General Category > Is Teamviewer hacked? Discussion and links.

Someone hack my TeamViewer account and stole all my passwords saved in browsers!

(1/2) > >>

ingydust:
Hi,

on May 1st 2016 (at 13:04 GMT+3, Bucharest, Romania) someone hack intro my PC from TeamViewer and stole all my passwords from browsers (IE, Firefox, Chrome, Opera) with a little software called WebBrowserPassView. I was in other room for only 10 minutes and when come back I saw that someone open Amazon pages in browsers (Firefox and Chrome). He quickly loged out from session when I move the mouse. I saw this litlle utility on my desktop with a .txt file with all my password. He/she manage to transfer this .txt file... So it was to late...
I tried to connect to his/shes ID 279 320 949 and display popup with: "Your activity on TeamViewer is suspected to be bussiness (not free)" (something like this... I can't remember exactly, but I'm sure that you know what I'm talking about).
I quickly change all important passwords (gmail, facebook, yahoo, paypal, etc), even on TeamViewer and activate double authentication with code on my mobile.
I searched on the internet about TeamViewer and WebBrowserPassView hack and I found a lot of people were attacket with this method...
I restore entire clean image (bit by bit) of C:\ created 3 months ago to be sure that I'm not having a virus or something, even I'm very sure that I don't have virus (I know what I'm doing).
I'm using Windows XP SP3, AVG Antivirus and Outpost Firewall and I'm connected to internet trough TP-Link Router with security enabled.


Ex from log file (I sent it as support ticket already):
 - File transfer request from IngyDust (XxX XxX XxX) allowed
 - Write file C:\Documents and Settings\Username\Desktop\WebBrowserPassView.exe
- ClipboardFileContentHandlerWin::LogFileTransfer: Transmit file: 'C:\Documents and Settings\UserName\Desktop\grtg.txt' (this it the .txt with all my stolen passwords)

Please help me to find what's going on and who is this hacker (IP, address, email, etc)

Thank you in advance!

PS: After few hours of searching this problem on the internet I found that are MANY pople in this situation. I hope that is not a problem on TeamViewer side (servers security etc). PLEASE HELP!

matt:
I'm feeling your pain...
Just so that you know, this is NOT official support.
This is a user run forum.

The number of such reports has increased the last few days. Personally, I'm reviewing my use of Teamviewer...

matt:
Also, make sure that you change your important passwords (banks, government etc) immediately (I'm hoping that you have already done this)

https://www.teamviewer.com/en/company/press/statement-on-ransomware-infections-via-teamviewer/

ingydust:

--- Quote from: matt on May 01, 2016, 04:54:55 PM ---I'm feeling your pain...
Just so that you know, this is NOT official support.
This is a user run forum.

The number of such reports has increased the last few days. Personally, I'm reviewing my use of Teamviewer...

--- End quote ---

Hi, matt! I saw this after few hours of searching... There are many TeamViewer users in this situation.


--- Quote from: matt on May 01, 2016, 05:02:41 PM ---Also, make sure that you change your important passwords (banks, government etc) immediately (I'm hoping that you have already done this)

https://www.teamviewer.com/en/company/press/statement-on-ransomware-infections-via-teamviewer/

--- End quote ---

I changed all important passwords starting the first minutes after attack and non-important too.

Thank you very much for your reply!

Now I'm waiting for a official reply on TeamViewer support ticket.

0plus6:
Same thing here. Happen to catch them trying to steal passwords out of Chrome browser using a small program they copied across called ChromePass. Waiting on TeamViewer ticket response.

Navigation

[0] Message Index

[#] Next page

Go to full version