests it is one of his contacts). It is the Messenger 7.5 with Windows XP Service pack 2 (all updates applied and up to date). They have up to date antivirus software in the form of PC-Cillin with it's own personal firewall. This has detected nothing.

I ran panda activescan and apart from a few cookies it only came up with two other forms of adware :

Adware:adware/oemji in the registry
Adware:Adware/WinTools C:\WINDOWS\system32\grwinsthlp.exe

Also ran hijack this and tried to put log in here, but said message too long.

Can anyone please help? Firstly to secure the machine and his account to stop this happening and secnodly is it possible to find out who is doing it?

Many thanks in advance.

here is the hijackthis log:

Edit: log put into notepad and attached (Rev)

grwinsthlp.exe is a trojan.

Install and run Spybot Search & Destroy and AdAware (make sure you update the definitions first before running them)

Also you need to remove WinTools. Details here

Also check out Egghead's Spyware removal thread

I have found that Xoftspy works indescribably well. Takes care of most of my problems. Just wanted to give you my two cents.

Many thanks Reverend, I will do as requested and hope that this solves the problem. I will report back.

Also is there any way of definitely proving who the hijacker is? I am 99% sure of who it is, but have no concrete evidence.

Many thanks for your two cents Angelcry, although I had already tried Xoftspy. Thanks anyway, answers always appreciated.

Quote:

---

Originally Posted by wexfordalty

Also is there any way of definitely proving who the hijacker is? I am 99% sure of who it is, but have no concrete evidence.

---

If you have any conversations with him try and trick him into revealing his identity. You only need him to make a small slip up and then you will have enough evidence in the "saved" conversation. You can pass that info onto MSN.

My prefered option though would be to pay him a personal visit and enquire as to whether his dental insurance is up to date. ;) :boxer:

Quote:

---

Originally Posted by Reverend

My prefered option though would be to pay him a personal visit and enquire as to whether his dental insurance is up to date. ;) :boxer:

---

:eek:





:rolleyes:

this is a little scary... Let us know how u go... delete the trojan!! Then reset password, hopefully there is no password stealer!

And you can track the fellows ip address. That should tell you where he/she is or where about this person may be. You need to get a chat going with him though. Try this site. http://www.abika.com/Reports/verifyemail.htm. Hope that helps. Oh' and im just wondering have you tried the free version of AVG? It may sound strange but that fixed my computer after a major virus. When all others failed on me.

Quote:

---

Oh' and im just wondering have you tried the free version of AVG? It may sound strange but that fixed my computer after a major virus. When all others failed on me.

---

I'll second that. It picked up a backdoor.optix (?) trojan when Norton died on me.

Quote:

---

Originally Posted by Reverend

You can pass that info onto MSN.

---

Already had much contact with them and found them to be about as much use as a chocolate teapot.

Quote:

---

Originally Posted by Reverend

My prefered option though would be to pay him a personal visit and enquire as to whether his dental insurance is up to date. ;) :boxer:

---

LOL. Yeah, not an option though we are talkin about a schoolkid here.

Quote:

---

Originally Posted by cash_site

this is a little scary... Let us know how u go... delete the trojan!! Then reset password, hopefully there is no password stealer!

---

Will let you know. There must be a password stealer given the number of changes made and the speed with which it is hacked each time.

Quote:

---

Originally Posted by AngelCry

And you can track the fellows ip address. That should tell you where he/she is or where about this person may be. You need to get a chat going with him though. Try this site. http://www.abika.com/Reports/verifyemail.htm. Hope that helps. Oh' and im just wondering have you tried the free version of AVG? It may sound strange but that fixed my computer after a major virus. When all others failed on me.

---

Thanks for that will try the search and AVG. First want to try and track if possible.

Also check for a Keylooger. As you said the speed which it was accomplished leads me to believe that the culprit has an "inside" to your system.

Quote:

---

Originally Posted by rik

Also check for a Keylooger. As you said the speed which it was accomplished leads me to believe that the culprit has an "inside" to your system.

---

Ah ha....Miss Scarlet, with a wrench in the Library.....lol.....gotta luv a mystery.:D ......only the nose knows....:p......I like Revs idea..:boxer:

Just to keep you updated. She is trying to get some evidence with which to nail the little **at before I attempt clean the PC for her (probably tomorrow).

Hi all,

Just to keep you all informed. Couldn't really get any hard evidence on culprit, but enough circumstantial to speak to his parents and say that we were not 100% sure, but were thinking of going to police with it (think this may have done the job).

Have cleaned machine as per all suggestions and the problem has not re-occurred since, so fingers crossed.

Many thanks again for all of your help and suggestions.

In all honesty I would probably still suggest a clean OS install just to be sure no keyloggers or trojans are on the system.

Short of your kid giving out the usernames and passwords, I know of no other way this could happen.

Sorry for delay in response, but have been away for past week. Still no further problems to report. However, he definitely did not give out the passwords and you may well be correct, so I think I will probably do a clean OS install anyway (just to be on the safe side). Thanks again for your help.