Email issue maybe a virus or hacked account?

[supersix4]

Hey guys any feedback on this issue would help me a bunch... Anyway I think my moms email got hacked she keeps sending out these emails with a link and usually a sentence (I'm not going to post the link incase it is that, and I certainly won't click on it)

Enuough sufrefing, strat banging Be her intimea champeion

I had her change her password after the first or second time it happened and its just now happened again.

I had to restore her computer because I believe she got a trojan playing those flash games online

But could she still have a keystroke logger or something in there for it be getting ahold her email password?

I thought those total restore partitions were pretty locked down.

[PrivatePixel]

What OS is she using? What email client? Is there an anti-virus / internet security suite pre-installed on the PC? Any positive results after running Malwarebytes?

Are you saying that the email client is dispatching spam automatically and without her knowledge?

[brent21holmes]

I really believe your mother's email might be hacked,
How often does she use her email?

[supersix4]

Originally Posted by PrivatePixel

What OS is she using? What email client? Is there an anti-virus / internet security suite pre-installed on the PC? Any positive results after running Malwarebytes?

Are you saying that the email client is dispatching spam automatically and without her knowledge?

OS is Windows 7 on an HP (64 bit), Yahoo email (basic nothing that costs money), Symantec virus protection which she pays for, and yeah I found multiple trojans/ goodies that had invaded the registry when I ran aSquared. As usual Symantec didn't find any issues...

Yeah like tonight she was driving home when I saw the email 2 minutes later I called her she said WTF I've been in the car the past 15 minutes no way I sent that email which I attached above. So I guess thats a yes its basically sending out spam or worse links to viruses (and it selects multiple contacts sometimes different ones, but it doesn't send more then 1 email every now and then). I've not clicked on any of the links the 1-3 other times this has happened, so really I have no idea what it is

Originally Posted by brent21holmes

I really believe your mother's email might be hacked,
How often does she use her email?

That's her personal email and uses it to shop, talk to family members, and friends...

I'd say she uses at least once a day...

[tilallr1]

Try downloading and scanning your system with MalwareBytes. It should at the very least give you an idea of what your dealing with. Usually finds most of the crap we get.

http://www.malwarebytes.org/

If that fails you can also run a more risky scan and kill program called:

COMBOFIX

http://www.bleepingcomputer.com/comb...o-use-combofix

If this doesn't kill it nothing will. But run at own risk, it's possible it could hose your system if improperly used. Read instructions carefully.

Also ... and this is very important ... be sure to turn off system recovery in windows and run these programs in Safe Mode.

[MrFattBill]

Originally Posted by tilallr1

Try downloading and scanning your system with MalwareBytes. It should at the very least give you an idea of what your dealing with. Usually finds most of the crap we get.

http://www.malwarebytes.org/

If that fails you can also run a more risky scan and kill program called:

COMBOFIX

http://www.bleepingcomputer.com/comb...o-use-combofix

If this doesn't kill it nothing will. But run at own risk, it's possible it could hose your system if improperly used. Read instructions carefully.

Also ... and this is very important ... be sure to turn off system recovery in windows and run these programs in Safe Mode.

Indeed, it's like a virus sleep away camp.

Bill

[tilallr1]

Originally Posted by MrFattBill

Indeed, it's like a virus sleep away camp.

Bill

[tilallr1]

One last thought:

[Show spoiler]In other words ... REFORMAT if the problem persists ... its the only way to be sure.

[supersix4]

Originally Posted by tilallr1

[Show spoiler]In other words ... REFORMAT if the problem persists ... its the only way to be sure.

Yeah I did do that right off the bat, once I couldn't get rid of everything... It runs normal again now since I've done that, but I'm just wondering how the email is still sending .

lol thats always my go to option when in doubt reformat

[PrivatePixel]

Originally Posted by supersix4

OS is Windows 7 on an HP (64 bit), Yahoo email (basic nothing that costs money)

That's her personal email and uses it to shop, talk to family members, and friends...

If it's a Yahoo e-mail account, chances are it was hacked (and she's not alone; it seems to be a pervasive problem). Difficult to say if a keystroke logger was somehow embedded into her PC, or if the account was hacked remotely. Malwarebytes may be able to address the first issue (using ComboFix is a more drastic step, and intended for more knowledgeable users), but if it's being done remotely, that could be investigated as well.

