150k page got hacked --- t_alejandro_t is scammer

[vikas3445]

today one of my skype contact ( to whoom i was talking about a bot since last 2 weeks and he sent me a bot last 4, 5 days before which was not working due to "dll missing", come to me talked about something 1,2 sentence and after that told that he wants fb pages and his budget is $2000 .I said i have one , he requested to make him insight analyst and i did it, after 4,5 minutes he said that he checked insight and please remove him, then i removed him. Then he left saying that he will let me know after discussing with his partner. But after 10 minutes when i try to post in my page, i found i am no longer admin of all the pages that i ahad in that profile, next moment i ogt logged out and when i tried to login, password not working.Eventually i managed to get my account back by resetting password by mobile and email, but lost my 3 pages (148k+25k+3k ,, all active).

I wonder how he did it !!! when i checked my email there was 3 emails which tells "you are no longer admin of XXXX" for the 3 pages , i tried to get it back by clicking the links in those mails, but failed. I doubt the bot which he gave me was a keylogger and he were watching my activities since that day, and thus i knew my password , but can't understand then why he wanted me to make him insight analyst.
Very frustrated, does anyone have an idea about it??

(His skype ID- t_alejandro_t)

 

[Untouchable]

it was a keylogger for sure.
Always run untrusted bots on sanboxee or vmware.

 

[rinor4ever]

Check for unusual activity in your PC. Maybe it's not keylogger it can be Browser Extension and it will run each time the OS start!
It can be addED into your system in HKLM using silent install (NSIS sripts...).

Do not allow any bot "Administrator Privileges"

 

[vikas3445]

what should i do now to prevent more damage?

Check for unusual activity in your PC. Maybe it's not keylogger it can be Browser Extension and it will run each time the OS start!
It can be addED into your system in HKLM using silent install (NSIS sripts...).

Do not allow any bot "Administrator Privileges"

 

[bizhack3r]

try rkill,works really good,google it

 

[Mark Zuckerberg]

Don't you have a updated Antivirus ? i mean your antivirus didn't warn you ? Keylogger contains virus and NOD32 is best for this type of things... otherwise it should be a Browser Extension .. Reinstall your windows and report to facebook !

 

[alienacademy]

Thats a keylogger for sure.... and i think he want to confirm that ur pages are active before hacking

 

[xashishx]

Must be a simple keylogger and he wanted you to make him the insight analyst because you need to enter the password to confirm him as the insight analyst and while you are entering the password, the keystrokes are recorded and sent, simple.

 

[mekostryler]

owww you got burned pretty bad sorry to hear that

 

[rohit00033]

I guess you can still talk to Facebook team and ask them if they can help you out.
One of my friend had same problem and his pages were restored to his real accounts, although they are really laggy in conversation but its worth a try if your pages were really active!

 

[vikas3445]

i didn't find an option to talk with them, can anyone help , please..

I guess you can still talk to Facebook team and ask them if they can help you out.
One of my friend had same problem and his pages were restored to his real accounts, although they are really laggy in conversation but its worth a try if your pages were really active!

 

[vikas3445]

LOL. I got him from bhw itself.
He is http://www.blackhatworld.com/blackhat-seo/members/601080-ccostache26.html , but he is banned here, don't know for what he got banned.

 

[rinor4ever]

what should i do now to prevent more damage?

Firstly do not hope that any antivirus or antimalware will help you (You can try with)!
They can't detect custom malware, especially when you're target victim...

If I were you I would find what cause the problem. Maybe the reason why he requested to make him insight analyst was to make you to login in the FB and he can capture the data (email and some words behind asterisk). I'm not user of fb and I don't know what are this stats!

If you want to skip this part you can do it (Save the infected file but do not execute and you can check later also you can PM me the infected file but do not wait for any results since I don't have time and I'm not going to test it now).

You can get back in time using OS system restore (Be aware, they will say that you're not going to lose any data but I have lose a lot data like programming language source codes or nsis scripts(exact all my nsis scripts and now I'm lazy in starting writing again) and I don't know why).
Or better idea save your data in another HDD and format it (it will take time to save your data and of course you will forgot some) and you will be completly safe. I belive that anyone know this here...

Hope that I've helped you! You can also search for more on different sources (I think that better place for hacking problems is HF)

Thanks,
rinor4ever