Account hijacked 2x in 1 week

What happened:
My hotmail account was hijacked ( this is not a please help me get the password to " blank " account ) - password and secret question changed - after I recently opened it... So, I opened a new account, this one with the answer to the secret question and the personal access data inaccurate so to keep out anyone that knows me personally.... And that account was hijacked also... But this is only in Hotmail.. my other web based email accounts I've had for years are un-molested..
What I have done:
Now I run a stand alone desktop, I live alone, and no-one can have access to my pc without me knowing it, and no-one has for months. There is no way someone can see see my key strokes thru the window, and I do not, and have never kept passwords on a post-it note anywhere, and I always use passwords that have #s,_, etc w/ no personal relevency... If anyone were splicing into my phone line I'd know it.
Now, mentioning key stokes, I use AV and a firewall up-dated almost everyday and run every day. I put the computer down, and in safe-mode ran my just that minute up-dated AV (AVG) on the system... nothing, no loggers, no trojans, back doors, worms, virii, etc.. No alerts from the firewall for known or unknown progs trying to access the internet in anyway ( ZA configured so nothing has permission to connect w/o request )
One potentail weakness I'm aware of is that I use MSN to chat with friends in different countries... However, my AV checks all files DLed this way as soon as they arrive. I only use MSN with my contacts, I never waste time in chat rooms...
I know there used to be progs for brute-force/dictionary attacks on Hotmail, but to my knowledge non of these types of attack is effective since Hotmail, Yahoo and other web-based email carriers implimented the policy of temporary account access disabling after x# of failed password attempts... The only other thing I can think is there is some form of a page redirect tool being used, but wouldn't that still entail access to my IP session(s) while I connected to my account, and thus my other webased email accounts, etc?
So finally, does anyone have an idea how someone could be doing this to me? Have I missed some obvious "Doh!" type of detail here, or is there some new Hotmail (/Yahoo/Aim/ etc) hacker program out there? What havn't I done, what could I do to to prevent this?
TIA, Websword

Well if i read your post right. Your computer is nice and safe so I came up with this very farfetch theory.

DUMB LUCK :D :P

I mean it.

Or (but this is guessing since it's been some time and i don't use hotmail) is it possible that someone saved a page of you in hotmail. I don't know if it work but I tested this with yahoo yust now.

If you open a page that you saved maybe you could bypass the login. I know it worked about a year ago because someone at my school had saved a page on a local disk of one of the public computers. (but this is mostley guesswork though.)

Hve you specifically tried a Spyware detecting application, such as Spybot or AdAware, as opposed to just anti-virus? Sometimes the internet tracking programs are just as bad as a trojan for gathering keystrokes, but are not detected as a virus, i.e. gator, comet cursor. I would also run a "netstat -a" command from your command prompt and inspect what ports are listening and/or have established external connections. If you have any unexpected connections start digging deeper.

Your AV won't be very good at detecting trojans and some other malware. The quick way to determine whether you have some kind of malware/keylogger that would be very difficult to find is to take your firewall and disable the outbound access of ALL programs that you have set on permanently allow. Then as you use the different programs allow access that time only, not permanently. That way, if anything you usually use, (browser, email, messenger etc.), is sneaking out messages behind your back you will get a popup telling you that something is trying to access the internet. Well.... If you aren't initiating the program at that moment it should be the clue you need to track it down. If you can't track it down or mitigate at that point then the old reformat/reinstall would be the next logical step.

Good luck.....

yeah my first thought was keylogger too.. as Tiger said, your firewall should tell you that.

However, I'd really like to see a hijackthis log..
Even though it's primary purpose is to fix hijacked browsers, it also shows entries in the registry of things that startup.. which might be hidden to even your task manager.
I've found a few trojans and wierd things on a few peoples boxes with it..
So if you wouldn't mind, please post a log (or attach it)

http://mjc1.com/mirror/hjt/

Sumdum: The reason I suggested my course of action is because some of the more sophisticated keyloggers are devilishly good at hiding themselves within legitimate processes as an new and hidden thread.

