I sent a virus message to Malcolm

[GeorgeB]

I say 'virus' but I'm not sure what it is or how it came about. Can anyone help me ascertain the cause and perhaps suggest how I might get rid of it?

The source email account of mine is a hotmail account which I access only as webmail. I never acccess it using Outlook Express or anything. Malcolm sent me a PM here to say he'd received an advertising type message, purporting to come from me. Sure enough, I can see the message in the 'sent' list of my hotmail account. It says the message was sent at "18:01" although a date is not listed. All other sent messages have a date and time. The bogus email was sent to one person in my hotmail contact list and blind-copied (bcc) to about 15 more people, including Malcolm. I've now deleted all the contacts in the contact list (many more than 15), in the hope that this helps.

I've scanned my PC for viruses and nothing is reported. Would the bogus message have been constructed 'by my PC' whilst I was accessing my hormail account on the MSN website? Any ideas?

Thanks in advance.

 

[shenion]

Sounds like someone has hijacked you hotmail account. I'd suggest changing your login password.

 

[Paul.]

You've most likely had your account hacked by a spammer, I would change your password, sometimes they do that for you and lock you out of your own account, you should probably contact hotmail support.

 

[oz.]

I had that, they changed my status to 'Away' so that when i got an e-mail it automatically sent an email back - containing whatever they'd written. Change your password and it should be ok, I've since opened a Gmail account and have had nothing.

 

[GeorgeB]

Thanks. I've changed the password, which I was able to do. If some hacker or software 'learned' the password by 'watching' me type, that's very worrying because there are other accounts which are a lot more important than my hotmail account, e.g. eBay and Paypal for a start. It would be a nightmare if anyone else could start gaining access to accounts like those. Can anyone think of any other explanation, besides some person or system going to hotmail.com and simply logging-in with my password?

 

[Paul.]

As a precaution its probably a good idea to change all your passwords just in case you have a keylogger installed, antivirus software wont always find them, Download spybot its free, and will work alongside antivirus tools, another good free one is superantispyware.

 

[GeorgeB]

TIG Paul - thanks for your help. I agree it makes sense to change virtually all passwords, perhaps from another computer. I used spybot for a while 2 years ago but grew concerned for potential clashes with other security products, so I removed it. I will now reinstall the latest version and do a scan before I remove it once more.

 

[Paul.]

TIG Paul - thanks for your help. I agree it makes sense to change virtually all passwords, perhaps from another computer. I used spybot for a while 2 years ago but grew concerned for potential clashes with other security products, so I removed it. I will now reinstall the latest version and do a scan before I remove it once more.

I've never had any problems using spybot with other programs, including superantispyware, the latter will slow down your boot time if you allow it to run on startup, that can be changed in the options though. if you install spybot dont forget to update it before you use it, and also use the immunise function to help protect your browser, then leave it installed it wont do any harm, unless your machine is very slow you wont know its there.

 

[GeorgeB]

I just loaded, updated and ran spybot. It found only 5 or 6 harmless-looking advertising type cookies and nothing else. So Norton, Windows Defender, Malware AntiBytes and Spybot have all failed to come up with anything much. Perhaps my hotmail password was picked up years' ago and has only just been used. Others have reported hotmail hacking which involves the site being advertised in the outgoing bogus message - eoffar.com These people could not regain access to their hotmail accounts so perhaps I'm lucky. If the people running that site are behind this, how come they haven't been arrested? I haven't checked the website at eoffar.com, for fear it might contain further viruses.

 

[the snooper]

have a read through this other people have reported the same

also this

 

[Paul.]

I just checked that site with macafee site advisor and it is dodgy, it appears to be a Chinese seller of electronic goods I'd stay away,
You might also want to have a look at this site,

 

[rikrobson]

The email does not have to have come from your hotmail account or mean that the account has necessarily been hacked. The senders email address is added to the email and only the email headers record the real ip address of the originator. If the originating ip address is part of the hotmail (microsoft) network then there is the possibility that the account has been compromised.
To be sure I'd need to see the original email headers for the offending email.

 

[toddy]

and did you say you had norton.
i would get rid of it asap and use AGV insted, it is free, and what most computer users use.
i do and havnt yet had any problems, unlike vista

 

[KTMMICK]

People.....also be careful using a wireless connection, I don't know if you have seen the programme "The Real Hustle" but it is dead EASY to hack into computers. They sat outside someones house and got a persons Bank details log ins and everything........also be wary about using Bluetooth devices both on your Mobbie and your Computer.

