2

About 6 days ago my parents who aren't great with PCs got phished on gmail, and the account started spreading spam.

It had been hacked on an Argentinian IP, and then logged in from IMAP and SMTP from the UK. At the moment it was logged in from the UK, it sent spam out on the gmail contacts briefly.

We changed the password and added 2 step verification. The account has not had any attempted log ins since, and no suspicious activity.

However, since I probably have crazy anxiety problems, I am scared that malware or a virus could have gotten into the machine, however I see no signs.

• I checked msconfig for bad entries

• I scanned with MSE, Mbam, Mbam Anti rookit, Tdsskiller, Spybot, norton 360, kaspersky pure 3.0, norton pe, and it has all come clean, all on full scans.

• I dont see any suspicious activity network wise. (Kaspersky shows 34 ports listening for svchost, 11 for system, is that normal?)

• Nothing seems to be changed, and the pc runs fine.

One of my main reasons I'm worried, is that I believe my own pc was running and connected to the network when my parents got on the phishing link. And the next day it was running and connected, and my parents PC was on too.

I haven't turned my PC on since, and I have been stressing and scanning for Long time now on my parents PC.

I was even thinking about going around with my win7 install disk and formatting all the PCs..

Can anyone shed some light on this? What's the possibility my parents PC got infected? And could it have spread to other PCs?

If it helps, my situation is similar to this Don't understand how my mum's Gmail account was hacked

1

If you want to be as sure as you can be, reinstalling the operation system from read only media is a good idea.

  • But if I do that will I have to format all machines in the house? Is there anyway I can find out if there's a definate aign of infection? – Keyes Jul 5 '14 at 22:34
  • Pretty much not. An antivirus scan can only say if it found a match for a virus or not. It pretty much means that you can never really be sure if you have a virus or not. If the antivirus scan doesn't find anything, that doesn't mean that there isn't a virus there that the scan couldn't detect. Even if the scan picks up a virus, there might be another virus still left. That said, I would reinstall anything, you are probably fine. – Henrik Falk Jul 6 '14 at 20:37
0

Phishing is usually carried out by spoofing. You get a link asking you to login with the credentials to some site whose appearance is identical to some trusted sites you know. Your parents probably clicked on the link, and logged in too with gmail credentials. This way the attacker obtained the login credentials.

However, I believe that the security of the pc which was the victim of the attack is not compromised. If you have some decent Internet Security Software installed with the updates, you would be safe. Further the browser used is also important. Chrome with all the latest updates installed is well secure.

So there is less chance of your pc being infected. As a further step you can consider sending an email to all those contacts which received spam, asking them to stop opening emails received from you for a bit of time.

If you are further interested you can look into the browser's history to copy the malicious link, and scan it in some online link scanner. However I do not recommend the above steps unless you are perfectly sure about what you are doing.

  • I had checked the pages, which there are many variants which the link shows. This whole incident has kept me from using my own pc, because Im scared if anything was on the original one that it could spread on lan. – Keyes Jul 6 '14 at 6:28
  • @Keyes Which browser it was ? – Extreme Coders Jul 6 '14 at 6:38
  • It was google chrome, updated. All our machines use it. – Keyes Jul 6 '14 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.