Have I been hacked?

BertieUK

This morning my wife received an email from me that I had not sent.

It consisted of 'Hey look at this' giving a web address.

This email was in turn sent on to her contacts who are now very wary of opening any of her emails.

We have both changed our passwords and now wonder if there is anything else that we should be doing.

PS We are both pensioners and are a little anxious. Many thanks.

closed

scan both machines with malwarebytes

http://www.filehippo.com/download_malwarebytes_anti_malware/

email source addresses can be spoofed, so it could be from many sources, including any of your/her contacts. what email system is it? ie yahoo/gmail/your isp?

waddler_8

The question is - did you (or anybody who received the email) click on the link?

BertieUK

waddler_8 wrote: »

The question is - did you (or anybody who received the email) click on the link?

I have not sent or recieved any of these emails, and my wife has sent an email to her contacts warning of what appears to be a scam or the likes.

My wife is a little confused at the moment and thinks that she must have opened it but it contained rubbish she says.

I am running a full scan on both machines at this moment.

Thank you all... I will report back when the scans have finished.

waddler_8

Full scan not really necessary & it could take hours - quick scan will suffice.

http://helpdesk.malwarebytes.org/entries/20883848-what-is-the-difference-between-the-three-scan-types-in-malwarebytes-anti-malware

BertieUK

Malwarebyte has just finished scanning both machines and has said...

...No malicious items were detected.

Good new so far...

Nilrem

An email doesn't have to be from the account it says it's from...

An old trick with virus's was to send emails to everyone in someone's contact list/address book, but use one of the names in the list to make it harder to find out who was infected.

So Joe bloggs is infected with a virus.
The virus looks through his address book and finds John Doe and Jane Doe, it sends a message to Jane but spoofs the "from" so it looks like it's from John.
So Jane thinks John has sent it, when it's really from Joe's machine

It's a really old trick that is also used by spammers when they have a list of people they want to spam, and works because email relies on trust to make sure the "from" field is accurate (it assumes the person sending the email will want replies to the person it says it's from, as opposed to you clicking a link or something in the body of the email).

waddler_8

The key is in clicking the link. You're unlikely to get infected just viewing the email.

The link would probably direct you to an exploit. Any threat from this can be mitigated by ensuring everything is up to date, particularly programs known to be commonly exploited.

I followed up something similar to this the other day. My Wife's facebook account received a similar message (Lol, remember this day! - link) through the Private Messaging System.

In a sandboxed environment & using fiddler to log the traffic, I saw clicking the link took me through a number of redirections to exploit domains, before dumping me on a fake facebook login page.

The infection attempts were unsuccessful due to a fully patched machine, so it attempted to phish her login details instead.

So, so long as you never clicked the link, & scans come back clean, things should be ok.

We can take a more comprehensive look if need be.

BertieUK

I will see what the next few days bring - I will post a follow up as to what we both encounter.

I thank you and I note the experience that you also had and the points you made, and thanks to all who gave advice, it is appretiated. Kind regards.

debitcardmayhem

One other word of caution Bertie please make sure that you use different passwords for any on-line systems and if they are the same as your email passwords then change them as a matter of urgency

BertieUK

debitcardmayhem wrote: »

One other word of caution Bertie please make sure that you use different passwords for any on-line systems and if they are the same as your email passwords then change them as a matter of urgency

All important passwords have now been changed thank you so much for that helpfull info:)