-1

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in Italy).

Then I looked for the access history and found out that 67.221.255.65 (which I think is a proxy, maybe related to some of my VPN?) tried to access my account, but had been blocked because it's not one of my usual location. I found out that some program exported my Chrome cookies and maybe sent them somewhere. I was using Kaspersky Internet Security, but it did not notice anything when I downloaded and installed the infected file and maybe I (stupid) granted the virus internet access through KIS Firewall. Then I ran a scan with Malwarebytes and it found the virus and deleted it. Subsequently I also used Combofix, Microsoft Malware Remover, ADWCleaner, HouseCall, Clamwin and HiJackThis just to be sure everything was ok. Later I got again to the Google access history and the suspect access log was gone along with the above-mentioned IP, but I kept it (in https://security.google.com/settings/security/activity it does not show any access log before 26th of may, but maybe they get deleted after some time. The suspect access happened on 29th of april. It says "Sign-in events unavailable prior to this date. Other activity below." (such as password change...)).

The virus created a registry key which launched it at startup and it was hidden in appdata; after Malwarebytes's scan both registry key and files in appdata were gone. But now sometimes I got a notify in Chrome asking me if I want to use google.tr instead of google.it (I don't remember if this happened also before I got infected); it's weird because the attacker location was Turkey (.tr is the turkish domain).

Today it asked me if I wanted to used google.pk .Sometimes I use a proxy (chrome extension) called Zenmate, but it does not use turkish or pakistan IPs. I did not notice any suspect activity in my PC or in my accounts (actually, when I download stuff and look at the network monitor, the download speed counter raises, but also the upload counter raises; I think it's normal, because I use NetSpeedMonitor to monitor network activity and it shows high upload speed, but when I use Windows Resource Monitor, I don't see a so high upload speed in the Net Tab).

Lastly, today I tried to exit from my Google account and got a weird message, it said somethign like: "We are sorry. Since you were connected to different Google services, we were not able to completely disconnect you. You are still connected to the services in the following domains. If you want we to continue trying to disconnect you from these domains, click on the "try again" button". So I clicked that button but I got an error message (this service is not available at this time...).

So I think someone stole my cookies and is using my account, though I changed my password after deleting the virus, but maybe the cookies aren't voided yet. How can I void them? Why does google say that I don't have contemporary accesses in my account, but when I try to disconnect it says I'm connected to different services?

Am I still infected? Is someone using my account? What can I do? What does the post-logout message mean?

Hope you will understand my twisted english and have the patience to read my long post. I am on Windows 7, Chrome 35, KIS 2014.

Thank you in advance.

  • 1
    Find the cookie monster and ask for them back? – AJ Henderson Jun 19 '14 at 14:02
  • @AJHenderson : LOL – Abbas Javan Jafari Jun 19 '14 at 15:16
5

A cookie is tied to your session, so you need to make sure all your login sessions are invalidated (generally, log out). If you are having a problem invalidating your sessions, then you will need to contact the particular website for support as how to invalidate sessions on every website you may have been logged in is far too broad.

I also recommend you follow best practice and nuke it from orbit. If you system has been compromised, it is no longer your system. You don't know what hooks they may have made in to your computer. Backup any data that you need carefully, format the system and reinstall from scratch. That way you can be sure to have removed any infections left by the attacker.

  • The problem is I can't contact Google directly and I can't be sure all sessions are invalidated, in fact when I logged out it said I was connected to google services in Google.tr, but in the log-in activities there's no trace of this turkish login. However should the button in the window opened by clicking on the "details" link, at the bottom of the gmail page, be enough to log out the attacker from my account? Thank you – Krusty Jun 19 '14 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.