I'm not saying you aren't right with your suggestion, just that the Hijack This could be "beaten" but a process attempting to talk to the "world" is more likely to be intercepted intact..... That's my story and I'm sticking to it... ;)

I hear ya buddy.. it very well might not show up.. then again, it might.
I'm a curious sort of guy.. so I'll throw a few tools at whatever problem I face.
some trojan scanners do an ok job with keyloggers as well.. TDS-3 might catch it.

Just because you have a trojan doesnt mean your AV or Firewall will pick it up, it could be using a common port and maybe a specialy or unknow tojan. Tojans these days can be very undetectable could bind itself to another windows proccess or if you use ntfs file system it could be hiding in an ads

you should try scanning with TDS-3 http://tds.diamondcs.com.au/ got it a few weeks ago, already love it

Hello and thanks all!!!
To respond in order to you all:
Zetaphor and MoonWolf... I'm not sure of a IE exploit/spoof that would get under my rader, and I'm guessing that a saved page would not be enough, I mean does that not also need a cookie/GUId of some sort?
OverdueSpy and Tiger Shark: Well, yes, I have X-Cleaner, SpyBot and AdAware which all get run 1nce a week >< ( I HATE spy/adware ) and they have shown nothing to this date... And I do keep an eye out with netstat, nothing out of sort there. I have always kept *all* progs insystem disabled. Everybody's gotta ask permission to go weewee....

Sumdumguy: Ok, here's the log attached, I'm sure I know just about everything on it.. Although why it says I'm using default options in IE when I'm not... You'll see I've recently visited, count 'em.., 3 online AV scanners.. The Zinio reader is for online magasines I get. The one suspicious entry is the http://httpsinfogateway.com the URl is a blank page, this appears to be a dialer planter.... I'm thinking to delete this unit with extreame predjudice!

OK, ScripterX, I have a trojan finder/remover or 2, but I'll give TDS-3 a spin..

On a final interesting note, last night, ZA asked permission for IE to connect out of the blue.. a close look determined that this was coming out of a port in the low 14000s I didn't catch exactly which one as I was focused on the fact that the process was claiming it self to be MS TV/Vidio connection, which while sounds semi-plausible, I've never seen it nor had it ask for access to the internet prior to that moment, and it wanted to go to IP 3.0.0.2/255.255.255.255...!! WTF is that, some "special" microsoft domain?
Anyway, thanks everyone for all the imput!!

While reading your post i couldn't help to wonder what kind of ISP you are using and what kind of network your sitting on. I know this might be far fetched but could somebody be sniffing your packets. I had a friend working at a BIG ISP and they sometimes during lonely and boring night started sniffing packets and checking what people where doing and you could get a lot of passwords that way.

This is a little far fetched, but with the difficulties you are having compiled with the fact that windows trojans have become better at hiding (where netstat might not be reliable), you might want to try running a port scan from a second system to see what ports your system is listening on from the attackers prospective.

Ah i'd just format the hard drive and to a clean re-install of your Operating System, that way you know for sure that if there was anything on your Hard-Drive, then it will defiantly be gone when you re-install the Os..
Everytime i get paranoid about something, i just do a quick system back up of important files, and then i format the HDisk and re-install everything.
Fine it will take some time to get all your custom setting back into action, but it's worth it, just think Today there screwing with your e-mail accounts, Tomorrow they could be stealing your Identity and ruining your life..

cheers
.:front2back:.

ha... or maybe u just copy some malicious file or batch from friend or school through a floppy, then place it in ur box... end up effected with some stealth program to ur box, perhaps.....

aye

[CAX Object]
InProcServer32 = C:\WINDOWS\OPTIONS\CABS\SYSTEM\CAX.DLL
CODEBASE = http://info.httpsgateway.com/download/dialer/cax.cab

was the only think I saw in there that was goofy, checked it out and found this....

http://securityresponse.symantec.com...dware.cax.html


Not sure if just getting rid of it will fix your email problems, but at least there's one less piece to worry about...

Greg

There are some interesting things on your HT log, but before I say anything in particular, could you please post a regular HijackThis log (not the start-up version)? It reveals a few different things that the startup listing doesn't.

And before you fix anything:

1) Make sure you know what it is..... manythings are important to the functioning of your pc
2) Put HT in it's own folder or the backups will be scattered ... and this could be annoying if you need to redo somethig that you fixed.

