4

I opened two emails. Supposedly one was from Zendesk (the other I did not realize was from another source. Attention was elsewhere). Anyhow, I clicked on the unsubscribe button. Normally, this a good policy for legitimate sources. Men don't always multitask very well :/

In this case, I clicked on the one from the supposedly non-legitimate source. I was wondering, since I have noscript on at all times, could I possibly get infected? All I got was a spinning circle (in the tab) with the new tab internal address.

Note: I obviously have the scripts enabled for my email provider. But not for random websites.

According to the Zendesk email, they claim that the person/group had some malware. Something about a file or something. Now, I have zero clue whether that email itself is legitimate at this point. Have I dealt with Zendesk in the past? Yes. With which email account? I cannot remember.

In any event, the email does not come with an attachment as Zendesk claimed it would. Anyhow, this is what they wrote:

Your computer(s) may be infected with a virus if you recently:

Opened a file from "Joyce Lim" named "info.xls", "information.xls", "infos.xls", "mail.xls", "market.xls", or "marketing.xls" related to a job opening entitled "Need mail and other lead generation consultation." Enabled macros from the file, or already had your macros enabled

I am currently running MBAM, and will run superantispyware afterwards, and then Avast. Finally, I will run norton power eraser.

1

You're most likely fine although depending on the attack (how targeted, how much the attacker knows about their audience). If you didn't open any attachments you most likely do not have malware on your computer because a javascript to sandbox escape zero day is very very valuable and would likely be weaponized by or at the government. As long as you don't have any vulnerable extensions (any extensions which interface directly with an unsandboxed application are dangerous and can potentially be exploited for RCE) you are likely safe on this front.

The worst case scenario is that the unsubscribe page had some malicious content in it that attacked your other accounts using iframes or some other CSRF approach. With javascript disabled except for special domains your are still quite vulnerable to some attacks however these only would affect vulnerable websites and the accounts you use on them. So worse case scenario your account on a website has some XSS injected into it. Without javascript exploiting an XSS is more difficult however if it's stored you may eventually end up signing in without noscript and then it's game over because pretty much any action you can take on the site the attack can now as well.

The issue with these web to web attacks is that once you're infected it's really hard to know and it's up to the site operators to detect and fix these vulnerabilities. Keep noscript running but I wouldn't be too worried since it's out of your hands at this point.

0

Antispyware/Antivirus tools might not help and their efficiency can not be trusted.

The best method would be to delete your local OS account and its contents, and create a new one. and perform a backup. Of course this assumes you didn't use administrative account while opening attachment.

Afterwards, changing passwords that were stored on local account.

However if you did use administrative account then the only way to return trust to OS is to clean reload.

  • I always use an admin account. Also, I did not open any attachments - I know better lol. My question actually pertains to having clicked on a potentially fake "unsubscribe" button. Since I use noscript, would that prevent any outside script from loading, since I clicked on the link within my email account? That being said, noscript allows my email provider's scripts of course. – user3298911 Nov 13 '16 at 20:29
  • It depends how is your noscript set up. if it's mis configured then yes, scripts can infect PC very easy. but usually, replacing account removes infection completely. but since you use admin account there is no way of returning trust. please don't use admin account, because you turn your PC into easy target. – gmlox Nov 13 '16 at 21:04
  • My noscript addon has the default setup, and it blocks every script by default. Except of course, the webiste's specific scripts, which I allow. In this case, it allows google.com and gstatic.com. – user3298911 Nov 13 '16 at 21:09
  • 1
    @gmlox, I really do not want to be rude but saying that removing a windows account also removes any sophisticated virus is utter nonsense – architekt Nov 13 '16 at 21:12
  • 1
    @gmlox Privilege escalation can happen immediately after compromise. It's just about fingerprinting the environment and loading/executing the suitable exploit. This process can be fully automated. – Noir Nov 14 '16 at 0:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.