Is my PC safe? need help

Question

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam.

It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from the UK. At the moment it was logged in from the UK, it sent spam out on the gmail contacts briefly.

We changed the password and added 2 step verification. The account has not had any attempted log ins since, and no suspicious activity.

However, since I probably have crazy anxiety problems, I am scared that malware or a virus could have gotten into the machine, however I see no signs.

• I checked msconfig for bad entries

• I scanned with MSE, Mbam, Mbam Anti rookit, Tdsskiller, Spybot, norton 360, kaspersky pure 3.0, norton pe, and it has all come clean, all on full scans.

• I dont see any suspicious activity network wise. (Kaspersky shows 34 ports listening for svchost, 11 for system, is that normal?)

• Nothing seems to be changed, and the pc runs fine.

One of my main reasons I'm worried, is that I believe my own pc was running and connected to the network when my parents got on the phishing link. And the next day it was running and connected, and my parents PC was on too.

I haven't turned my PC on since, and I have been stressing and scanning for Long time now on my parents PC.

I was even thinking about going around with my win7 install disk and formatting all the PCs..

Can anyone shed some light on this? What's the possibility my parents PC got infected? And could it have spread to other PCs?

If it helps, my situation is similar to this Don't understand how my mum's Gmail account was hacked

Answer 1

If you want to be as sure as you can be, reinstalling the operation system from read only media is a good idea.

Answer 2

Phishing is usually carried out by spoofing. You get a link asking you to login with the credentials to some site whose appearance is identical to some trusted sites you know. Your parents probably clicked on the link, and logged in too with gmail credentials. This way the attacker obtained the login credentials.

However, I believe that the security of the pc which was the victim of the attack is not compromised. If you have some decent Internet Security Software installed with the updates, you would be safe. Further the browser used is also important. Chrome with all the latest updates installed is well secure.

So there is less chance of your pc being infected. As a further step you can consider sending an email to all those contacts which received spam, asking them to stop opening emails received from you for a bit of time.

If you are further interested you can look into the browser's history to copy the malicious link, and scan it in some online link scanner. However I do not recommend the above steps unless you are perfectly sure about what you are doing.