:)

TA, All,
As to my ISP, they're a smaller company, and I know the local franchiser/NA real well, and he's for sure got bigger fish to fry than lit'l ol me, if he's into that sort of playing which I highly doubt... Certainly there are a new breed of much more cunning trojans, worms and virii out now and while it is a very small possibility that something came in via a floppy, it *could* have... So I'm taking the paranoid but safe way out: Back up the data and F-Disc.
Meanwhile, 4 other web based email accounts remain unmolested including my MSN as well as my POP mail and all other website accounts.... Still not sure what to make of that since someone sure put the zap on my hotmail... I have alerted all my contacts that were possably able to be emailed from those 2 accounts to beware of any messages from hotmail, especially attachments, but at the same time to save them w/o opening. I hope something may be gleaned from the headers, but I'm not sure how much info passes into a header about whom is connected to the hotmail server and that account.....
Thanks again everybody!!! Websword.

Ok well here goes my 2 cents:
You should do as front2back says and format, after formatting contact hotmail stating that you believe someone has hacked into your account, they will ask for some personal information and if the attacker has not changed any of your personal information then you should have no troubles reseting your password. And if you are using broadband 255.555.555 is your subnet mask and 3.0.0.2 would be your local IP it's an IP only you have access to just like 127.0.0.1 through that IP with the correct password you can configure your broadband connection. Hope this helps

While I'm quite convinced that it might be too late to save the offending drive from the good old fdisk bearing in mind the time the OP last posted.... sorry mate.... busy.... didn't notice your reply.

For future reference to others.....

Overdue: Portscanning a machine to see what ports are listening on a machine potentially infected with a trojan is less useful than it used to be and will become practically useless as time goes on. As firewalls are becoming more widely used the Trojan writers are already aware that listening on a port isn't enough. "Connection shovelling" I believe is the new term where a trojan server makes the initial outbound connection on a common port. On any system this will show _no_ unusual ports listening because the "server" isn't listening - the port appears closed. So the portscan does nothing more than lull the user into a false sense of security.

With firewalls that have egress filtering the trojan will fail the test if it does anything other than disable the firewall when it needs to or rewrites the firewall rules if it can, (your local software firewall, (ZA, Tiny, Kerio etc)), but it will continue to work on corporate firewalls because the firewall itself has no knowledge of the initiating process on the client - "if it's going out on port 80 it's a browser"..... On a machine with local egress filtering the trojan will work just fine if it either it insinuates itself into an acceptable process, (iexplore for example), as a new thread or, if the firewall is sophisticated enough to determine it's actions by "thread within process", (which I don't believe any are at present), then by subverting the entire process in the first place. If either of these can occur then corporate firewalls are useless again because the fact still remains to a corporate firewall "if it's going out on port 80 it's a browser". In the corporate world especially, the firewall will have to be integrated into the entire network, (be aware of every process on every machine and every thread within every process and that the thread itself is legitimate).... Can you say bandwidth and processor time.... ;)

The basis for security, (while allowing for usability), will have to move to the client eventually. Hopefully it will be centralized but it will require even quite small networks to have relatively high bandwidth capability. Then local firewalls, with "thread in process" knowledge _and_ recognition of previously subverted processes, (Tripwire, MD5 checksums on activation etc.), would report to the "perimeter" firewalls and they would accept or deny requests based upon the reported process/thread.... Remember: We can't have the users deciding for themselves what might be good or bad and it is unfair to place that burden on them in the first place.

So..... Don't trust a portscan to tell you if you have a trojan..... It isn't reliable......

That's it in a nutshell..... ;)

Tiger - I agree completely.

My suggestion of an external port scan was prompted by other solutions coming up empty. I view a port scan as a tool to be used when you start running out of options, and upon encountering these type of problems. Like I said, the idea was "far fetched." However, a port scan does not take long and you never know, Websword might have gotten lucky and found an open trojan port listening, thus providing a direction to research.

I will admit though, that I should have put in a caveat stating that a portscan should not be solely depended upon for confirmation of a trojan's presence or lack thereof, and I will make sure I do so in the future if the need for a similar suggestion arises.

Thanks for the heads up.

Overdue: I'm not saying I wouldn't try one myself..... ;) Just that as time goes on we should probably be careful not to put a lot of stead in a "clean" scan.