Hacked - I think!

[Steamywee]

Yesterday evening, I opened an email from my Bathroom fitter which had an attached quotation which I downloaded.

heading to my "Downloads folder", I saw the quote which was benign and moved it to my file on the project.

I then noticed that the next line of that folder headed "Earlier this month" or some such, where to my horror I saw a download which I had not made!

It was for "Splashtop" software, which I did not recognise but knew from the name was likely a remote view/control tool.

I right clicked on it and brought up the "Properties" window and saw to my consternation that it was downloaded on October 17th at around 14:30, so it had been there for a week!!

Utterly gobsmacked, I contacted MBAM with whom I have an account and after about a half hour "Chat", I hoped to galvanise them into some protective action, their response was "Someone will contact you IN THE NEXT COUPLE OF DAYS!!

Note to self: review likelihood of continued subscription! 

I have scanned the file with MBAM and found nothing untoward, ...that is if you were expecting it to be there in the first place!

I also ran a full scan of the machine (which is done daily), and nothing to report!

After a rather poor nights sleep, I thought to check if the dratted thing had in fact installed itself, - and it had!

Also on the 17th of October!

Since None of this was known to me before 20:30 on Friday 24th October, I would be unable to contact Banks etc before Monday!
I have managed to contact the credit card people who have noted the details and advise no unknown movement on any cards or accounts, ...yet!

There was an odd coincidence (I don't like coincidence) that on the 17th October at 14:30. the same time this was downloaded and installed on my PC, there had been two calls to my mobile phone.

I have never had any unknown numbers call my Mobile, they do call my Landline and often are caught in the latter stages of scamming to get a response, which they never do get as I don't answer any unknowns unless they explain themselves first!

However, these two calls didn't wait for any answer 'cos they hung up after some 20 seconds!

Turns out these calls were from a TalkTalk CUSTOMER SERVICE NUMBER, which I now understand is involved in some current scams being perpetrated.

I have disconnected that (my main machine) from the internet and am currently using my laptop which is, for the moment "clean".

I am loathe to uninstall "Splashtop" in case it holds any clues as to who planted it or what it may have accessed.

Any helpful advice gratefully received.

[amahle-TT]

We are glad that the issue has been resolved, thank you for the feedback, have a good day!

[Steamywee]

That's as may be but us old gits sometimes need these youngsters for their innate understanding of their world of technology in which we old farts (is that more acceptable?)only exist 'cos we gate crashed the party!😀

[ferguson]

Moral of this story? Don't let tech whizz 20 somethings loose on your computer, or at least only in a guest account which prevents them from downloading anything!  🙂

[Steamywee]

HI Folks, update and the end of the nightmare!

It's been a fraught weekend, just waiting for a shed load of bad news but it has turned out OK.

Looking through my Browser history was a pain, trying to go back more than about 4 days and the dratted thing skips back to "today", you can never get it to allow you to see further back.

Eventually on Sunday afternoon I stumbled on a way to do it but I've not remembered how to with all the stress!

Turns out that my cousin and her husband came to see me on Thursday 16th Oct with their son David.

Since he is in his late 20's and considerably more IT aware, I had asked him if he knew how to use an old iPad as a second screen for my PC.

He wasn't sure as the iPad is I think a 2012 vintage.

I left him with it and went off with Cousin & spouse to help move some furniture, as they are emigrating to Albania, (Crazy!)

When we had finished, David said bad news, the iPad was too old and it couldn't be used and that was the end of the matter!

A horrible coincidence (I think I've said I don't like them) on Sunday morning, I awoke to find an unsolicited email at 2:02 on Sunday morning from a Bank who hold one of my investments asking if I could confirm my contact details!

My heart sank thinking this was the start of a nightmare I wouldn't awake from. 

I managed to get hold of David on Sunday afternoon to ask if he knew how "Splashtop" arrived on my machine

Turns out that he had indeed downloaded it but forgot to uninstall it afterwards.

The relief was enormous, but I was still not sure until I spoke to the bank to confirm that this email was indeed from them, and thankfully it was!

The sense of freedom with the lifting of that fear was unbelievable.

Thanks for your input, especially the simple advice to check my history, despite how hard Chrome make that it was the key!

Happy bunny.

[nameunknown_]

@Steamywee 

Splashtop has created a blog about recent abuse of remote access tools, including Splashtop.

https://www.splashtop.com/blog/phishing-campaign-misuses-remote-access

The attack described in the blog tricks the user into downloading malware that subsequently downloads and installs two remote access tools.

I am not saying that is how it has come to be downloaded and installed on your device, because of course I do not know that.

You have said "I am loathe to uninstall "Splashtop" in case it holds any clues as to who planted it or what it may have accessed."

At the very least you should check that it is not configured for unattended access.

[ferguson]

@Gliwmaeden2 

I have had incoming calls from TalkTalk on that number. 

[fr8ys]

I can't see how receiving a phone call on your mobile could cause a download to your PC, even if you have My Phone, or whatever they call it now, is installed.

@ferguson advice re scam protection is correct and @nameunknown_ has also given good advice.

If you really feel that your mobile phone is at fault, there is no support for mobile available on the forum.

I suggest you wait for Malware Bytes to respond and give you advice.

As an aside, have you taken steps regarding your mobile, given the imminent closure of the service as would have been advised recently via email,assuming your mobile is with TalkTalk?

[Gliwmaeden2]

The number could easily have been spoofed - most businesses don't call out on the number that is publicised for calling in as a customer, @Steamywee.

The same happens with banking  - scammers tend to use the number for calling in, lulling customers into trusting the call.

Unlikely to have been calls from Talktalk. 

Worth reporting these as suspicious calls:

https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-call

[ferguson]

Scam protection is a feature of HomeSafe which can be managed via My Account.

You think TalkTalk somehow downloaded Splashtop on your PC as the result of a unanswered phone call? 

[Steamywee]

Thanks @fr8ys  there was no need to do a Google search, since I have already ascertained that this is remote access software.

Not sure what you mean when saying "Do you have scam protection activated? If not re-enable this" Enable it where and in what application?

My antivirus "protection" is with Malwarebytes aka MBAM, with whom I have raised a "Support Ticket" - their parlance for an Investigation.

Sadly their idea of "Urgent" seems to involve a two day lag!

Regarding your final sentence, I disagree, since this unwanted download occurred at exactly the time two calls were made to my mobile phone and were unanswered, both were from 0345 172 0088, which is a TalkTalk line as I understand.

[fr8ys]

Doing a Google search suggests this is a remote desktop access programme that many are reporting issues with.

Do you have scam protection activated? If not re-enable this.

Who is your anti virus protection? Have you contacted them for advice.

Is the acronym you have used for malware bytes? If so then they seem to be able to tailor a response if approached, by user. Don't try to run the suggested solution from their forum as they says it is tailored to that user. 

It may well be worth posting on there to receive a response.

Hope you find a solution there.

As this isn't something that appears to be a TalkTalk issue I shall move this to the Lounge 

[Steamywee]

Hmm, Thanks @nameunknown_ not sure about that since it has somehow already installed without my knowledge!

[nameunknown_]

@Steamywee 

Unattended access is a feature of Splashtop that must be enabled. By default, the 'Request permission to connect' setting is enabled, requiring an end-user to approve each connection.

If unattended access has not been enabled, and you have not granted permission for a connection, then your device would not not been remotely accessed using Splashtop.