 

[MrFluffy]

The email does not have to have come from your hotmail account or mean that the account has necessarily been hacked. The senders email address is added to the email and only the email headers record the real ip address of the originator. If the originating ip address is part of the hotmail (microsoft) network then there is the possibility that the account has been compromised.
To be sure I'd need to see the original email headers for the offending email.

He mentioned that it was in his sent items when he checked, which doesnt fit the forged from address scenario.

Odds are his home pc has been compromised and they snarfed the hotmail login from some sort of bot/trojan/keylogger on there.
George, change every password for sure from another machine, and for me id wipe the machine and reinstall completely from a KNOWN clean source.
Another good method is to boot from a linux live cd (its a complete install of linux which runs from a cd or usb stick without installing) , and use that session to change everything. Since if you have for example a bunch of windows machines on the same lan/router, they could all have got hit/infected by the same exploit as some attacks self propogate like this...

 

[hunter27]

I have been using "personal key scrambler" for a bit now seems a good program and is free. as recomended by PC World

KeyScrambler Personal

One of the biggest dangers you face online is theft of your user name and passwords for logging into commercial Web sites (such as banking and financial sites) and Web-based e-mail accounts. A criminal who steals that information could empty your bank account and use your e-mail address to pose as you.

This add-in to Internet Explorer and Firefox promises a simple way to keep you safe. As you type your password, KeyScrambler Personal scrambles it so that the information sent out over the Internet doesn't match what you type. That way, a lurking crook won't be able to steal your private information.

A small icon sits at the bottom of your screen, telling you that KeyScramber Personal is going about its work. As you type, you'll also see the scrambled text that the program is sending.

Can be downloaded here

http://www.qfxsoftware.com/products.htm

Pete

 

[GeorgeB]

Wow! I'm so grateful to you guys for all the good advice. I have a Linux CD but didn't think of digging that out, to change the passwords. What a good idea! I also scanned with the Windows malicious software removal tool, and that found nothing, either. I doubt if this piece of scum software is still on my PC but if anyone has any better ideas for other checks, I'd like to hear about them.

Yes, the sent message is listed in the sent folder, on the hotmail webage. I find it unlikely that a human keyed-in the message but how did they do that automatically? A telling feature is that all my real, genuine outgoing messages have a date and time in one column within the sent folder. But this fake message only has a time, and no date. It seems the robot, or whatever, is not perfect. If it really originated from that hotmail webpage (compose message) then how come the date didn't end up in the sent folder? If it was 'synthesised' and sent from somewhere else, purporting to come from me, how did a copy end up in my sent folder AND WHY would they do me the favour or logging it there? How could they 'inject' the message to my sent folder, unless it was sent from within the hotmail webmail account?

I'd been running AVG for several years, before I removed it, as more trouble than it's worth. Perhaps I was wrong. My Norton is only passive detection - there's no active anti-virus checking. If none of these progs pick up a virus on my PC, then it seems nothing has got through. If my whole PC crashes, no problem. I can be up and running again in about 15 minutes by a full hard disk restore from a backup HDD. But i hadn't bargained for key logging type threats. Would AVG be better? Can't firewall and defender guard against anything getting n in the first place?

I appear to have got off lightly, compared to some people. None of my email settings were altered, or anything. As far as I can tell, it's just that one bogus message was sent.

 

[GeorgeB]

I have been using "personal key scrambler" for a bit now seems a good program and is free. as recomended by PC World

Many thanks for this. It must be worth having! I probably need the $13 version because I currently favour and use Google Chrome.

 

[..DAZ..]

as well as spybot also get adaware which is free to download, whatever one doesn't pick up the other should. Commodo antivirus also has a free version that contains anti spyware software. I use all three and have never had any conflicts and aint had a virus for a long time. I "think" it is a worm that you have got as opposed to a virus, thay basically copy the email addresses from your accounts and then use them to spam people. Not really malicious as such but still annoying when you get emails from people saying Please stop emailing me!!!
ps, chuck norton........................absolute pants!!!!

daz

 

[Charred fingers]

I read an article the other day about confusing keystroke loggers which went like this.
Say your password was ABCDEFG if you type in ABCDE then using the mouse you click between the C&D then type DEFG, what you then have is your correct password with 2 extra characters to the right of the cursor which you delete by pressing the delete key. Because keystroke loggers don't monitor the mouse, as far as it is concerned you typed in ABCDEDEFG then deleted the F&G leaving ABCDEDE