I found the following recommendation on Kioskea as to the steps one could take if s/he suspects their account was compromised:

Send an email to Yahoo Account Security Department (account-security-help@cc.yahoo-inc.com) mentioning the problem. Keep in mind that you have to be polite with your writing.

1. Provide them details of the entire story.
2. Mention the time and date when you last accessed your account.
3. Give the password that you last used to access your account.
4. Most importantly, provide the all the information you entered when you register your account or just the information when you last updated your account.
5. Wait for the response. Do not contact them several times a day, as they consider repeated messages abuse and harassment.

Another suggestion that's fairly similar:

In case of a hacked account, send an e-mail describing your problem to account-security-help@cc.yahoo-inc.com. If this doesn't help, call Yahoo at 1-408-349-1572; explain to a customer service person what happened. They will ask you to perform a number of steps, then they compare your original info with the changed info. A resolution may come in as little as 24 hours.

[supersix4]

Thanks buddy I'm sending her that info and hopefully she can resolve it.

* it just sent me another one today.

[Anthony P]

The issue with e-mail is that it can easily be faked. All someone needs is your mom's e-mail address and they can send an email to you that says it is coming from your mom. So the first thing to do is make sure it is from your mom here is one link that might help http://www.makeuseof.com/tag/how-to-...to-the-source/

this should help you find out if it is really coming from your mom or not. It could be that it is a scam/joke that is pretending it is from her or even a virus on your own PC

[supersix4]

Originally Posted by Anthony P

The issue with e-mail is that it can easily be faked. All someone needs is your mom's e-mail address and they can send an email to you that says it is coming from your mom. So the first thing to do is make sure it is from your mom here is one link that might help http://www.makeuseof.com/tag/how-to-...to-the-source/

this should help you find out if it is really coming from your mom or not. It could be that it is a scam/joke that is pretending it is from her or even a virus on your own PC

Thanks I'll check that out... Would it be worth it for her to close the account and start over? If this or the Yahoo security can't do anything?

[Anthony P]

Originally Posted by supersix4

Thanks I'll check that out... Would it be worth it for her to close the account and start over? If this or the Yahoo security can't do anything?

don't know, I would guess it would depend in finding out first what is happening. If someone has access to her e-mail then I think it probably would be, but in theory she should be able to change her PW and that should be the end of it, but if not, it might not help for example if she logs in at the local internet cafe/library/public PC and clicks on remember my PW, the new account will soon have the same problem. The issue with changing e-mails is that if you do use it, then you need to let everyone know. I think something else that can be done is to have multiple accounts where important stuff are cut out from shopping and from friends.

[supersix4]

Originally Posted by Anthony P

don't know, I would guess it would depend in finding out first what is happening. If someone has access to her e-mail then I think it probably would be, but in theory she should be able to change her PW and that should be the end of it, but if not, it might not help for example if she logs in at the local internet cafe/library/public PC and clicks on remember my PW, the new account will soon have the same problem. The issue with changing e-mails is that if you do use it, then you need to let everyone know. I think something else that can be done is to have multiple accounts where important stuff are cut out from shopping and from friends.

My neighbor who were good friends with recently got a job at bestbuy working for geeksquad anyway he came over with some of there gear and did some stuff for 4 or 5 hours and he told her even after my full restore there were "43 viruses in there" so with that gone now I'm wondering whats going to happen.

[tilallr1]

So is the problem gone now?

Something I thought about ... Do you have a web based email?

If so, just change your password and delete everything from junk and trash and it should stop the spam sending virus.

[supersix4]

Originally Posted by tilallr1

So is the problem gone now?

Something I thought about ... Do you have a web based email?

If so, just change your password and delete everything from junk and trash and it should stop the spam sending virus.

Yeah it hasn't sent anything recently, but again its kind of a wait and see thing since sometimes it doesn't do it for weeks I'll update if something else happens I'm hoping its over though.

[atomik kinder]

My sister has had a similar thing happen to her Hotmail account. I got an e-mail from her today while I was at work. She was at work also and claimed her computer was powered down. I believe her account was hijacked as you could see the items in her sent box.