2

Exposition

One late night I was multi-tasking when a (trusted) friend sent me a link with text in a Facebook message he had apparently written. The preview of the link had a picture of me, and because I was curious and wasn't thinking and (seemingly) had no reason to be suspicious, I clicked it. Nothing noticeable happened.

One month later...

I was on a friend's profile when I glanced at his friend's list and noticed an impostor, someone pretending to be me. I explored the profile and saw we had roughly 200 mutual friends and, even scarier, there we pictures of me I had never uploaded online. This is when I retraced my online activity and connected the dots: clicking that link was almost certainly a mistake.

Note: I saved the link. If it would be of any help, I could post it here for analysis. Let me know in the comments and I will edit this post with warning triggers.

"Nuking it from orbit"

Online damage limitation. I knew things were serious when I found those pictures, so I immediately took action. I contacted Facebook and, thankfully, they quickly shut the account down. I've read that others haven't been so lucky. I've also read that these impostors will create new accounts after such deletions and block the person they're pretending to be to avoid detection. To combat this, I've periodically asked several friends to search my name to see if anything suspicious pops up. Nothing so far.... I also changed all of my passwords.

My machine. I knew they had almost certainly gained access to my machine. I hadn't done a back-up in quite some time, so I moved important documents, new pictures, and media (photos and video) to an external hard drive. I wiped my machine and reinstalled the OS along with McAffee's LiveSafe. I ran a scan on the files from the hard drive and nothing was flagged.

The Aftermath

I've been closely monitoring everything and nothing out-of-the-ordinary has happened. However, I'm still paranoid. Is it possible that a malicious file could have bypassed LiveSafe, allowing an attacker to access my computer and/or network? If the likelihood of this is high, what additional steps would I need to take to regain my privacy and peace of mind? Everything is up-to-date on my machine and I run a full system scan every week.

Still... I feel unsafe.

Update: In addition to the protective measures that I mentioned above, I've also enabled two-factor authentication on all accounts that I have that offer this feature.

closed as too broad by Anders, ThoriumBR, Steffen Ullrich, forest, Stephane Mar 9 '18 at 10:33

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 8
    My first concern would be that the attacker gained access to your online accounts (including online photo storage). I would also perform a Google image search for this image that you said that you never used online. You might find other vectors the attacker used or find that the image was indeed used online before this event. – schroeder Mar 7 '18 at 11:29
  • 3
    Still... I feel unsafe. Well you're on the internet, a wild lawless place. It's the right way to feel. – Nico Mar 7 '18 at 11:30
  • 1
    "Can malware survive a machine wipe, an OS reinstall, and a virus scan?" Yes, but then fake online profiles is the least of your worries. – schroeder Mar 7 '18 at 11:33
  • 3
    Change your passwords on your online accounts and enable 2FA where you can. – schroeder Mar 7 '18 at 12:06
  • 4
    in addition to @schroeder advices I would suggest you to check currently set recovery mail/phone numbers – Soufiane Tahiri Mar 7 '18 at 13:23