My Last Few Days Watching my Computer

So it started when I woke up and my Windows 8.1 was in Tablet mode. I don't have a tablet. I didn't even know there was a tablet mode.

So I had to google and find out about it to get my Windows back to the way it should be.

I went to Windows 10, and about 6 months later the same thing happens.

This time I knew what was the problem. But I didn't know why it happened two times.

I did more google searches about things.

Then I learned someone could be using my computer.

I found out someone was accessing my Yahoo account then, quite by accident. I was up in the middle of the night, around 3 am. And saw 5 charges of $1999 each to Sony Playstation for a game about Forza, or something like that.

I thought that the person ordering entered the wrong email address. Until I woke the next morning and found all of the emails about the Playstation deleted. They were no longer there. I knew right away something was wrong. And look at account history and found that two devices connected from Taiwan.

I deleted my Yahoo account and created a gmail account.

A couple of days ago I read that all of the Yahoo accounts had been comprised, and had been sold on the deep/dark web.

I learned that people will install vpns (virtual private networks) on your computer when they hack you. And to find out about it to look at your Firewall. I opened my Windows Firewall and had 3 or 4 vpns active that I had never seen or heard of before. And even something in all chinese or something like it.

I reinstalled Windows 10 fresh. And did the update. And downloaded TCPview. That shows all traffic going to and from my computer, I think.

Anyway i got the knew Windows 10 update, which was a fresh windows install, and also was watching TCPView.

This morning I awoke to an IP adress, I will not post here. But it belonged to Bill Blackwater. And when he saw, or they saw I saw them my internet disconnected.

originally posted by: GailNot
So it started when I woke up and my Windows 8.1 was in Tablet mode. I don't have a tablet. I didn't even know there was a tablet mode.

So I had to google and find out about it to get my Windows back to the way it should be.

I went to Windows 10, and about 6 months later the same thing happens.

This time I knew what was the problem. But I didn't know why it happened two times.

I did more google searches about things.

Then I learned someone could be using my computer.

I found out someone was accessing my Yahoo account then, quite by accident. I was up in the middle of the night, around 3 am. And saw 5 charges of $1999 each to Sony Playstation for a game about Forza, or something like that.

I thought that the person ordering entered the wrong email address. Until I woke the next morning and found all of the emails about the Playstation deleted. They were no longer there. I knew right away something was wrong. And look at account history and found that two devices connected from Taiwan.

I deleted my Yahoo account and created a gmail account.

A couple of days ago I read that all of the Yahoo accounts had been comprised, and had been sold on the deep/dark web.

I learned that people will install vpns (virtual private networks) on your computer when they hack you. And to find out about it to look at your Firewall. I opened my Windows Firewall and had 3 or 4 vpns active that I had never seen or heard of before. And even something in all chinese or something like it.

I reinstalled Windows 10 fresh. And did the update. And downloaded TCPview. That shows all traffic going to and from my computer, I think.

Anyway i got the knew Windows 10 update, which was a fresh windows install, and also was watching TCPView.

This morning I awoke to an IP adress, I will not post here. But it belonged to Bill Blackwater. And when he saw, or they saw I saw them my internet disconnected.

Disconnect the computer and see if new programs have been istalled..

Change your password from another computer and I suspect you can change your log on...you might be able to contact microsoft for assistance..

a reply to: chrismarco

Windows 10 update just did a clean install on my computer. And I have checked my installed programs, nothing new. I did a clean install of Windows 10 about 2 weeks ago.

I didn't check the firewall though. That is when I found 3 different VPNs installed and active.

It sounds like you may be getting a bit paranoid. Generally, hackers don't target individuals. Impose some sensible security measures on your computer. And get on with your life.

originally posted by: Moresby
It sounds like you may be getting a bit paranoid. Generally, hackers don't target individuals. Impose some sensible security measures on your computer. And get on with your life.

Nah. It was personal when I saw my account hijacked. Was it personal to me? Perhaps not. I made it clear in the OP that I knew that all of Yahoo had been hacked.

And the vpns I found, I doubt were personal either. Never did I mention it was personal. I did mention only truth and what is verifiable nevertheless.

a reply to: GailNot

Your service provider will often ping you and it shows up for a second and goes right away. On occasion it's been known to be followed by a temporary loss of connection (one typical reason being the server you were on required maintenance, so they stopped all incoming connections to that server, they pinged the server to grab all of the currently connected IPs, disconnected them from that server, and then threw them all on to one or more operational servers so they could complete their maintenance).

I'm not sure what IP tool you used to gain the information about Bill Blackwater... nevertheless, if you still have the IP, send me a u2u, I have a tool or two myself, perhaps I can find more info for you.

a reply to: UberL33t

Thanks, I will if it happens again.

I posted above that I am using TCPView. I don't know how good it is, but that is what I found that is free. If you have any other alternatives I'd be happy to know.

a reply to: GailNot

This is my favorite... and it appears that it gives you more options than your current one. There is a 30 day free evaluation and it's $49.99 USD (I think) after that to keep the full version.

X-NetStat Pro

a reply to: UberL33t

So, just to give an update.

I've been keeping an eye on TCPView and my firewall since I posted the OP and have found mostly nothing of note.

But I did find something that leads me to believe that I did stumble onto something going on with my computer.

When I got the Windows 10.1 update that reinstalled my OS when I was logging into my Microsoft account it wanted me to phone verify my email address because it said it detected a lot of spam mail from it.

Which is very weird because I don't see any emails being sent from it. I did the verification etc. And did a search on my ip address at this website:

IPSNOOPER.NET

I found it by doing a google search. And I did search for my IP address and this is what popped up:

email reputation: poor.

And a little further down:
pbl.spamhaus.org: Listed.

It had my ipaddress listed for some reason I didn't know about. But I could click on the link and it says:

IP Address [***.***.**.**] is listed in the CBL. It shows signs of being infected with a spam sending trojan, malicious link or some other form of botnet.

It was last detected at 2016-08-11 15:00 GMT (+/- 30 minutes), approximately 11 days, 2 hours, 29 minutes ago.

This IP is infected (or NATting for a computer that is infected) with the misc spambot. In other words, it's participating in a botnet.

If you simply remove the listing without ensuring that the infection is removed (or the NAT secured), it will probably relist again.

Well the 8-11 date is after I posted this OP so some type of activity is still going on from my IP address somewhere.

It's given me some links to try some things to see if I can find the malicious software on my computer. But I don't know if I have any. I have a clean install of Windows 10 Update. I have run a couple of anti-virus software, as well as AntiMalware. And am now downloading a program they recommend:

How to resolve future problems and prevent relisting Norton Power Eraser is a free tool and doesn't require installation. It just needs to be downloaded and run. One of our team has tested the tool with Zeus, Ice-X, Citadel, ZeroAccess and Cutwail. It was able to detect and clean up the system in each case. It probably works with many other infections.

Anyone want to chime in?